Tcpdump is a powerful tool
to collect packet on a network. It's built in FreeBSD 3.2-RELEASE,
maybe non before, you must check yourself.
Tcpshow is a tool to help
you show the packet information. It's not built in operation system,
at least FreeBSD 3.2-RELEASE not, you must install yourself. You
can download the package from here.
- # cd /usr/src/sys/i386/conf/
- Don't comment this line
in your kernel.

- # config xxx(xxx is
the name of your kernel)
- # cd /usr/src/sys/compile/xxx/
- # make depend all install
- Now tcpdump is enabled,
you can capture packets now.
- Install tcpshow to decode
tcpdump file, you can download the tcpshow package from here.
- # pkg_add -v tcpshow-1.74.tgz
- Now decoder is done.
Example
A
- # tcpdump -i ed0 -w
test
Listen on interface ed0 and redirect output to file named test.
- # tcpshow < test
| more
Decode file test.
B
- # tcpdump -i ed0 -w
test 'dst port 23'
Only listen destination port 23 on interface ed0 and redirect
output to file named test.
- # tcpshow -minHdrDecode
< test | more
Decode file test and minimal display.
C
- # tcpdump -i ed0 -w
test 'dst port 23' and 'ether src 0:aa:bb:cc:dd:ee'
Only listen ethernet source address 00:aa:bb:cc:dd:ee and destination
port 23 on interface ed0 and redirect output to file named test.
- # tcpshow -minHdrDecode
-noHostNames < test | more
Decode file test, minimal display and use ip address instead of
host name.
D
- # tcpdump -i ed0 -w
test 'dst port 23' or 'dst port 110' and 'ether src 0:aa:bb:cc:dd:ee'
Only listen ethernet source address 00:aa:bb:cc:dd:ee and destination
port 23 or 110 on interface ed0 and redirect output to file named
test.
- # tcpshow -minHdrDecode
-noHostNames < test | more
Decode file test, minimal display and use ip address instead of
host name.
E
- # tcpdump -i ed0 -w
test 'dst port 23' or 'dst port 110' and 'ether src 0:aa:bb:cc:dd:ee'
and 'less 60'
Only listen ethernet source address 00:aa:bb:cc:dd:ee, destination
port 23 or 110 and packet length less than 60 on interface ed0
and redirect output to file named test.
- # tcpshow -minHdrDecode
-noHostNames < test | more
Decode file test, minimal display and use ip address instead of
host name.
F
- # tcpdump -i ed0 -w
test 'dst port 23' or 'dst port 110' and 'src host 192.168.0.1'
&
Only listen source ip 192.168.0.1 and destination port 23 or 110
on interface ed0 and redirect output to file named test in the
background.
- # tcpshow -minHdrDecode
-noHostNames < test | more
Decode file test, minimal display and use ip address instead of
host name.
|
|