Quick tip: Capture Linux network packets to a file

by Vivek Gite · 3 comments

tcpdump command dump traffic on a network in real time. It prints out a description of the contents of packets on a network interface.

How do I capture network packets to a file?

By default traffic is dumped on a screen. To capture these packets to a file, enter the following command as the root user:
# tcpdump -i eth0 -w traffic.eth0

How do I read packets from a file?

The -w flag causes it to save the packet data to a file called traffic.eth0 for later analysis, and/or with the -r flag, which causes it to read from a saved packet file rather than to read packets from a network interface:
# tcpdump -r traffic.eth0

Featured Articles:

Want to read Linux tips and tricks, but don't have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don't miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 3 comments… read them below or add one }

1 Artem Nosulchik 09.25.07 at 7:56 am

Nice tip, Vivek! Also it would be useful to send these captured packets with tool Bit-twist.
An example of it’s usage is available here.

2 vivek 09.25.07 at 11:50 am

Artem,

Thanks for sharing Bit-Twist. I will check it out :)

3 raisa 01.07.10 at 4:46 am

does tcpdump support tcp packet reassembly?? if not how can reassembly be implemented?

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Previous post:

Next post: