tcpdump

Question

Level 4

1,047 points

tcpdump

I hav a Mac Pro running 10.6.1 behind a router. I'm trying to capture any traffic on just port 80, but no matter what command I use, no packets are captured.

Can someone tell me what I'm doing wrong?

Mac OS X (10.6.1)

Posted on Oct 21, 2009 10:27 PM

Reply

Answer 1

Oct 22, 2009 12:32 AM in response to Jeffrey Ellis

Any luck with this one? I bet you tried it already. sudo tcpdump -v -i en0 -s 0 port 80

Reply

Answer 2

Jeffrey Ellis Author

Level 4

1,047 points

Oct 22, 2009 6:01 AM in response to doug pennington

Hi, Doug--

Yes, indeed. Actually, I've tried a bunch of different port listeners of various stripes, and all give me absolutely nothing for any tcp activity whatsoever.

There must be something about my setup which is causing this.

Here's my specifics:

Mac Pro 2.28 Intel dual core
10.6.1
Cable modem receiving a dynamically assigned IP-->Router farming out int. addresses with range 192.168.2.2-100
The Mac has a Manually assigned int. IP of 192.168.2.5.
And is connecting wirelessly to the router.
All internet services, web, email, anything else I've tried, seems to be working normally.

Reply

Answer 3

etresoft

Level 8

46,894 points

Oct 22, 2009 8:19 AM in response to Jeffrey Ellis

I really don't know tcpdump, but Doug's command generated quite a bit of data for me. It seems to look for any TCP activity involving port 80, so just firing up Safari generated lots of output. I did have to change "en0" to "en1" to use my wireless interface instead of the ethernet.

Reply

Answer 4

Oct 22, 2009 9:15 AM in response to Jeffrey Ellis

As etresoft pointed out, you have to make sure you specify the right interface to capture on. Obviously the man pages have a lot info. Try 'man pcap-filter' for the tcpdump filter syntax.

Reply

Answer 5

Oct 22, 2009 9:16 AM in response to Jeffrey Ellis

Jeffrey, try en1 yet this am as suggested by etresoft and what about firewall's?

Reply

Answer 6

Oct 22, 2009 9:28 AM in response to Jeffrey Ellis

If you're not sure which interface is active, you could run the following:
<pre style="border: 1px solid #ddd; padding-left: .75ex; padding-top: .25em; padding-bottom: .25em; margin-top: .5em; margin-bottom: .5em; margin-left: 1ex; max-width: 60ex; overflow: auto; font-size: 10px; font-family: Monaco, 'Courier New', Courier, monospace; color: #444; background: #eee; line-height: normal">netstat -rnfinet | sed -n 's/^default.* //p'</pre>

Or just try this:
<pre style="border: 1px solid #ddd; padding-left: .75ex; padding-top: .25em; padding-bottom: .25em; margin-top: .5em; margin-bottom: .5em; margin-left: 1ex; max-width: 60ex; overflow: auto; font-size: 10px; font-family: Monaco, 'Courier New', Courier, monospace; color: #444; background: #eee; line-height: normal">sudo tcpdump -Xns0 -i`netstat -rnfinet | sed -n 's/^default.* //p'`</pre>

The X option displays hex and ascii data.

Reply

Answer 7

Jeffrey Ellis Author

Level 4

1,047 points

Oct 22, 2009 1:35 PM in response to Cole Tierney

I just tried sudo tcpdump -Xns0 -i`netstat -rnfinet | sed -n 's/^default.* //p'`

(How are you doing that code insertion, BTW?)

And that gives a syntax error.

However netstat -rnfinet | sed -n 's/^default.* //p'

Gives this as a result:

bash-3.2# netstat -rnfinet | sed -n 's/^default.* //p'
en2
en3
en4

So I then tried on en2 and it worked. So thank you 🙂

I'm still not seeing the information I need, however. All that's coming in is stuff like this:

13:32:38.340152 IP 69.12.107.205.http > 192.168.2.5.62568: Flags [.], ack 6990, win 65535, options [nop,nop,TS val 51353994 ecr 346378498], length 0

What I'm actually looking for is the url that's being sent to the http server. Is there a command parameter to capture that?

Reply

Answer 8

Oct 22, 2009 2:00 PM in response to Jeffrey Ellis

(How are you doing that code insertion, BTW?)

Anything enclosed in back tick characters (`) is evaluated first. (Incidentally I just discovered that php treats back ticks the same way. Cool!)

And that gives a syntax error.

That makes sense to me since you appear to have multiple default routes. My mac only returns one.

What I'm actually looking for is the url that's being sent to the http server. Is there a command parameter to capture that?

You may see the url if you use the -A option with your tcpdump command. If you don't mind compiling from source another similar program is tcpflow. It reassembles the packets which makes it easier to look at.

Reply

Answer 9

Camelot

Level 9

54,339 points

Oct 22, 2009 2:28 PM in response to Jeffrey Ellis

You're clearly not providing the right switches to tcpdump. Since you omit the actual command you are using, you're asking everyone to work blindly to solve your issue.

Instead, please post the actual command you're trying to use. I'm sure someone will see the problem from there.

Reply

Answer 10

Jeffrey Ellis Author

Level 4

1,047 points

Oct 22, 2009 4:57 PM in response to Cole Tierney

Hm. I tried the (`) thing and it isn't working...

`Here's a sample`

The -A did it. Thanks again 🙂

Oh, and here's my command:

sudo tcpdump -A -v -i en2 -s 0 port 80

Reply