Sniffing and displaying TCP packets in UTF-8

Question

I am trying to use tcpdump to display the content of tcp packets flowing on my network. I have something like:

tcpdump -i wlan0 -l -A

The -A op

Answer 1

There are many options that you can explore to sniff packets.

Wireshark is the most useful sniffer and its available for free for all platforms. It has a feature rich GUI which will help you sniff packets and analyze protocols. It has many filters so that you can filter out unwanted packets and only look at packets that you are interested in. Check out their webpage at: available for download for Windows and OS X

To dowload for Linux distros check out this link

If you prefer an alternate solution more on the lines of tcpdump you can also explore tcpflow which is definitely a good option to analyze packets. It also provides you an option to store the files for later analysis. Check this link: tcpflow

Another option is Justsniffer

Which probably best addresses your problem and provides you with text mode logging and is customizable.

Answer 2

tcpdump -i wlan0 -w packet.ppp

This command stores the packets in packet.ppp

After that open it in wireshark

wireshark packet.ppp

right click on the packet and then select Follow tcp packet

Then you can have available different formats to view the data in wireshark.

Answer 3

Make sure your terminal supports outputting UTF-8 and pipe the output to something which replaces non printable characters:

tcpdump -lnpi lo tcp port 80 -s 16000 -w - | tr -t '[^[:print:]]' ''
tcpdump -lnpi lo tcp port 80 -s 16000 -w - | strings -e S -n 1

If your terminal does not support UTF-8 you have to convert the output to a supported encoding . E.g.:

tcpdump -lnpi lo tcp port 80 -s 16000 -w - | tr -t '[^[:print:]]' '' | iconv -c -f utf-8 -t cp1251

-c option tells iconv to omit character which does not have valid representation in the target encoding.