How to get tcpdump to save to a file without using binary? - unix

Question

I want to capture the packet content description and the packet data to a file with tcpdump for later inspection.
Currently I am using the -w option to save packet data to a file:
tcpdump -c 100 -w /root/tcpdump.txt
This saves the packet data to the file but also includes several lines of binary before each packet. However, I would like to have the packet content description (what's normally shown on STDOUT when running tcpdump) shown before the packet data itself (in the same file) without the binary.
So the file should save the following for each packet:
Packet content description
Packet data
Example of what I want to save to the file:
17:17:42.847059 IP some.server.com.17845 > some.host.net.55618: Flags [P.], seq 137568:137888, ack 1185, win 167, length 320
<-- Followed by the raw packet data here -->
This information is to be used for later analysis of the file so we can review the full packets going to a specific host/address.
Can anyone suggest how to do this?

Answer 1

tcpdump -c 100 -w /root/tcpdump.txt
If you use -w with a name that ends with .txt, you're misunderstanding what -w does.
-w writes out a completely binary file, in pcap format, which is intended to be read by tcpdump or by other programs such as Wireshark, NOT to be directly read by humans!
IF the packets, at some layer, are carrying a text-based protocol, such as the FTP control protocol, SMTP, or HTTP requests/responses and their headers, then SOME of the data in the file will be text, but it will NOT all be text. Do NOT treat that as an indication that it is, or should be, a text file.
However, I would like to have the packet content description (what's normally shown on STDOUT when running tcpdump) shown before the packet data itself (in the same file) without the binary.
The packet data itself is binary!
If you mean you want a text hex dump of the packet data, in a form such as
0x0000: 0001 0800 0604 0001 0001 0000 0010 0a78
0x0010: 0452 0000 0000 0000 0a78 0452 0101 0600
after the packet description, so that what you see is like this:
17:49:38.007886 ARP, Request who-has 10.120.4.82 tell 10.120.4.82, length 32
0x0000: 0001 0800 0604 0001 0001 0000 0010 0a78
0x0010: 0452 0000 0000 0000 0a78 0452 0101 0600
then you should do
tcpdump -c 100 -x >/root/tcpdump.txt
so that the text output of tcpdump - the output you get when you don't use -w - is redirected to /root/tcpdump.txt rather than being printed on your terminal or terminal emulator, and so that a hex dump is written as well as a packet description (that's what -x tells tcpdump to do).
This will not write out the link-layer header for the packet in the hex dump; if you want the link-layer header for the packet, e.g.
17:49:38.007886 ARP, Request who-has 10.120.4.82 tell 10.120.4.82, length 32
0x0000: ffff ffff ffff 0001 0000 0010 0806 0001
0x0010: 0800 0604 0001 0001 0000 0010 0a78 0452
0x0020: 0000 0000 0000 0a78 0452 0101 0600
then use -xx rather than -x.