How do I make tcpdump not print the tcp headers?

Question

I tried this:

tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'

I need only the ascii part of it. How do I remove the rest?

with tshark you can do it with: tshark -l -i eth0 -f 'port 6667 and greater 74' -T field -e data — Marcin, Nov 28 '10 at 17:02
It says 28 packets captured but doesn't print anything to STDOUT. — coder, Nov 29 '10 at 16:47

score 18 · Answer 1 · edited May 06 '16 at 13:39

18

As Josh suggests, tcpflow can print just the TCP packet data to a file or STDOUT. You can pipe tcpdump to tcpflow like this:

tcpdump -i lo -l -w - port 23 | tcpflow -C -r -

To only view one side of the conversation, you can use filters for tcpdump, e.g. dst port 23.

edited May 06 '16 at 13:39

Keiji

103
2

answered Feb 18 '14 at 03:02

jwmullally

281
2
2

4

Why would you need to start `tcpflow` as root? – Ruslan Mar 13 '14 at 08:56

score 11 · Answer 2 · answered Jun 25 '17 at 22:29

11

I feel the most elegant solution is just to ditch tcpdump. No pipes of any kind:

tcpflow -c port 6667

And that's it.

answered Jun 25 '17 at 22:29

BarsMonster

644
3
11
24

1

You saved my life, I want to buy you a cookie – gdaras Dec 10 '18 at 13:25
And you can use `-D` to print the data in hex, in case your traffic isn't textual. – Ruslan Dec 04 '20 at 05:45

score 5 · Answer 3 · answered Apr 14 '11 at 15:01

I'm not sure about the exact syntax for tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than tcpdump.

score 4 · Answer 4 · answered Apr 14 '11 at 15:34

A quick and dirty way to do this is to filter the output through strings:

tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings

Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.

Mircea Vutcovici · Answer 5 · 2011-04-14T16:14:26.900

1

If you need only the ASCII part you can use: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'|sed 's/\.//g' or with ngrep: ngrep -d eth0 -lq . '(port 6667) and (length > 74)' |sed -rn '/^ /s/\.//gp'

edited Apr 14 '11 at 16:14

answered Apr 14 '11 at 16:04

Mircea Vutcovici

16,706
4
52
80

score 1 · Answer 6 · answered Jul 30 '11 at 21:00

1

I had the same problem last week - I used the wireshark gui instead and did a "copy readable ascii" for the interesting packets.

I was (successfully) trying to pin down a problem with a http request to a web-service and its XML-answer.

answered Jul 30 '11 at 21:00

Nils

7,657
3
31
71

How do I make tcpdump not print the tcp headers?

6 Answers6

Linked