Commands using tcpdump

This works just as well for SMTP. You could run this on your mail server to watch e-mail senders and recipients:

tcpdump -l -s0 -w - tcp dst port 25 | strings | grep -i 'MAIL FROM\|RCPT TO'

This is a better way to do the "src X or dst X" filter; plus you might not want to bother with DNS lookups (-n).

Where src or dst is the host that you want to view the HTTP header.

then open with wireshark

Simple TCPDUMP grepping for common unsafe protocols (HTTP, POP3, SMTP, FTP)

Trace and view network traffic. I made this far too complicated.. now fixed, thanks zolden.

commandline for mac os x

Real gurus don't need fancy tools like iftop or jnettop.

Sometimes it is useful to have just a general picture of "what is taking all the bandwidth here". Running this command will limit tcpdump to a few packets (instead of flooding your terminal endlessly) and will provide a small, but sometimes sufficient, sample to determine what is going on.

Useful to quickly diagnose DOS attacks.

analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering and -iany to see all interfaces.

Outputs pseudo-random sounds to speakers (stereo mode because of -c 2) when there are any kind of network activity.

We can get useful statistics from tcpdump with this simple command.

Thanks "Babak Farrokhi" to teaching me this ;)

The tcpdump arguments are just an example.

View all memcache traffic

Sometimes the question comes up: How to get unbuffered tcpdump output into the next program in the pipe? i.e. if your OS forces you to wait for the buffer to fill before the next program sees any of the output

If you use -Uw- then you can't use -A (or -X or -XX) at the same time.

When the question comes up, I've never seen anyone suggest this simple solution: chaining 2 tcpdump instances.

The command is useful for monitoring the use of the boxes and their connection IP.

Result file "sniff" is readable with GUI program "wireshark" or through CLI with the command:

tcpdump -f "sniff" -XX

When using tcpdump, specify -U option to prevent buffering.

Default output-file is "liveh.txt".

This uses only BRE, in case you're using an older version of sed(1) that doesn't have support for ERE added.

With a modern sed(1), to reduce false positive matches, you might do something like:

liveh(){ tcpdump -lnnAs512 -i ${1-} tcp |sed 's/.*GET /GET /;s/.*Host: /Host: /;s/.*POST /POST /;/GET |Host: |POST /!d;/[\"'"'"]/d;/\.\./d;w '"${2-liveh.txt}"'' >/dev/null ;}

Anyway, it's easy to clean up the output file with sed(1) later.

You don't need this command often and there are other ways to test output but if you want to be sure if your router and ethernet card are working this is one way.