dumping net traffic to log file

[Darrin Chandler]

On Tue, Jul 25, 2006 at 01:39:49PM -0400, Steel City Phantom wrote:
> Great, im making good progress here.  it seems like tcpdump only 
> captures the headers, is there a way to capture the entire packet, data 
> and all?

In addition the the other fine answers you got, after you've written to
a file with -w and are later reading it with -r you can raise the
snaplength with -s to view a bit more without seeing the whole packet.
Often that's a nice way to narrow things down when you don't yet know
exactly what you're looking for.

Also, you will want to get familiar with filter expressions, which may
appear at the end of the tcpdump command:

"tcpdump <...> host 192.168.10.100 and port 999"

would only show traffic for port 999 to or from 192.168.10.11, for
instance.

-- 
Darrin Chandler            |  Phoenix BSD Users Group
dwchandler at stilyagin.com   |  http://bsd.phoenix.az.us/
http://www.stilyagin.com/  |