Using tcpdump and Wireshark to sniff and analyse your network traffic

Sometimes a network service is just not behaving the way it should. And the log files do not help you either. Then it is time to use the power of tcpdump and Wireshark to get a deeper look on what is actually happening on the wire.

If you have an X11 running on the host in question you may just start Wireshark and start recording the traffic. However often you need to record traffic that is running on a machine you can just login through SSH. Don’t panic – you can still analyze the traffic.

Sniff the network

Run tcpdump on the server in question. The number of options is pretty large. But most of the time the call is rather simple. Try something like this:

tcpdump -lnni eth0 -w dump -s 65535 host web01 and port 80

That will mainly record traffic on the interface eth0, write the output (in raw format) to the file named dump, record the whole packet (65535 bytes maximum) instead of just a few bytes and use the filter expression host web01 and port 80 to just listen to traffic for the server called web01 and listen only to traffic on the HTTP port (80).

Run this command and let it run while you want to record network activity. When you are done, just stop the process (Ctrl-C) and you have the raw data in the dump file.

 

Analyze the dumpfile in Wireshark

Now copy this dump file over to a workstation where you have X11 running – scp should do it. Then start wireshark and load the file (or just run wireshark dumpfile). You will be shown what has happened when.

In the top window you will see one line for each packet. Click on a packet that you like to inspect deeper and you will be shown the protocol stack in the lower left corner. The layers correspond to the OSI model and are used to transport the packet. Unless you are debugging your switch environment you can safely ignore all the lower layers (that are shown as the first lines) and expand (click on the ‘+’) the HTTP protocol. Wireshark is very smart and will try to interpret the network traffic so you get a clearer view at the protocol. It knows about most common protocols like HTTP, SMTP, POP3 and a few hundreds more.

Wireshark on the console

If you just need need a tad more information than what tcpdump delivers but want to see it on the console and in real-time then tshark may be for you. Give it a try.

8 thoughts on “Using tcpdump and Wireshark to sniff and analyse your network traffic

  • 2010-08-13 at 13:05
    Permalink

    thanks for the nice workaround. 😀

    Reply
  • 2011-05-24 at 12:11
    Permalink

    Good one but at the same time if would have explained step by step process of analysis for wireshark it would have been more practical useful for readers

    Reply
    • 2011-05-24 at 13:14
      Permalink

      You mean you expected a complete introduction on how to debug network problems using Wireshark? I assume I could write entire books about that. Probably outside of the scope of such a quick article. 🙂

      Reply
  • 2012-02-15 at 10:20
    Permalink

    You can also use the tool "dsniff" which is available in repository for installing. Just look at this GREAT tool! It offers super scanning and filter methods for sniffing on networks. Be aware and use it only on YOUR OWN network and ONLY TO SCAN FOR SECURITY HOLES! Not to exploit other users!!!!

    You don't need wireshark or X11. Also to mention, it's possible to create the dump with 'tcpdump' and then read this dump again with "tcpdump -r filename" to see what information it gathered.

    Reply
    • 2012-03-02 at 03:44
      Permalink

      dsniff very helpful to analyze my network.

      keep me track down to packets source. ^^

      rgds,

      tbg

      Reply
  • 2012-02-18 at 22:03
    Permalink

    Nice.

    One way I sometime use it is by:
    /some/loc/$ tcpdump -nnieth0 -w dump.raw
    #
    # If chunked data / or want to check merged:
    /some/loc/$ mkdir tmp && cd tmp
    /some/loc/tmp/$ tcpflow -r ../dump.raw
    # Now one can investigate each transfere from separate files
    # Next join them to one:
    /some/loc/tmp/$ cat * > ../dump.flow
    /some/loc/tmp/$ cd ..
    # Extract some data
    /some/loc/$ foremost -i dump.flow

    etc.

    A quick dump syntax explanation: http://openmaniak.com/tcpdump.php

    Reply
  • 2016-07-17 at 03:27
    Permalink

    Couldn’t the packets also be captured in wireshark? Or is there an advantage of using tcpdump for capturing and wireshark for analyzing?

    Reply
    • 2016-07-17 at 11:16
      Permalink

      The answer is in the third sentence. 🙂

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close