From owner-freebsd-questions@FreeBSD.ORG Tue Jul 25 18:22:19 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EB2A916A4E0 for ; Tue, 25 Jul 2006 18:22:19 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from pi.codefab.com (pi.codefab.com [199.103.21.227]) by mx1.FreeBSD.org (Postfix) with ESMTP id E26BE43D5F for ; Tue, 25 Jul 2006 18:21:59 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from localhost (localhost [127.0.0.1]) by pi.codefab.com (Postfix) with ESMTP id 3BC8F5D49; Tue, 25 Jul 2006 14:21:59 -0400 (EDT) X-Virus-Scanned: amavisd-new at codefab.com Received: from pi.codefab.com ([127.0.0.1]) by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KDmFy0wR0Tt3; Tue, 25 Jul 2006 14:21:57 -0400 (EDT) Received: from [192.168.1.251] (pool-68-161-117-245.ny325.east.verizon.net [68.161.117.245]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pi.codefab.com (Postfix) with ESMTP id 7EAB25D44; Tue, 25 Jul 2006 14:21:57 -0400 (EDT) Message-ID: <44C6613B.2000208@mac.com> Date: Tue, 25 Jul 2006 14:21:47 -0400 From: Chuck Swiger User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: Steel City Phantom References: <44C51D80.8060306@yahoo.com> <20060725011022.GD27489@jeeves.stilyagin.local> <44C63BBE.90102@yahoo.com> <44C64486.3030005@mac.com> <44C65765.4090401@yahoo.com> In-Reply-To: <44C65765.4090401@yahoo.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: dumping net traffic to log file X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jul 2006 18:22:20 -0000 Steel City Phantom wrote: > Great, im making good progress here. it seems like tcpdump only > captures the headers, is there a way to capture the entire packet, data > and all? Use "-s 0". tcpdump is closer to the equivalent of a network toolbox than merely a "swiss army" knife, but you may find that dumping to a file and reading that file from another process does better (via -i & -o flags), especially under higher traffic volume. -- -Chuck