Sniff UDP packets on a local port
I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands
tcpdump -u port 14550
and
tcpdump udp
and
netstat -uanpc | grep 14550
but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command
netstat -lnpuc
, it shows the following among its output
udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
networking
add a comment |
I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands
tcpdump -u port 14550
and
tcpdump udp
and
netstat -uanpc | grep 14550
but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command
netstat -lnpuc
, it shows the following among its output
udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
networking
Have you considered the GUI program calledwireshark? It'll dissect the packets and show you the information being sent by each, and you can then useudp.port == 14550or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff thelointerface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)
– Thomas Ward♦
May 9 '17 at 11:57
Thanks for your comment. I installed Wireshark and typedudp.port == 14550inApply a display filterfiled but nothing appeared. I also triedudp port 14550in theEnter a capture filterfield. Also when I run the commandnetstat -lnpuc, it shows the following among its outputudp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
– Salahuddin Ahmed
May 9 '17 at 12:16
Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
– Thomas Ward♦
May 9 '17 at 12:41
1
Now it's working. I had to runwiresharkwithsudo. Many thanks
– Salahuddin Ahmed
May 9 '17 at 12:59
add a comment |
I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands
tcpdump -u port 14550
and
tcpdump udp
and
netstat -uanpc | grep 14550
but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command
netstat -lnpuc
, it shows the following among its output
udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
networking
I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands
tcpdump -u port 14550
and
tcpdump udp
and
netstat -uanpc | grep 14550
but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command
netstat -lnpuc
, it shows the following among its output
udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
networking
networking
edited May 9 '17 at 12:32
Salahuddin Ahmed
asked May 9 '17 at 11:51
Salahuddin AhmedSalahuddin Ahmed
45117
45117
Have you considered the GUI program calledwireshark? It'll dissect the packets and show you the information being sent by each, and you can then useudp.port == 14550or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff thelointerface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)
– Thomas Ward♦
May 9 '17 at 11:57
Thanks for your comment. I installed Wireshark and typedudp.port == 14550inApply a display filterfiled but nothing appeared. I also triedudp port 14550in theEnter a capture filterfield. Also when I run the commandnetstat -lnpuc, it shows the following among its outputudp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
– Salahuddin Ahmed
May 9 '17 at 12:16
Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
– Thomas Ward♦
May 9 '17 at 12:41
1
Now it's working. I had to runwiresharkwithsudo. Many thanks
– Salahuddin Ahmed
May 9 '17 at 12:59
add a comment |
Have you considered the GUI program calledwireshark? It'll dissect the packets and show you the information being sent by each, and you can then useudp.port == 14550or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff thelointerface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)
– Thomas Ward♦
May 9 '17 at 11:57
Thanks for your comment. I installed Wireshark and typedudp.port == 14550inApply a display filterfiled but nothing appeared. I also triedudp port 14550in theEnter a capture filterfield. Also when I run the commandnetstat -lnpuc, it shows the following among its outputudp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2
– Salahuddin Ahmed
May 9 '17 at 12:16
Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
– Thomas Ward♦
May 9 '17 at 12:41
1
Now it's working. I had to runwiresharkwithsudo. Many thanks
– Salahuddin Ahmed
May 9 '17 at 12:59
Have you considered the GUI program called
wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)– Thomas Ward♦
May 9 '17 at 11:57
Have you considered the GUI program called
wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)– Thomas Ward♦
May 9 '17 at 11:57
Thanks for your comment. I installed Wireshark and typed
udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 – Salahuddin Ahmed
May 9 '17 at 12:16
Thanks for your comment. I installed Wireshark and typed
udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 – Salahuddin Ahmed
May 9 '17 at 12:16
Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
– Thomas Ward♦
May 9 '17 at 12:41
Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
– Thomas Ward♦
May 9 '17 at 12:41
1
1
Now it's working. I had to run
wireshark with sudo. Many thanks– Salahuddin Ahmed
May 9 '17 at 12:59
Now it's working. I had to run
wireshark with sudo. Many thanks– Salahuddin Ahmed
May 9 '17 at 12:59
add a comment |
2 Answers
2
active
oldest
votes
tcpdump supports UDP capturing. example usage:
tcpdump -n udp port 14550
Edit
Because of your applications are communicating with lo interface you must specify interface like this:
tcpdump -i lo -n udp port 14550
this command print headers only. if you want to print data part of packet in hex and ASCII use this:
tcpdump -i lo -n udp port 14550 -X
or if you want to save packets to a file and see it's content in Wireshark use this:
tcpdump -i lo -n udp port 14550 -w packets.pcap
I tried this command but it doesn't capture the packets. It outputs the followinglistening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytesand nothing else!
– Salahuddin Ahmed
May 9 '17 at 13:11
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
@SalahuddinAshraf yes. you must append option-Ato tcpdump to see data. also you can send packet to a file and see packets in Wireshark by-w packets.pcap
– Ghasem Pahlavan
May 9 '17 at 14:11
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
|
show 1 more comment
You can use ngrep. Example:
# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f913393%2fsniff-udp-packets-on-a-local-port%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
tcpdump supports UDP capturing. example usage:
tcpdump -n udp port 14550
Edit
Because of your applications are communicating with lo interface you must specify interface like this:
tcpdump -i lo -n udp port 14550
this command print headers only. if you want to print data part of packet in hex and ASCII use this:
tcpdump -i lo -n udp port 14550 -X
or if you want to save packets to a file and see it's content in Wireshark use this:
tcpdump -i lo -n udp port 14550 -w packets.pcap
I tried this command but it doesn't capture the packets. It outputs the followinglistening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytesand nothing else!
