tcpdump

Displays headers from packets arriving on the specified interface.

tcpdump [ count <packets> ] 
 
        [ interface <name> ] 
 
        [ snarf <bytes> ] 
 
        [ numeric ]
 
        [ absolute ] 
 
        [ hexadecimal ] 
 
        [ quiet | verbose | more-verbose ] 
 
        [ no-timestamp ]
 
        [ timeout <minutes> ]
 
        [ raw-packets ]
 
        [ module <slot> ]
 
        [ <expression> ]
 
        [ | { include | exclude } <regexp> ]
 
        [ > <url> ]
 

• packets--number of packets to count before exiting
• name--name of the interface; can be one of the following:
• ethernet0
• tunnelN (where N is number assigned to the tunnel in the configuration)
• lo
• lo:0
• lo:1
• bytes--number of bytes in each packet to be analyzed (equivalent to snaplen)
• minutes--number of minutes to wait
• slot--chassis position of target module
• expression--filter for which packets to be dumped
• regexp--regular expression
• url--URL of remote file where output is to be sent (cannot be local to CNA)

System operations mode, login-level access.

Use once.

count--1 when run on a peripheral module in local mode, otherwise none

name--name of lowest numbered interface

bytes--68

timeout--2 minutes

If no interface is specified, default is Ethernet0

Time stamp is included

The tcpdump command is available both as a system-wide command and a local command.

When you are connected to the system through the management module’s ethernet port, the tcpdump command will work on any module that you specify with the slot argument.

When you are connected to a peripheral module’s console port, the command operates as a local command on the module to which you are physically connected. Not all arguments are supported in local mode.

All but one of the listed arguments are optional (expression is required).

Order is important--if you specify multiple arguments, they must appear in the order shown:

• Use the count keyword to specify the number of packets to count before exiting. When you use this keyword, be aware that it may take some time for the command to complete (or timeout). During this time, there are no on-screen activity indicators.
• Use the interface keyword to specify an CNA interface (ethernet interfaces will be placed in promiscuous mode and all traffic, not just those packets that are addressed to the interface, will be included in the output).
• Use the snarf keyword to specify the number of bytes in a packet.
• Use the numeric keyword to keep addresses in numeric form, instead of converting them to symbolic names (not available in local mode).
• Use the absolute keyword to display absolute (as opposed to relative) TCP sequence numbers.
• Use the hexadecimal keyword to display the output in hexadecimal format.
• Use the quiet, verbose, or more-verbose keyword to determine how much data is output.
• Use the no-timestamp keyword to suppress timestamps in the output.
• Use the timeout keyword to specify the number of minutes to wait for a reply (not available in local mode).
• Use the raw-packets keyword with the > character and a file URL to divert raw packets to a file (not available in local mode). If you are specifying a module number or an expression, these arguments must follow the raw-packets keyword but the URL must be last. Additionally, the URL must point to a remote location; you cannot direct data to a file local to CNA. Packets written to the file follow the regular tcpdump binary format compatible with the -w and -r options defined by the tcpdump utility.
• Use the module keyword to specify an CNA slot number.
• The expression argument should follow regular tcpdump expression semantics. It can consist of one or more primitives (such as an ID name or number), preceded by one or more qualifiers. The entire expression (primitive and qualifier) must be enclosed in double quotes. Qualifiers can be one of the following:
• type--kind of object identified by primitive (possible types include host, or net, or port); if none specified, host is assumed
• dir--direction of transfer; to or from the primitive; can be src, dst, src or dst, or src and dst, for example
• proto--protocol, such as ether, fddi, ip, arp, tcp, or udp, for example; if none specified, all protocols consistent with type are assumed

Each qualifier/primitive pair must be separated by and, or, not:

	tcpdump raw-packets “host 1.2.3.4 and port 80” 
 
	                                          > ftp://mydomain.com/myfile
 
	
 

• include--shows all lines in the output which contain a match to the specified regular expression
• exclude--shows all lines in the output except those which contain a match to the specified regular expression

If url is set to a valid FTP, HTTP or HTTPS URL (with the required pipe character, >), output will be sent to the specified destination. See the copy command for URL syntax.

See http://www.tcpdump.org for more information about the tcpdump utility.