Sniffing and displaying TCP packets in UTF-8

Question

I am trying to use tcpdump to display the content of tcp packets flowing on my network. I have something like:

tcpdump -i wlan0 -l -A

The -A option displays the content as ASCII text, but my text seems to be UTF-8. Is there a way to display UTF-8 properly using tcpdump? Do you know any other tools which could help?

Many thanks

Answer 1

Make sure your terminal supports outputting UTF-8 and pipe the output to something which replaces non printable characters:

tcpdump -lnpi lo tcp port 80 -s 16000 -w - | tr -t '[^[:print:]]' ''
tcpdump -lnpi lo tcp port 80 -s 16000 -w - | strings -e S -n 1

If your terminal does not support UTF-8 you have to convert the output to a supported encoding . E.g.:

tcpdump -lnpi lo tcp port 80 -s 16000 -w - | tr -t '[^[:print:]]' '' | iconv -c -f utf-8 -t cp1251

-c option tells iconv to omit character which does not have valid representation in the target encoding.

Answer 2

There are many options that you can explore to sniff packets.

Wireshark is the most useful sniffer and its available for free for all platforms. It has a feature rich GUI which will help you sniff packets and analyze protocols. It has many filters so that you can filter out unwanted packets and only look at packets that you are interested in. Check out their webpage at: available for download for Windows and OS X

To dowload for Linux distros check out this link

If you prefer an alternate solution more on the lines of tcpdump you can also explore tcpflow which is definitely a good option to analyze packets. It also provides you an option to store the files for later analysis. Check this link: tcpflow

Another option is Justsniffer

Which probably best addresses your problem and provides you with text mode logging and is customizable.

Answer 3

tcpdump -i wlan0 -w packet.ppp

this command stores the packets in packet.ppp

after that open it in wireshark

wireshark packet.ppp

right click on the packet and then select Follow tcp packet

then u can have available different formats to view the data in wireshark.

Thanks, Munipratap.