How to capturing packet data so i can see the Version, IHL, TOS, etc?

Applications IP Networking
1

Helo Folks :slight_smile:
i had read an answer in this thread unix[dot]com/programming/117551-calculate-ip-header-checksum-manually.html

i need to know what the software name that was used to capturing packet data in a network, just like the packet's capture output that showed up in the thread.

Thank you :slight_smile:

PS
#Wowww i just shocked with the forum's rules.. very very restricted and hard rules
i am not allowed to write a URL before i ever post at least 5 post. wewww..

2

tcpdump, wireshark can capture packets in a network, or you can write a perl script using libpcap, it works too.

3

yes, i had try using tcpdump but i can't get the expected result.
i jus get output like this :

22:07:24.594264 IP okaprinarjaya-machine.local > 224.0.0.251: igmp v2 report 224.0.0.251
22:07:24.595606 IP okaprinarjaya-machine.local.59749 > google-public-dns-a.google.com.domain: 7289+ PTR? 251.0.0.224.in-addr.arpa. (42)
22:07:24.778994 IP google-public-dns-a.google.com.domain > okaprinarjaya-machine.local.59749: 7289 NXDomain 0/1/0 (99)
22:07:24.880158 IP6 fe80::290:f5ff:fe51:af16.mdns > ff02::fb.mdns: 0 PTR (QM)? 251.0.0.224.in-addr.arpa. (42)

i can't see where's the Version, IHL, TOS, etc

thank you :slight_smile:

4

i can't get Version,IHL,TOS, etc until now using tcpdump. Anybody know how to get Version, IHL, TOS, etc using tcpdump just like what showed up in unix[dot]com/programming/117551-calculate-ip-header-checksum-manually.html

5

Sorry for my belated reply, in fact, you can redirect the output to a file (in raw mode) then visualize using wireshark (or tcpdump -vv -x -X, i don't have tcpdump installed on my PC right now so I can't show you the output). That way, you can see any information in a packet (version, IHL, TOS...) but they are in HEX so you have to translate them bit by bit.
Hope this helps.

1 Like
6

Ok.... thank you very much @thanhdat :slight_smile:
now i can see the packet just like what i want :b:

---------- Post updated at 07:24 AM ---------- Previous update was at 07:20 AM ----------

Before i forget, i want to add some correction from your answer
tcpdump -w afile.log -x -X
then read it with
tcpdump -r afile.log -x -X

Thank you :slight_smile: