Re: tcpdump how to? (darwin ne Wade Williams <email@hidden>wbie)
Re: tcpdump how to? (darwin ne Wade Williams <email@hidden>wbie)
- Subject: Re: tcpdump how to? (darwin ne Wade Williams <email@hidden>wbie)
- From: Josh Graessley <email@hidden>
- Date: Wed, 06 Mar 2002 15:28:26 -0800
On 3/6/02 2:44 PM, "Wade Williams" <email@hidden> wrote:
>
W>hen I looked at the man page for tcpdump, I thought it was saying
>
> that it only shows packet headers, not entire packets, hence the need
>
> for tcpflow. But maybe I was mistaken. (I'm pretty much a Darwin
>
> newbie too.)
>
>
You were not mistaken. TCPDump shows only headers. You need tcpflow if you
>
wish to see packet data.
Actually, that's not entirely true. You can use the -s option to specify the
maximum length of packet data to display and -X to display the packets
contents.
example:
sudo tcpdump -s 1500 -nXi en0
The -n as noted before keeps tcpdump from wasting it's time and yours
looking up the names of addresses.
-josh
_______________________________________________
macnetworkprog mailing list | email@hidden
Help/Unsubscribe/Archives:
http://www.lists.apple.com/mailman/listinfo/macnetworkprog
Do not post admin requests to the list. They will be ignored.