3 ms·
You know what else is neat? netsh on windows. Let's you do circular size limited packet captures and associate every packet with the originating/destination pro
by _8j50 4y ago
You know what else is neat? netsh on windows. Let's you do circular size limited packet captures and associate every packet with the originating/destination process.
But yes, tcpdump and strace/ltrace are the ultimate tool for "I have no idea what the problem is, let me find out exactly what is happening" when troubleshooting.
- EvanAnderson 4y agoI used to use netsh to capture on Windows boxes but the workflow for getting the data into pcap format was awful. Lately I’ve been using RawCap[0]. It’s a single EXE that works on stock versions of Windows and produces pcap files. It has no capture-time filtering options, which is a bummer, but it’s quicker for me to get data to look at than the netsh / convert to pcap workflow. [0] https://www.netresec.com/?page=Blog&month=2020-01&post=RawCap-Redux https://www.netresec.com/?page=Blog&month=2020-01&post=RawCa...
- hamburglar 4y ago> tcpdump and strace/ltrace are the ultimate tool for "I have no idea what the problem is, let me find out exactly what is happening" when troubleshooting. And the ability to do that type of troubleshooting when the shit hits the fan is becoming more and more rare. I regularly run into devs, even so-called “senior” devs, these days who don’t know how it’s useful to look at packets or system calls and whose minds are blown that anyone would know details that far down the stack. It would be depressing if it wasn’t so good for job security.
- pjc50 4y agoHuh, I never had any idea that netsh existed.
- _8j50 4y agoThat's what you use for managing the windows firewall, setting up tunnels/port forwarding too. Pretty nifty for a windows cli tool.