How can tcpdump print the contents of packets in Linux?
In Linux, you can use the tcpdump command to capture network packets and view their content. By default, tcpdump only prints out the header information of the packets. To print out the full content of the packets, you can use the following command:
tcpdump with [options] and display the packets in ASCII format.
Among them, option A is used to print the ASCII content of the message. You can also use other options to filter and restrict output, such as:
- i : designated network interface
- host: designated host
- port: specified port
- source IP address specified
- target IP address specified
For example, to print the content of all TCP packets with a source or destination IP address of 192.168.0.1, you can use the following command:
Capture all TCP packets where the source or destination is 192.168.0.1 and the TCP header contains the SYN or FIN flags.
During the execution of the command, tcpdump will continuously print the packet content that matches the conditions, displayed in chronological order. You can stop tcpdump execution by pressing Ctrl+C.