Tcpdump is a powerful tool to collect packet on a network. It's built in FreeBSD 3.2-RELEASE, maybe non before, you must check yourself.

Tcpshow is a tool to help you show the packet information. It's not built in operation system, at least FreeBSD 3.2-RELEASE not, you must install yourself. You can download the package from here.

1. # cd /usr/src/sys/i386/conf/
2. Don't comment this line in your kernel.
   
3. # config xxx(xxx is the name of your kernel)
4. # cd /usr/src/sys/compile/xxx/
5. # make depend all install
6. Now tcpdump is enabled, you can capture packets now.
7. Install tcpshow to decode tcpdump file, you can download the tcpshow package from here.
8. # pkg_add -v tcpshow-1.74.tgz
9. Now decoder is done.

Example

A

1. # tcpdump -i ed0 -w test
   Listen on interface ed0 and redirect output to file named test.
2. # tcpshow < test | more
   Decode file test.

B

1. # tcpdump -i ed0 -w test 'dst port 23'
   Only listen destination port 23 on interface ed0 and redirect output to file named test.
2. # tcpshow -minHdrDecode < test | more
   Decode file test and minimal display.

C

1. # tcpdump -i ed0 -w test 'dst port 23' and 'ether src 0:aa:bb:cc:dd:ee'
   Only listen ethernet source address 00:aa:bb:cc:dd:ee and destination port 23 on interface ed0 and redirect output to file named test.
2. # tcpshow -minHdrDecode -noHostNames < test | more
   Decode file test, minimal display and use ip address instead of host name.

D

1. # tcpdump -i ed0 -w test 'dst port 23' or 'dst port 110' and 'ether src 0:aa:bb:cc:dd:ee'
   Only listen ethernet source address 00:aa:bb:cc:dd:ee and destination port 23 or 110 on interface ed0 and redirect output to file named test.
2. # tcpshow -minHdrDecode -noHostNames < test | more
   Decode file test, minimal display and use ip address instead of host name.

E

1. # tcpdump -i ed0 -w test 'dst port 23' or 'dst port 110' and 'ether src 0:aa:bb:cc:dd:ee' and 'less 60'
   Only listen ethernet source address 00:aa:bb:cc:dd:ee, destination port 23 or 110 and packet length less than 60 on interface ed0 and redirect output to file named test.
2. # tcpshow -minHdrDecode -noHostNames < test | more
   Decode file test, minimal display and use ip address instead of host name.

F

1. # tcpdump -i ed0 -w test 'dst port 23' or 'dst port 110' and 'src host 192.168.0.1' &
   Only listen source ip 192.168.0.1 and destination port 23 or 110 on interface ed0 and redirect output to file named test in the background.
2. # tcpshow -minHdrDecode -noHostNames < test | more
   Decode file test, minimal display and use ip address instead of host name.

CopyRight © by Mask.
All rights reserved.