How to display all data using tcpdump?

linux networking tcpdump
Dolphin picture Dolphin · Jul 13, 2016 · Viewed 28.8k times · Source

I am capturing network traffic by using tcpdump. The problem is: I can't see all capture data when the package is too long. For example, when the tcp frame length is more than 500, I just see 100-200 or less. How to display all frame data(500+)?

I have tried add -vv and -vvv parameter. This is my current command:

 tcpdump -i eth1 tcp and host 10.27.13.14 and port 6973 -vv -X -c 1000

Answer

Dolphin picture Dolphin · Jul 13, 2016

Add -s0 parameter:

tcpdump -i eth1 tcp and host 10.27.13.14 and port 6973 -s0 -vv -X -c 1000

Related questions

icmp request received, but doesn't reply

I set up 3 CentOS servers, configured server2 as router between 192.168.1.0/24 and 30.0.0.0/24, but ping can't get through. I tried ping 192.168.1.62 from server1, according to tcpdump on server3, ICMP request is received, but it doesn't generate ICMP response. 23:36:06.436243 IP 30.0.0.2 > 192.168.1.62: ICMP echo …

Read More
Understanding Tcpdump filter & bit-masking

I am trying to sniff the http headers by using tcpdump. This filter works well but I can't understand it - (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) I've googled it but I can't …

Read More
ssh: Could not resolve hostname [hostname]: nodename nor servname provided, or not known

I am trying to set up a VPN with a Raspberry Pi, and the first step is gaining the ability to ssh into the device from outside my local network. For whatever reason, this is proving to be impossible and …

Read More