7

I am trying to use tcpdump to display the content of tcp packets flowing on my network. I have something like:

tcpdump -i wlan0 -l -A

The -A option displays the content as ASCII text, but my text seems to be UTF-8. Is there a way to display UTF-8 properly using tcpdump? Do you know any other tools which could help?

Many thanks

Alexandre Dupuis
  • 139
  • 1
  • 3
  • 9
  • What exactly is a sample of the output you're getting? – chryss Aug 06 '10 at 08:12
  • Something like that: ".f....vB`xt`live`setQuestion`-1`24642`Dans quel d..partement se trouve la grotte de Lascaux ?`N`G..ographie, politique, ..conomie`6`". At the moment I am implementing my own filter to resolve the problem... – Alexandre Dupuis Aug 06 '10 at 10:48

3 Answers3

5

Make sure your terminal supports outputting UTF-8 and pipe the output to something which replaces non printable characters:

tcpdump -lnpi lo tcp port 80 -s 16000 -w - | tr -t '[^[:print:]]' ''
tcpdump -lnpi lo tcp port 80 -s 16000 -w - | strings -e S -n 1

If your terminal does not support UTF-8 you have to convert the output to a supported encoding . E.g.:

tcpdump -lnpi lo tcp port 80 -s 16000 -w - | tr -t '[^[:print:]]' '' | iconv -c -f utf-8 -t cp1251

-c option tells iconv to omit character which does not have valid representation in the target encoding.

Delian Krustev
  • 2,826
  • 1
  • 19
  • 15
1
tcpdump -i wlan0 -w packet.ppp

This command stores the packets in packet.ppp

After that open it in wireshark

wireshark packet.ppp

right click on the packet and then select Follow tcp packet

Then you can have available different formats to view the data in wireshark.

Omer Dagan
  • 14,868
  • 16
  • 44
  • 60
Munipratap
  • 529
  • 5
  • 9
0

There are many options that you can explore to sniff packets.

Wireshark is the most useful sniffer and its available for free for all platforms. It has a feature rich GUI which will help you sniff packets and analyze protocols. It has many filters so that you can filter out unwanted packets and only look at packets that you are interested in. Check out their webpage at: available for download for Windows and OS X

To dowload for Linux distros check out this link

If you prefer an alternate solution more on the lines of tcpdump you can also explore tcpflow which is definitely a good option to analyze packets. It also provides you an option to store the files for later analysis. Check this link: tcpflow

Another option is Justsniffer

Which probably best addresses your problem and provides you with text mode logging and is customizable.

Vijay
  • 924
  • 7
  • 14