Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-13 Thread Klaus Schrod
Guy Harris wrote: On Mon, Jul 12, 2004 at 03:13:33PM +0200, Klaus Schrod wrote: Does anybody have any idea why we still get this error? Because, for whatever reason, the dissector for the protocol atop which the purported IP traffic is running thinks it's IP even though it isn't? (The version fiel

Re: [tcpdump-workers] Bug in print-ppp.c

2004-07-13 Thread Hannes Gredler
thanks for your submission - checked in; - /hannes On Tue, Jul 13, 2004 at 03:04:43PM +1000, Darren Reed wrote: | I've come across a packet that causes me to get a stack trace something | like this: | #0 0x in ?? () | #1 0x0807a0bd in handle_ctrl_proto (proto=32855, pptr=0x8195c82 "\001"

[tcpdump-workers] http capture

2004-07-13 Thread Andersen, Kevin J.
I need to capture all incoming http requests to a webserver. I'm using the following command: /usr/sbin/tcpdump -i eth0 -p -n tcp port 80 However, that shows me all the traffic. I am specifically looking for each original request. Can someone help me here? Thanks, Kevin - This is the tcpdum

Re: [tcpdump-workers] http capture

2004-07-13 Thread Guy Harris
On Jul 13, 2004, at 9:52 AM, Andersen, Kevin J. wrote: However, that shows me all the traffic. I am specifically looking for each original request. tcp dst port 80 should catch all traffic going *to* port 80 but not all traffic coming *from* port 80 (although if the client port is also 80, i

Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-13 Thread Guy Harris
On Jul 13, 2004, at 7:56 AM, Klaus Schrod wrote: Again our situation: Two computers connected to the net, one (lion) with a fixed ip address and one (styx) with pppoe. We established an ipsec tunnel between them successfully. tcpdump showed an error in the ESP traffic between styx and lion. But

Re: [tcpdump-workers] error-message "IP11 truncated-ip" in last tcpdump/libpcap

2004-07-13 Thread Guy Harris
On Jul 13, 2004, at 11:51 AM, Guy Harris wrote: whereas the traffic from 62.225.140.214 to 217.234.111.121 has Linux cooked capture IP with a protocol type of IP-inside-IP IP (with a bogus version number of 3 and a bogus header length of 8) The second capture is similar - an

[tcpdump-workers] windump options 4 writing in a *.txt file

2004-07-13 Thread César Cárdenas
Dear all: It is possible to write raw packets in a *.txt file? I've already tried with: windump -w test.txt windump -w "test.txt" windump -w test but the text is coded or I could not read with notebook or wordpad or msoft word...Many thanks for your help I am using windows 2000 and winpcap 3.0, B

Re: [tcpdump-workers] windump options 4 writing in a *.txt file

2004-07-13 Thread Guy Harris
On Jul 13, 2004, at 12:44 PM, César Cárdenas wrote: It is possible to write raw packets in a *.txt file? That depends on what you mean by "raw packets". Packet data is binary, so that wouldn't go into a .txt file. The packet data can be dumped in hex and/or ASCII, and that could be put into a text