Is the installation of tcpdump similar to wireshark ,

which is : yum install tcpdump ?

How about getting started with it , Any documentation available for it ?

Thanks Jatin

On 4/22/2010 5:30 PM, James Hogarth wrote:

On 22 April 2010 12:57, Jatin Daveyjashokda@cisco.com wrote:

...

Hi All

Yesterday i had installed wireshark on my centos box which does not have the GUI , It is actually a hardened box. I installed the tool using the following command:

yum install wireshark

After installation i dont know how to proceed further in capturing the packets. I basically want to capture packets and copy them onto my windows box. On the windows box i can use the Wireshark UI to open the pcap file to view its contents.

Can some one help me in this regard.

Thanks Jatin _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

For a box with no GUI use tcpdump to get a packet capture to then scp over to a box with wireshark on it to analyse the traffic... your windows box in this case.

James _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

Thanks James,

I will install it on my box. Thanks for the support.

Thanks Jatin

On 4/22/2010 5:40 PM, James Hogarth wrote:

On 22 April 2010 13:03, Jatin Daveyjashokda@cisco.com wrote:

...

Is the installation of tcpdump similar to wireshark ,

which is : yum install tcpdump ?

How about getting started with it , Any documentation available for it ?

Thanks Jatin

Indeed yum install tcpdump

man tcpdump will give you lots of documentation after you install it

To get you started...

sudo tcpdump -w networkdump.pcap

scp networkdump.pcap<user>@<yoursystem>:

open networkdump.pcap in your wireshark on your box

???

profit _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

Thanks Michel

I would explore more on the tshark usage. Thanks for the support.

Thanks Jatin

On 4/22/2010 5:31 PM, Michel van Deventer wrote:

Hi,

...

Yesterday i had installed wireshark on my centos box which does not have the GUI , It is actually a hardened box. I installed the tool using the following command:

yum install wireshark

After installation i dont know how to proceed further in capturing the packets. I basically want to capture packets and copy them onto my windows box. On the windows box i can use the Wireshark UI to open the pcap file to view its contents.

Wireshark in cli mode is called tshark.

With 'tshark -i eth0 -w outfile' captures all traffic on eth0 to outfile.

   Regards,


   Michel

---

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos