5 ms·

Tcpdump is amazing. The quickness that you can have with it over Wireshark is awesome. I love that it is a command line tool instead of a GUI tool, since I need

Tcpdump is amazing. The quickness that you can have with it over Wireshark is awesome. I love that it is a command line tool instead of a GUI tool, since I needed to analyze TCP packets for quick debugging purposes. But for the people who are new(ish) to tcpdump have you heard of libnet and libpcap? You can basically build your own tcpdump! :D I was amazed at the speed packets fire when you program it yourself in C. See: https://github.com/the-tcpdump-group/libpcap https://github.com/the-tcpdump-group/libpcap <-- CAPturing packets https://github.com/sam-github/libnet https://github.com/sam-github/libnet <-- sending packets Libnet tutorial that I used religiously: https://repolinux.wordpress.com/2011/09/18/libnet-1-1-tutorial/#example-5 https://repolinux.wordpress.com/2011/09/18/libnet-1-1-tutori...

swalberg 11y ago
Wireshark also comes with "tshark" which is a CLI tool that gives you access to display filters and some of the GUI features. In particular, it's great for scripting if you're trying to pull some stats while troubleshooting.
- mettamage 11y ago
  I never knew, thanks :)
  - deleted 11y ago
    [deleted]
- s_q_b 11y ago
  Tcpdump is cool, tshark is cool, but nothing beats raw libpcap for grabbing raw data off the wire. It is simply so stable at high throughput it's often the only option. Wireshark starts to break down at a certain point. When that happens, I've found scapy (Python pcap parser) very useful. Once that breaks down, a good option reading the hex directly in C. Once that breaks down... Well, there be dragons.
  - richardwhiuk 11y ago
    Got to add dpkt to this list for parsing pcap streams - allows you to write some awesome python analysis tools - e.g. For this 5GB packet capture find me all the streams where tcp packets were retransmitted more than twice.
    - s_q_b 11y ago
      Dpkt is also a very good, although I've had some bugs with it on Mac. Probably just odd network issues.
- jcbeard 11y ago
  If you use VM's for this sort of thing, having images laying around like: https://security-onion-solutions.github.io/security-onion/ https://security-onion-solutions.github.io/security-onion/ gives you most of the tools you'd need (wireshark, scapy, etc. in one place). Seems to be the best way to go for me (Mac laptop user).
- theptip 11y ago
  I use tshark for capturing a lot, it's great. One of the big advantages for me is that it allows you to use the more expressive (and familiar) wireshark filter syntax, e.g. tshark -i eth0 -Y ip.addr==8.8.8.8 Instead of having to remember tcpdump's own fiddly syntax. Given that most of my protocol debugging work is done inside Wireshark, I'm much more fluent in that filter language. Note that the above snippet is a display filter, so it's capturing all the packets on the wire, doing a full dissection, and then running them through a filter before printing them; if you're trying to capture on a saturated 1G link you might need to fall back to the capture filters which are simpler and faster (and I believe also use tcpdump's syntax).
  - SwellJoe 11y ago
    Wireshark syntax is also fiddly. It's just more familiar for some folks. The first several years of my experience troubleshooting network problems happened when Wireshark didn't exist, but tcpdump did. I still have better recollection and comprehension of tcpdump syntax than Wireshark. I have to read the docs to use either these days (since I don't work at that layer of the network much anymore), but I have to read longer to make Wireshark do what I want. Sometimes "ease of use" is really just "what I'm used to". (Not saying Wireshark isn't more expressive or more powerful...it probably is. But, I usually have a very basic use case, and tcpdump can do it with a couple of flags and an address or port.)
- knoxa2511 11y ago
  Have you used sysdig? https://github.com/draios/sysdig https://github.com/draios/sysdig Its creator was one of the guys behind wireshark. They're pitching sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce. They have csysdig which is similar to tshark
carlosnunez 11y ago
> I was amazed at the speed packets fire when you program it yourself in C. For sure. There's no better way of learning the protocols than writing your own network sniffer. Even writing a crappy one like the one that a few folks and I put together in college will teach you a lot about how each protocol behaves and what to look for: https://github.com/carlosonunez/nbfm-sniffer https://github.com/carlosonunez/nbfm-sniffer
entelechy0 11y ago
Real-talk: I spent 2 semesters with wireshark, tcpdump, AND libpcap in college back in 2007-8. Now I'm in an environment where I get to use them professionally :D !!!
clinta 11y ago
And tcpdump already exists on every server. I frequently pipe the output of tcpdump over ssh into wireshark for analysis on my local machine. ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -

swalberg 11y ago

Wireshark also comes with "tshark" which is a CLI tool that gives you access to display filters and some of the GUI features. In particular, it's great for scripting if you're trying to pull some stats while troubleshooting.

mettamage 11y ago
I never knew, thanks :)
- deleted 11y ago
  [deleted]
s_q_b 11y ago
Tcpdump is cool, tshark is cool, but nothing beats raw libpcap for grabbing raw data off the wire. It is simply so stable at high throughput it's often the only option. Wireshark starts to break down at a certain point. When that happens, I've found scapy (Python pcap parser) very useful. Once that breaks down, a good option reading the hex directly in C. Once that breaks down... Well, there be dragons.
- richardwhiuk 11y ago
  Got to add dpkt to this list for parsing pcap streams - allows you to write some awesome python analysis tools - e.g. For this 5GB packet capture find me all the streams where tcp packets were retransmitted more than twice.
  - s_q_b 11y ago
    Dpkt is also a very good, although I've had some bugs with it on Mac. Probably just odd network issues.
jcbeard 11y ago
If you use VM's for this sort of thing, having images laying around like: https://security-onion-solutions.github.io/security-onion/ https://security-onion-solutions.github.io/security-onion/ gives you most of the tools you'd need (wireshark, scapy, etc. in one place). Seems to be the best way to go for me (Mac laptop user).
theptip 11y ago
I use tshark for capturing a lot, it's great. One of the big advantages for me is that it allows you to use the more expressive (and familiar) wireshark filter syntax, e.g. tshark -i eth0 -Y ip.addr==8.8.8.8 Instead of having to remember tcpdump's own fiddly syntax. Given that most of my protocol debugging work is done inside Wireshark, I'm much more fluent in that filter language. Note that the above snippet is a display filter, so it's capturing all the packets on the wire, doing a full dissection, and then running them through a filter before printing them; if you're trying to capture on a saturated 1G link you might need to fall back to the capture filters which are simpler and faster (and I believe also use tcpdump's syntax).
- SwellJoe 11y ago
  Wireshark syntax is also fiddly. It's just more familiar for some folks. The first several years of my experience troubleshooting network problems happened when Wireshark didn't exist, but tcpdump did. I still have better recollection and comprehension of tcpdump syntax than Wireshark. I have to read the docs to use either these days (since I don't work at that layer of the network much anymore), but I have to read longer to make Wireshark do what I want. Sometimes "ease of use" is really just "what I'm used to". (Not saying Wireshark isn't more expressive or more powerful...it probably is. But, I usually have a very basic use case, and tcpdump can do it with a couple of flags and an address or port.)
knoxa2511 11y ago
Have you used sysdig? https://github.com/draios/sysdig https://github.com/draios/sysdig Its creator was one of the guys behind wireshark. They're pitching sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce. They have csysdig which is similar to tshark

carlosnunez 11y ago

> I was amazed at the speed packets fire when you program it yourself in C. For sure. There's no better way of learning the protocols than writing your own network sniffer. Even writing a crappy one like the one that a few folks and I put together in college will teach you a lot about how each protocol behaves and what to look for: https://github.com/carlosonunez/nbfm-sniffer https://github.com/carlosonunez/nbfm-sniffer

entelechy0 11y ago

Real-talk: I spent 2 semesters with wireshark, tcpdump, AND libpcap in college back in 2007-8. Now I'm in an environment where I get to use them professionally :D !!!

clinta 11y ago

And tcpdump already exists on every server. I frequently pipe the output of tcpdump over ssh into wireshark for analysis on my local machine. ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -