Hide

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.


If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Hide

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

Hide

News

2011-03-12 - Confoo 2011 presentation
Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands
To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner
Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed
Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.
Hide

Tags

Hide

Functions

Commands using tcpdump from sorted by
Terminal - Commands using tcpdump - 42 results
tcpdump -nni eth0 -e icmp[icmptype] == 8
2014-06-08 18:13:24
User: siamware
Functions: tcpdump
2

capture only ping echo requests with tcpdump

sudo tcpdump -i wlan0 -n ip | awk '{ print gensub(/(.*)\..*/,"\\1","g",$3), $4, gensub(/(.*)\..*/,"\\1","g",$5) }' | awk -F " > " '{print $1"\n"$2}'
tcpdump host <IP> -nXXv -s0 -w file.pcap
tcpdump -nvvX -s 768 src x.x.x.x and dst port 80
tcpdump -i eth0 -w - | ssh forge.remotehost.com -c arcfour,blowfish-cbc -C -p 50005 "cat - | gzip > /tmp/eth0.pcap.gz"
2013-05-30 07:41:22
User: bhbmaster
Functions: ssh tcpdump
Tags: ssh tcpdump gzip
0

NOTE: When opening the files you might need to strip the very top line with notepad++ as its a mistake header

This is useful when the local machine where you need to do the packet capture with tcpdump doesn?t have enough room to save the file, where as your remote host does

tcpdump -i eth0 -w - | ssh forge.remotehost.com -c arcfour,blowfish-cbc -C -p 50005 "cat - | gzip > /tmp/eth0.pcap.gz"

Your @ PC1 doing a tcpdump of PC1s eth0 interface and its going to save the output @ PC2 who is called save.location.com to a file /tmp/eth0-to-me.pcap.gz again on PC2

More info @: http://www.kossboss.com/linuxtcpdump1

tcpdump -i eth0 -w - | ssh savelocation.com -c arcfour,blowfish-cbc -C -p 50005 "cat - > /tmp/eth0.pcap"
2013-05-30 07:33:48
User: bhbmaster
Functions: ssh tcpdump
Tags: ssh tcpdump
0

This is useful when the local machine where you need to do the packet capture with tcpdump doesn?t have enough room to save the file, where as your remote host does

tcpdump -i eth0 -w - | ssh savelocation.com -c arcfour,blowfish-cbc -C -p 50005 "cat - > /tmp/eth0.pcap"

Your @ PC1 doing a tcpdump of PC1s eth0 interface and its going to save the output @ PC2 who is called save.location.com to a file /tmp/ppp1-to-me.pcap.gz again on PC2

More info @: http://www.kossboss.com/linuxtcpdump1

tcpdump -l -s0 -w - tcp dst port 25 | strings | grep -i 'MAIL FROM\|RCPT TO'
2013-03-18 18:55:20
User: ene2002
Functions: grep strings tcpdump
3

This works just as well for SMTP. You could run this on your mail server to watch e-mail senders and recipients:

tcpdump -l -s0 -w - tcp dst port 25 | strings | grep -i 'MAIL FROM\|RCPT TO'

tcpdump -i eth0 -s 65535 -w test_capture
tcpdump -i eth0 port http or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|userna me:|password:|login:|pass |user '
tcpdump -s 1024 -l -A -n host 192.168.9.56
2013-02-02 22:29:52
User: wejn
Functions: host tcpdump
Tags: http tcpdump
-1

This is a better way to do the "src X or dst X" filter; plus you might not want to bother with DNS lookups (-n).

tcpdump -s 1024 -l -A src 192.168.9.56 or dst 192.168.9.56
2013-02-01 15:03:12
User: bleiva
Functions: tcpdump
Tags: http tcpdump
0

Where src or dst is the host that you want to view the HTTP header.

tcpdump src <srcIP> and dst <dstIP> -w file.pcap
tcpdump -ntr NAME_OF_CAPTURED_FILE.pcap 'tcp[13] = 0x02 and dst port 80' | awk '{print $4}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2 "\t" $1 }'
tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
2012-06-18 19:27:54
User: jseidl
Functions: egrep ftp tcpdump
1

Simple TCPDUMP grepping for common unsafe protocols (HTTP, POP3, SMTP, FTP)

tcpdump -A -s 0 port 80
2012-02-22 14:17:45
User: rik
Functions: tcpdump
1

Trace and view network traffic. I made this far too complicated.. now fixed, thanks zolden.

ssh user@server.com sudo tcpdump -i eth0 -w - 'port 80'| /Applications/Wireshark.app/Contents/Resources/bin/wireshark -k -i -
tcpdump -w - |pv -bert >/dev/null
2011-12-14 00:24:02
User: h3xx
Functions: tcpdump
7

Real gurus don't need fancy tools like iftop or jnettop.

tcpdump -i eth0 -n | head
2011-12-06 18:34:51
User: anarcat
Functions: tcpdump
0

Sometimes it is useful to have just a general picture of "what is taking all the bandwidth here". Running this command will limit tcpdump to a few packets (instead of flooding your terminal endlessly) and will provide a small, but sometimes sufficient, sample to determine what is going on.

Useful to quickly diagnose DOS attacks.

bzcat ext_if.log.0.bz2 | tcpdump -n -e -tttt -r - | less
sudo tcpdump -n -i eth0 -w data.pcap -v tcp or udp and 'not host 192.168.1.2'
ssh root@HOST tcpdump -iany -U -s0 -w - 'not port 22' | wireshark -k -i -
2011-09-13 21:10:40
User: dr3s
Functions: ssh tcpdump
0

analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering and -iany to see all interfaces.

tcpdump | aplay -c 2
2011-08-27 15:03:02
User: sxiii
Functions: aplay tcpdump
0

Outputs pseudo-random sounds to speakers (stereo mode because of -c 2) when there are any kind of network activity.

sudo tcpdump -i en0 'udp port 53'
tcpdump -nr capture.file | awk '{print }' | grep -oE '[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}' | sort | uniq -c | sort -n
2011-06-16 19:27:11
User: shahabv
Functions: awk grep sort tcpdump uniq
Tags: tcpdump
0

We can get useful statistics from tcpdump with this simple command.

Thanks "Babak Farrokhi" to teaching me this ;)

tcpdump -w "$(sed 's/-//gi; s/ /_/gi'<<<"-vvv -s0 -ieth1 -c10 icmp").pcap"