Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    TCPDump. How to create .pcap file with captured traffic?

    Scheduled Pinned Locked Moved Off-Topic & Non-Support Discussion
    13 Posts 3 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • kiokomanK
      kiokoman LAYER 8
      last edited by

      it is working fine for me, what error do you have?

      ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
      Please do not use chat/PM to ask for help
      we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
      Don't forget to Upvote with the 👍 button for any post you find to be helpful.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        Just so you know you can just download the captures you do with the gui as well..

        But to your specific question - what error?

        I just run your exact command (other than changing to one of my nics igb0) and ran fine

        [2.4.4-RELEASE][admin@sg4860.local.lan]/root: tcpdump -i igb0 -vv ether host fa:ba:da:00:00:14 -w test.pcap   
        tcpdump: listening on igb0, link-type EN10MB (Ethernet), capture size 262144 bytes
        ^C0 packets captured
        53 packets received by filter
        0 packets dropped by kernel
        [2.4.4-RELEASE][admin@sg4860.local.lan]/root: 
        

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • R
          ramses.sevilla
          last edited by

          Sorry, I thinked that I had putt the error message.

          It's this message:

          [2.3-RELEASE][admin@pfsense]/root: tcpdump -i em1 -vv ether host host fa:ba:da:00:00:14 -w test.pcap
          tcpdump: syntax error
          [2.3-RELEASE][admin@pfsense]/root:

          If I execute that line in Ubuntu, It's works well.

          If I execute this line in the pfSense, It's works well:

          [2.3-RELEASE][admin@pfsense]/root: tcpdump -i em1 -vv ether host host fa:ba:da:00:00:14
          tcpdump: listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
          ^C
          0 packets captured
          204503 packets received by filter
          0 packets dropped by kernel
          [2.3-RELEASE][admin@pfsense]/root:

          Regards

          1 Reply Last reply Reply Quote 0
          • kiokomanK
            kiokoman LAYER 8
            last edited by kiokoman

            this is not what you wrote on the first post,
            right:
            tcpdump -i em1 -vv ether host fa:ba:da:00:00:14 -w test.pcap
            wrong:
            tcpdump -i em1 -vv ether host host fa:ba:da:00:00:14
            also "-w test.cap" missing

            ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
            Please do not use chat/PM to ask for help
            we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
            Don't forget to Upvote with the 👍 button for any post you find to be helpful.

            1 Reply Last reply Reply Quote 0
            • R
              ramses.sevilla
              last edited by

              @kiokoman sorry,

              It's a Copy / Paste error.

              The correct command and the error are these:

              [2.3-RELEASE][admin@pfsense]/root: tcpdump -i em1 -vv ether host fa:ba:da:00:00:14 -w test.pcap
              tcpdump: syntax error
              [2.3-RELEASE][admin@pfsense]/root:

              Regards

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                dude your on pfsense 2.3 -- wow that is OLD and EOL.. you need to update to current

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • R
                  ramses.sevilla
                  last edited by

                  @johnpoz, yes, I know that pfSense 2.3 is very old and EOL, but it's an inherited installation.

                  I'm trying to clean the residual settings first and to upgrade to the latest version later, first to the 2.4 and to the 2.5 version later.

                  Regards

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    have no idea what version of tcpdump is installed on the 2.3 version - you will have to check your syntax for whatever version that is.

                    here is what is on current 2.4.4p3

                    [2.4.4-RELEASE][admin@sg4860.local.lan]/root: tcpdump --version
                    tcpdump version 4.9.2
                    libpcap version 1.8.1
                    OpenSSL 1.0.2o-freebsd  27 Mar 2018
                    [2.4.4-RELEASE][admin@sg4860.local.lan]/root: 
                    

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • R
                      ramses.sevilla
                      last edited by

                      Well, the TCPDump versión is:

                      [2.3-RELEASE][admin@pfsense]/root: tcpdump --version
                      tcpdump: illegal option -- -
                      tcpdump version 4.4.0
                      libpcap version 1.4.0
                      Usage: tcpdump [-aAbdDefhHIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
                      		[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                      		[ -i interface ] [ -j tstamptype ] [ -M secret ]
                      		[ -r file ] [ -s snaplen ] [ -T type ] [ -V file ] [ -w file ]
                      		[ -W filecount ] [ -y datalinktype ] [ -z command ]
                      		[ -Z user ] [ expression ]
                      [2.3-RELEASE][admin@pfsense]/root:
                      

                      Not has the "--version" option but shows the version.

                      On the other hand, I have already found the problem with the error of TCPDump when I try create a file with the "-w" options.

                      If I put:

                      tcpdump -i em1 -vv -w test.pcap ether host fa:ba:da:00:00:14

                      Instead of:

                      tcpdump -i em1 -vv ether host fa:ba:da:00:00:14 -w test.pcap

                      It works well.

                      [2.3-RELEASE][admin@pfsense]/root: tcpdump -i em1 -vv -w test.pcap ether host fa:ba:da:00:00:14
                      tcpdump: listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
                      Got 0
                      ^C0 packets captured
                      485686 packets received by filter
                      0 packets dropped by kernel
                      [2.3-RELEASE][admin@pfsense]/root:
                      

                      Regards and thanks so much.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        You need to UPDATE... 2.3 is EOL...

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          ramses.sevilla @johnpoz
                          last edited by

                          @johnpoz said in TCPDump. How to create .pcap file with captured traffic?:

                          You need to UPDATE... 2.3 is EOL...

                          @johnpoz, yes, I know that pfSense 2.3 is very old and EOL, but it's an inherited installation.

                          I'm trying to clean the residual settings first and to upgrade to the latest version later, first to the 2.4 and to the 2.5 version later.

                          Regards

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            Yeah I saw - just reminding you ;) heheheh

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.