Tcpdump usage examples

Tcpdump usage examples

October 1, 2014

In most cases you will need root permission to be able to capture packets on an interface. Using tcpdump (with root) to capture the packets and saving them to a file to analyze with Wireshark (using a regular account) is recommended over using Wireshark with a root account to capture packets on an "untrusted" interface. See the Wireshark security advisories for reasons why.
See the list of interfaces on which tcpdump can listen:

tcpdump -D

Listen on interface eth0:

tcpdump -i eth0

Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater):

tcpdump -i any

Be verbose while capturing packets:

tcpdump -v

Be more verbose while capturing packets:

tcpdump -vv

Be very verbose while capturing packets:

tcpdump -vvv

Be verbose and print the data of each packet in both hex and ASCII, excluding the link level header:

tcpdump -v -X

Be verbose and print the data of each packet in both hex and ASCII, also including the link level header:

tcpdump -v -XX

Be less verbose (than the default) while capturing packets:

tcpdump -q

Limit the capture to 100 packets:

tcpdump -c 100

Record the packet capture to a file called capture.cap:

tcpdump -w capture.cap

Record the packet capture to a file called capture.cap but display on-screen how many packets have been captured in real-time:

tcpdump -v -w capture.cap

Display the packets of a file called capture.cap:

tcpdump -r capture.cap

Display the packets using maximum detail of a file called capture.cap:

tcpdump -vvv -r capture.cap

Display IP addresses and port numbers instead of domain and service names when capturing packets (note: on some systems you need to specify -nn to display port numbers):

tcpdump -n

Capture any packets where the destination host is 192.168.1.1. Display IP addresses and port numbers:

tcpdump -n dst host 192.168.1.1

Capture any packets where the source host is 192.168.1.1. Display IP addresses and port numbers:

tcpdump -n src host 192.168.1.1

Capture any packets where the source or destination host is 192.168.1.1. Display IP addresses and port numbers:

tcpdump -n host 192.168.1.1

Capture any packets where the destination network is 192.168.1.0/24. Display IP addresses and port numbers:

tcpdump -n dst net 192.168.1.0/24

Capture any packets where the source network is 192.168.1.0/24. Display IP addresses and port numbers:

tcpdump -n src net 192.168.1.0/24

Capture any packets where the source or destination network is 192.168.1.0/24. Display IP addresses and port numbers:

tcpdump -n net 192.168.1.0/24

Capture any packets where the destination port is 23. Display IP addresses and port numbers:

tcpdump -n dst port 23

Capture any packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:

tcpdump -n dst portrange 1-1023

Capture only TCP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:

tcpdump -n tcp dst portrange 1-1023

Capture only UDP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:

tcpdump -n udp dst portrange 1-1023

Capture any packets with destination IP 192.168.1.1 and destination port 23. Display IP addresses and port numbers:

tcpdump -n "dst host 192.168.1.1 and dst port 23"

Capture any packets with destination IP 192.168.1.1 and destination port 80 or 443. Display IP addresses and port numbers:

tcpdump -n "dst host 192.168.1.1 and (dst port 80 or dst port 443)"

Capture any ICMP packets:

tcpdump -v icmp

Capture any ARP packets:

tcpdump -v arp

Capture either ICMP or ARP packets:

tcpdump -v "icmp or arp"

Capture any packets that are broadcast or multicast:

tcpdump -n "broadcast or multicast"

Capture 500 bytes of data for each packet rather than the default of 68 bytes:

tcpdump -s 500

Capture all bytes of data within the packet:

tcpdump -s 0

Article first published March 13, 2010. Last updated October 1, 2014.

Topology settings are grayed out in SmartDashboard for an interface of a VSX object

Symptoms

• Topology settings are grayed out in SmartDashboard for an interface of a VSX Gateway / VSX Cluster / Virtual System / Virtual Router object (SmartDashboard - VSX object - 'Topology' pane - select an interface - click on 'Edit...' - go to 'Topology' tab - refer to 'Topology' settings)

Cause

The box "Calculate topology automatically based on routing information" is checked in the object of VSX Gateway / VSX Cluster / Virtual System / Virtual Router.

How to terminate a vlan on ASR 9000 and bridge it to a port on asr 9000

we want to use the ASR to connect a client which has no vlan tag and add a vlan tag 100 on it when the traffic goes out from ASR to internet.


CLIENT --------- ASR ------TRUNK-------Internet PE


Here the configuration example:

!
interface GigabitEthernet0/0/0/0.100 l2transport
  encapsulation dot1q 100
  rewrite ingress tag pop 1 symmetric
!

!
interface GigabitEthernet0/0/0/1
  l2transport
!

!
l2vpn
!
bridge group cust1
  bridge-domain cust1
   interface GigabitEthernet0/0/0/0.100
   interface GigabitEthernet0/0/0/1
!  