– Salahuddin Ahmed
May 9 '17 at 13:11
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
@SalahuddinAshraf yes. you must append option-Ato tcpdump to see data. also you can send packet to a file and see packets in Wireshark by-w packets.pcap
– Ghasem Pahlavan
May 9 '17 at 14:11
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
|
show 1 more comment
tcpdump supports UDP capturing. example usage:
tcpdump -n udp port 14550
Edit
Because of your applications are communicating with lo interface you must specify interface like this:
tcpdump -i lo -n udp port 14550
this command print headers only. if you want to print data part of packet in hex and ASCII use this:
tcpdump -i lo -n udp port 14550 -X
or if you want to save packets to a file and see it's content in Wireshark use this:
tcpdump -i lo -n udp port 14550 -w packets.pcap
I tried this command but it doesn't capture the packets. It outputs the followinglistening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytesand nothing else!
– Salahuddin Ahmed
May 9 '17 at 13:11
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
@SalahuddinAshraf yes. you must append option-Ato tcpdump to see data. also you can send packet to a file and see packets in Wireshark by-w packets.pcap
– Ghasem Pahlavan
May 9 '17 at 14:11
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
|
show 1 more comment
tcpdump supports UDP capturing. example usage:
tcpdump -n udp port 14550
Edit
Because of your applications are communicating with lo interface you must specify interface like this:
tcpdump -i lo -n udp port 14550
this command print headers only. if you want to print data part of packet in hex and ASCII use this:
tcpdump -i lo -n udp port 14550 -X
or if you want to save packets to a file and see it's content in Wireshark use this:
tcpdump -i lo -n udp port 14550 -w packets.pcap
tcpdump supports UDP capturing. example usage:
tcpdump -n udp port 14550
Edit
Because of your applications are communicating with lo interface you must specify interface like this:
tcpdump -i lo -n udp port 14550
this command print headers only. if you want to print data part of packet in hex and ASCII use this:
tcpdump -i lo -n udp port 14550 -X
or if you want to save packets to a file and see it's content in Wireshark use this:
tcpdump -i lo -n udp port 14550 -w packets.pcap
edited May 9 '17 at 14:19
answered May 9 '17 at 13:07
Ghasem PahlavanGhasem Pahlavan
1,231717
1,231717
I tried this command but it doesn't capture the packets. It outputs the followinglistening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytesand nothing else!
– Salahuddin Ahmed
May 9 '17 at 13:11
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
@SalahuddinAshraf yes. you must append option-Ato tcpdump to see data. also you can send packet to a file and see packets in Wireshark by-w packets.pcap
– Ghasem Pahlavan
May 9 '17 at 14:11
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
|
show 1 more comment
I tried this command but it doesn't capture the packets. It outputs the followinglistening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytesand nothing else!
– Salahuddin Ahmed
May 9 '17 at 13:11
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
@SalahuddinAshraf yes. you must append option-Ato tcpdump to see data. also you can send packet to a file and see packets in Wireshark by-w packets.pcap
– Ghasem Pahlavan
May 9 '17 at 14:11
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
I tried this command but it doesn't capture the packets. It outputs the following
listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!– Salahuddin Ahmed
May 9 '17 at 13:11
I tried this command but it doesn't capture the packets. It outputs the following
listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!– Salahuddin Ahmed
May 9 '17 at 13:11
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
@SalahuddinAshraf I fixed it :)
– Ghasem Pahlavan
May 9 '17 at 13:30
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?
– Salahuddin Ahmed
May 9 '17 at 14:05
@SalahuddinAshraf yes. you must append option
-A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap– Ghasem Pahlavan
May 9 '17 at 14:11
@SalahuddinAshraf yes. you must append option
-A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap– Ghasem Pahlavan
May 9 '17 at 14:11
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks
– Salahuddin Ahmed
May 9 '17 at 14:14
|
show 1 more comment
You can use ngrep. Example:
# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201
add a comment |
You can use ngrep. Example:
# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201
add a comment |
You can use ngrep. Example:
# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201
You can use ngrep. Example:
# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201
answered Feb 6 at 8:26
Alexander YancharukAlexander Yancharuk
1012
1012
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f913393%2fsniff-udp-packets-on-a-local-port%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Have you considered the GUI program called
wireshark? It'll dissect the packets and show you the information being sent by each, and you can then useudp.port == 14550or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff thelointerface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)– Thomas Ward♦
May 9 '17 at 11:57
Thanks for your comment. I installed Wireshark and typed
udp.port == 14550inApply a display filterfiled but nothing appeared. I also triedudp port 14550in theEnter a capture filterfield. Also when I run the commandnetstat -lnpuc, it shows the following among its outputudp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2– Salahuddin Ahmed
May 9 '17 at 12:16
Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
– Thomas Ward♦
May 9 '17 at 12:41
1
Now it's working. I had to run
wiresharkwithsudo. Many thanks– Salahuddin Ahmed
May 9 '17 at 12:59