CODEWITHSUNDEEP
linuxnetwork-programmingtcpdump
Dolphin
Dolphin

Reputation: 39095

How to display all data using tcpdump?

I am capturing network traffic by using tcpdump. The problem is: I can't see all capture data when the package is too long. For example, when the tcp frame length is more than 500, I just see 100-200 or less. How to display all frame data(500+)?

I have tried add -vv and -vvv parameter. This is my current command:

 tcpdump -i eth1 tcp and host 10.27.13.14 and port 6973 -vv -X -c 1000

Upvotes: 9

Views: 69085

Answers (2)

nitwit
nitwit

Reputation: 586

tcpdump -i any -A -s0 port 80

  • listens to port 80
  • -i any: on any interface (replace with e.g., -i eth0)
  • -A prints packet contents
  • -s0 set snapshot length (0 means the whole packer, removing this option will use the default value, often 96)

Upvotes: 0

Dolphin
Dolphin

Reputation: 39095

Add -s0 parameter:

tcpdump -i eth1 tcp and host 10.27.13.14 and port 6973 -s0 -vv -X -c 1000

Upvotes: 21

Related Questions