Forum Discussion
Lay_Hin_53714
Nimbostratus
Dec 19, 2008tcpdump output interpret guide
Hi All,
Is there a document that can explain the output from tcpdump?
For example, I would like to know what S, P and DF means.
15:23:27.351280 202.6.123.44.9632...
hoolio
Cirrostratus
Dec 30, 2008I think it's :nnn
tcpdump -ni 0.0:000 -s0 -w/var/tmp/test.dmp
tcpdump: unrecognized interface name: 0.0:000
tcpdump -ni 0.0:nnn -s0 -w/var/tmp/test.dmp
tcpdump: listening on 0.0:nnn
Using tcpdump to read the file you can see extra fields at the end of the normal info. I'm assuming the Wireshark patch parses this info.
tail-type 1 len 33 f5-low ver[0] fty[0] fid[00000000] pid[00000000] cfl[00000000] flg[0001] pgr[0] pun[0] lis= tail-type 2 len 6 f5-med ver[0] ins[0] inp[0] ha[0] tail-type 3 len 40 f5-hi ver[0] pra[00000000:00000000:00000000:00000000] pla[00000000:00000000:00000000:00000000] prp[0] plp[0] pip[0] pvl[0]
Can someone send me a compiled version of the modified wireshark version (hooleylists at gmail dot com)? I can't easily compile it without reworking my existing cygwin installation.
Thanks,
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects