Hacker News Reader

Comment by mettamage | Hacker News Reader

Tcpdump is amazing. The quickness that you can have with it over Wireshark is awesome. I love that it is a command line tool instead of a GUI tool, since I needed to analyze TCP packets for quick debugging purposes.

But for the people who are new(ish) to tcpdump have you heard of libnet and libpcap? You can basically build your own tcpdump! :D

I was amazed at the speed packets fire when you program it yourself in C.

See: https://github.com/the-tcpdump-group/libpcap <-- CAPturing packets https://github.com/sam-github/libnet <-- sending packets

Libnet tutorial that I used religiously: https://repolinux.wordpress.com/2011/09/18/libnet-1-1-tutori...

View on HN

Wireshark also comes with "tshark" which is a CLI tool that gives you access to display filters and some of the GUI features. In particular, it's great for scripting if you're trying to pull some stats while troubleshooting.

I never knew, thanks :)

Tcpdump is cool, tshark is cool, but nothing beats raw libpcap for grabbing raw data off the wire. It is simply so stable at high throughput it's often the only option.

Wireshark starts to break down at a certain point. When that happens, I've found scapy (Python pcap parser) very useful. Once that breaks down, a good option reading the hex directly in C.

Once that breaks down... Well, there be dragons.

Got to add dpkt to this list for parsing pcap streams - allows you to write some awesome python analysis tools - e.g. For this 5GB packet capture find me all the streams where tcp packets were retransmitted more than twice.

Dpkt is also a very good, although I've had some bugs with it on Mac. Probably just odd network issues.

If you use VM's for this sort of thing, having images laying around like: https://security-onion-solutions.github.io/security-onion/ gives you most of the tools you'd need (wireshark, scapy, etc. in one place). Seems to be the best way to go for me (Mac laptop user).

I use tshark for capturing a lot, it's great. One of the big advantages for me is that it allows you to use the more expressive (and familiar) wireshark filter syntax, e.g.

tshark -i eth0 -Y ip.addr==8.8.8.8

Instead of having to remember tcpdump's own fiddly syntax. Given that most of my protocol debugging work is done inside Wireshark, I'm much more fluent in that filter language.

Note that the above snippet is a display filter, so it's capturing all the packets on the wire, doing a full dissection, and then running them through a filter before printing them; if you're trying to capture on a saturated 1G link you might need to fall back to the capture filters which are simpler and faster (and I believe also use tcpdump's syntax).

Wireshark syntax is also fiddly. It's just more familiar for some folks. The first several years of my experience troubleshooting network problems happened when Wireshark didn't exist, but tcpdump did. I still have better recollection and comprehension of tcpdump syntax than Wireshark. I have to read the docs to use either these days (since I don't work at that layer of the network much anymore), but I have to read longer to make Wireshark do what I want.

Sometimes "ease of use" is really just "what I'm used to". (Not saying Wireshark isn't more expressive or more powerful...it probably is. But, I usually have a very basic use case, and tcpdump can do it with a couple of flags and an address or port.)

Have you used sysdig? https://github.com/draios/sysdig

Its creator was one of the guys behind wireshark. They're pitching sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce.

They have csysdig which is similar to tshark

> I was amazed at the speed packets fire when you program it yourself in C.

For sure. There's no better way of learning the protocols than writing your own network sniffer. Even writing a crappy one like the one that a few folks and I put together in college will teach you a lot about how each protocol behaves and what to look for: https://github.com/carlosonunez/nbfm-sniffer

And tcpdump already exists on every server. I frequently pipe the output of tcpdump over ssh into wireshark for analysis on my local machine.

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i -

Reply on news.ycombinator.com