1 tcpdump Provides dump analysis and packet capturing. Format tcpdump ["-B" | d | e | f | l | m | n | "-N" | "-O" | q | s | "-S" | t | v | x | "-X"] [-b buffers] [-c count] [-F file] [-r file] [-s snaplen] [-w file] expression 2 Description The tcpdump utility displays the headers and contents of packets on the network that match a boolean expression (filter). If no filter is supplied all packets processed by tcpdump will be displayed. The the packets that are processed can also be written to a binary file for later examination and filtering. For complete information about using tcpdump, refer to the HP TCP/IP Services for OpenVMS Tuning and Troubleshooting guide. 2 Parameters expression A boolean expression that provides a filter to select the packets to dump. If you do not specify the expression, all packets on the network are dumped. Otherwise, only packets that match the expression are dumped. For information about specifying expressions, see the HP TCP/IP Services for OpenVMS Tuning and Troubleshooting guide. 2 Options -b Specifies the number of buffers used to communicate with the TCP/IP kernel. The default is 400 on Alpha systems and 50 on VAX systems. "-B" Displays buffer diagnostics showing when dropped packets occur. Use quotation marks to preserve the case of uppercase options. -c Exits after receiving count packets. -d Dumps the compiled packet-matching code to standard output and stops. -e Displays the link-level header on each dump line. -f Displays foreign internet addresses numerically rather than symbolically. "-F" file Uses file as input for the filter expression. Any additional expressions on the command line are ignored. Use quotation marks to preserve the case of uppercase options. -l Buffers the stdout line. This is useful if you want to see the data while capturing it. -m Enables multiline output from some protocols. This affects most ONC RPC decoding, as those protocols are often difficult to display on a single line. -n Does not convert addresses (for example, host addresses and port numbers) to names. "-N" Does not display domain name qualification of host names. For example, with this option, tcpdump displays nic instead of nic.ddn.mil. Use quotation marks to preserve the case of uppercase options. "-O" Does not run the packet-matching code optimizer. This is useful only if you suspect a bug in the optimizer. Use quotation marks to preserve the case of uppercase options. -q Quick (quiet) output. Displays less protocol information so output line are shorter. -r file Reads packets from file (which was created with the -w option). Standard input is used if a hyphen (-) is used to specify the file. -s snaplen Displays the number of bytes of data from each packet as specified by the value of snaplen, rather than the default of 68. The default of 68 bytes is adequate for IP, ICMP, TCP, and UDP, but may truncate protocol information from name server and NFS packets. Packets truncated because of a limited snapshot are indicated in the output with [|proto], where proto is the name of the protocol level at which the truncation has occurred. NOTE Taking larger snapshots both increases the amount of time it takes to process packets and decreases the amount of packet buffering. This may cause packets to be lost. You should limit the value of snaplen to the smallest number that will capture the protocol information you need. "-S" Displays absolute, rather than relative, TCP sequence numbers. Use quotation marks to preserve the case of uppercase options. -t Does not display a timestamp on each dump line. -tt Displays an unformatted timestamp on each dump line. -v Displays verbose output. For example, the time to live and type of service information in an IP packet is displayed. If -m is also specified, ONC RPC packets sent using TCP are decoded twice: first as RPC, then as TCP. By default, the TCP decoding is suppressed. -vv Displays detailed verbose output. For example, additional fields are displayed from NFS reply packets. -w file Writes the raw packets to file rather than parsing and displaying them. They can later be displayed with the -r option. Standard output is used if a hyphen (-) is used to specify the file. -x Displays each packet (minus its link level header) in hexadecimal format. The smaller of the entire packet or snaplen bytes is displayed. "-X" Displays packets in both hexadecimal and ASCII formats. Use quotation marks to preserve the case of uppercase options. 2 Examples 1.$ tcpdump host sundown This example shows how to use the tcpdump utility to display all packets arriving at or departing from host sundown. 2.$ tcpdump host sundown and ( hot or ace ) This example shows how to use the tcpdump utility to display traffic between sundown and either host hot or host ace. 3.$ tcpdump ip host ace and not helios This example shows how to use the tcpdump utility to display all IP packets between ace and any host except helios. 4.$ tcpdump net office This example shows how to use the tcpdump utility to display all traffic between local hosts and hosts on the network office. 5.$ tcpdump gateway snup and (port 21 or 20) This example shows how to use the tcpdump utility to display all FTP traffic through Internet gateway snup. 6.$ tcpdump ip and not net localnet This example shows how to use the tcpdump utility to display traffic neither sourced from nor destined for local hosts. If your network is connected to one other network by a gateway, this command does not produce any results on your local network. 7.$ tcpdump tcp[13] & 3 != 0 and not src and dst net localnet This example shows how to use the tcpdump utility to display the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a nonlocal host. 8.$ tcpdump gateway snup and ip[2:2] > 576 This example shows how to use the tcpdump utility to display IP packets longer than 576 bytes sent through gateway snup. 9.$ tcpdump ether[0] & 1 = 0 and ip[16] >= 224 This example shows how to use the tcpdump utility to display IP broadcast or multicast packets that were not sent using Ethernet broadcast or multicast. 10$ tcpdump icmp[0] != 8 and icmp[0] != 0 This example shows how to use the tcpdump utility to display all ICMP packets that are not echo requests or replies (that is, not PING packets). 11$ tcpdump -s 1500 -envv ip6 and udp port 521 This example shows how to use the tcpdump utility to display all RIPv6 packets. 12$ tcpdump -s 1500 -envv ip6 and ether host a:b:c:d:e:f This example shows how to use the tcpdump utility to display all IPv6 packets arriving at or departing from a host with the Ethernet address a:b:c:d:e:f.