3

Is there a way to stop tcpdump from (mis)interpreting protocols in captured packets?

It assumes that traffic coming from port 4500/udp is always IPSec traffic, 53/udp is DNS query, etc and tries to decode it. That's a problem for me because I can't parse the output properly.

dawud
  • 14,918
  • 3
  • 41
  • 61
aqz
  • 53
  • 1
  • 4

1 Answers1

4

You can use the '-q' option to remove the content decoding. You can maybe add the '-A' to see in ASCII the content of the packets, or -dd to see in C format.

Dom
  • 6,628
  • 1
  • 19
  • 24