• GigabitEthernet0/0/0/1 is the access port (untagged).
• interface GigabitEthernet0/0/0/0.100 accepts tagged frames with vlan 100.
• L2vpn bridge-domain cust1 connects both interfaces together.
• GigabitEthernet0/0/0/0.100 has tag rewrite operation. Removing tag on ingress, so sending untagged to GigabitEthernet0/0/0/1, and pushing tag 100 on egress, so untagged frames from gi0/0/0/1 got tagged

How to solve the truncate problem of Thunderbird

(1)happen randomly
(2)it truncates my response and forward messages


solution:

(1) every time reply, do a ctrl+A, select all , then click reply, it will include all the messages

(2)
 From web:

Google shows this question asked hundreds of times. There are many work-arounds and bug reports on this.
However it isn't a bug. It's a feature. The feature is intended to truncate unwanted signatures from Usenet (forum) posts. The signature is signified by a double hyphen and a space on a line by itself "-- ".
You can turn this feature off in Thunderbird's configuration by:

Advance -> Config Editor -> [I'll be careful] -> (search for) mail.strip_sig_on_reply -> [toggle it to false].

By the way, I spend about an hour searching for how to do this on every Thunderbird install. Hopefully this definitive answer will save Thunderbird users time.

how to add the interface to Wireshark

https://ask.wireshark.org/questions/7523/ubuntu-machine-no-interfaces-listed


how to add the interface to Wireshark

the  commands work for me with Wireshark 1.6.2 on Ubuntu Server 11.10 (64-bit):

$ sudo apt-get install wireshark
$ sudo dpkg-reconfigure wireshark-common 
$ sudo usermod -a -G wireshark $USER
$ sudo reboot

Retrofit 经验

1. 在网站查了很久，没有任何人说过》

 Retrofit  不支持本地地址localhost或者127.0.0.1.我尝试了很久，也找不到答案。后来换成本地实际地址http://192.168.104.241/mylogin/，就搞定了

2.Retrofit2 的baseUlr 必须以 /（斜线） 结束，不然会抛出一个IllegalArgumentException,所以如果你看到别的教程没有以 / 结束，那么多半是直接从Retrofit 1.X 照搬过来的。
如果baseUrl有了斜线，那么后面的relative前面不要加斜线。

其他的别人讲的都很详细，请参考。

http://www.jianshu.com/p/7687365aa946
http://www.itdadao.com/articles/c15a1018518p0.html
http://www.jianshu.com/p/308f3c54abdd

MYSQl -- Unintall and install

How to uninstall:

sudo apt-get purge mysql-server mysql-client mysql-common mysql-server-core-5.5 mysql-client-core-5.5
sudo rm -rf /etc/mysql /var/lib/mysql
sudo apt-get autoremove
sudo apt-get autoclean

How to install

1.  install the latest version:
   

   
   sudo apt-get update
   
   sudo apt-get install mysql-server
   
   
   

2.  then configure the MySQL:

We'll initialize the MySQL data directory, which is where MySQL stores its data. How you do this depends on which version of MySQL you're running. You can check your version of MySQL with the following command.

mysql --version

You'll see some output like this:

Output

mysql  Ver 14.14 Distrib 5.7.17, for Linux (x86_64) using  EditLine wrapper

 If you're using version 5.7.6 or later, you should use mysqld --initialize instead.

However, if you installed version 5.7 from the Debian distribution, like in step one, the data directory was initialized automatically, so you don't have to do anything.

Regardless of how you installed it, MySQL should have started running automatically. To test this, check its status.

service mysql status

You'll see the following output (with a different PID).

Output

mysql start/running, process 2689

If MySQL isn't running, you can start it with sudo service mysql start.
For an additional check, you can try connecting to the database using the mysqladmin tool, which is a client that lets you run administrative commands. For example, this command says to connect to MySQL as root (-u root), prompt for a password (-p), and return the version.

mysqladmin -p -u root version

You should see output similar to this:

Output

mysqladmin  Ver 8.42 Distrib 5.5.47, for debian-linux-gnu on x86_64
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Server version      5.5.47-0ubuntu0.14.04.1
Protocol version    10
Connection      Localhost via UNIX socket
UNIX socket     /var/run/mysqld/mysqld.sock
Uptime:         4 min 15 sec

Threads: 1  Questions: 602  Slow queries: 0  Opens: 189  Flush tables: 1 

 Open tables: 41  Queries per second avg: 2.360

This means MySQL is up and running.

You can edit the /etc/mysql/my.cnf file to configure the basic settings -- log file, port number, etc. For example, to configure MySQL to listen for connections from network hosts, change the bind-address directive to the server's IP address:

bind-address            = 192.168.0.5

Replace 192.168.0.5 with the appropriate address.

After making a change to /etc/mysql/mysql.conf.d/mysqld.cnf the MySQL daemon will need to be restarted:

sudo systemctl restart mysql.service

If you would like to change the MySQL root password, in a terminal enter:

sudo dpkg-reconfigure mysql-server-5.5

The MySQL daemon will be stopped, and you will be prompted to enter a new password. 

[mysqld]
#
# * Basic Settings
#
user        = mysql
pid-file    = /var/run/mysqld/mysqld.pid
socket        = /var/run/mysqld/mysqld.sock
port        = 3306
basedir        = /usr
datadir        = /var/lib/mysql
tmpdir        = /tmp
lc-messages-dir    = /usr/share/mysql
skip-external-locking