Sniff UDP packets on a local port












6















I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands



tcpdump -u port 14550


and



tcpdump udp


and



netstat -uanpc | grep 14550


but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command



netstat -lnpuc


, it shows the following among its output



udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 









share|improve this question

























  • Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)

    – Thomas Ward
    May 9 '17 at 11:57













  • Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2

    – Salahuddin Ahmed
    May 9 '17 at 12:16













  • Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?

    – Thomas Ward
    May 9 '17 at 12:41






  • 1





    Now it's working. I had to run wireshark with sudo. Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 12:59
















6















I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands



tcpdump -u port 14550


and



tcpdump udp


and



netstat -uanpc | grep 14550


but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command



netstat -lnpuc


, it shows the following among its output



udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 









share|improve this question

























  • Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)

    – Thomas Ward
    May 9 '17 at 11:57













  • Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2

    – Salahuddin Ahmed
    May 9 '17 at 12:16













  • Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?

    – Thomas Ward
    May 9 '17 at 12:41






  • 1





    Now it's working. I had to run wireshark with sudo. Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 12:59














6












6








6


2






I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands



tcpdump -u port 14550


and



tcpdump udp


and



netstat -uanpc | grep 14550


but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command



netstat -lnpuc


, it shows the following among its output



udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 









share|improve this question
















I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands



tcpdump -u port 14550


and



tcpdump udp


and



netstat -uanpc | grep 14550


but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this?
When I run the command



netstat -lnpuc


, it shows the following among its output



udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 






networking






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited May 9 '17 at 12:32







Salahuddin Ahmed

















asked May 9 '17 at 11:51









Salahuddin AhmedSalahuddin Ahmed

45117




45117













  • Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)

    – Thomas Ward
    May 9 '17 at 11:57













  • Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2

    – Salahuddin Ahmed
    May 9 '17 at 12:16













  • Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?

    – Thomas Ward
    May 9 '17 at 12:41






  • 1





    Now it's working. I had to run wireshark with sudo. Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 12:59



















  • Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)

    – Thomas Ward
    May 9 '17 at 11:57













  • Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2

    – Salahuddin Ahmed
    May 9 '17 at 12:16













  • Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?

    – Thomas Ward
    May 9 '17 at 12:41






  • 1





    Now it's working. I had to run wireshark with sudo. Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 12:59

















Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)

– Thomas Ward
May 9 '17 at 11:57







Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)

– Thomas Ward
May 9 '17 at 11:57















Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2

– Salahuddin Ahmed
May 9 '17 at 12:16







Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2

– Salahuddin Ahmed
May 9 '17 at 12:16















Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?

– Thomas Ward
May 9 '17 at 12:41





Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?

– Thomas Ward
May 9 '17 at 12:41




1




1





Now it's working. I had to run wireshark with sudo. Many thanks

– Salahuddin Ahmed
May 9 '17 at 12:59





Now it's working. I had to run wireshark with sudo. Many thanks

– Salahuddin Ahmed
May 9 '17 at 12:59










2 Answers
2






active

oldest

votes


















8














tcpdump supports UDP capturing. example usage:



tcpdump -n udp port 14550


Edit



Because of your applications are communicating with lo interface you must specify interface like this:



tcpdump -i lo -n udp port 14550


this command print headers only. if you want to print data part of packet in hex and ASCII use this:



tcpdump -i lo -n udp port 14550 -X


or if you want to save packets to a file and see it's content in Wireshark use this:



tcpdump -i lo -n udp port 14550 -w packets.pcap





share|improve this answer


























  • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

    – Salahuddin Ahmed
    May 9 '17 at 13:11











  • @SalahuddinAshraf I fixed it :)

    – Ghasem Pahlavan
    May 9 '17 at 13:30













  • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

    – Salahuddin Ahmed
    May 9 '17 at 14:05











  • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

    – Ghasem Pahlavan
    May 9 '17 at 14:11











  • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 14:14



















0














You can use ngrep. Example:



# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201





share|improve this answer
























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "89"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f913393%2fsniff-udp-packets-on-a-local-port%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    2 Answers
    2






    active

    oldest

    votes








    2 Answers
    2






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    8














    tcpdump supports UDP capturing. example usage:



    tcpdump -n udp port 14550


    Edit



    Because of your applications are communicating with lo interface you must specify interface like this:



    tcpdump -i lo -n udp port 14550


    this command print headers only. if you want to print data part of packet in hex and ASCII use this:



    tcpdump -i lo -n udp port 14550 -X


    or if you want to save packets to a file and see it's content in Wireshark use this:



    tcpdump -i lo -n udp port 14550 -w packets.pcap





    share|improve this answer


























    • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

      – Salahuddin Ahmed
      May 9 '17 at 13:11











    • @SalahuddinAshraf I fixed it :)

      – Ghasem Pahlavan
      May 9 '17 at 13:30













    • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

      – Salahuddin Ahmed
      May 9 '17 at 14:05











    • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

      – Ghasem Pahlavan
      May 9 '17 at 14:11











    • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

      – Salahuddin Ahmed
      May 9 '17 at 14:14
















    8














    tcpdump supports UDP capturing. example usage:



    tcpdump -n udp port 14550


    Edit



    Because of your applications are communicating with lo interface you must specify interface like this:



    tcpdump -i lo -n udp port 14550


    this command print headers only. if you want to print data part of packet in hex and ASCII use this:



    tcpdump -i lo -n udp port 14550 -X


    or if you want to save packets to a file and see it's content in Wireshark use this:



    tcpdump -i lo -n udp port 14550 -w packets.pcap





    share|improve this answer


























    • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

      – Salahuddin Ahmed
      May 9 '17 at 13:11











    • @SalahuddinAshraf I fixed it :)

      – Ghasem Pahlavan
      May 9 '17 at 13:30













    • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

      – Salahuddin Ahmed
      May 9 '17 at 14:05











    • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

      – Ghasem Pahlavan
      May 9 '17 at 14:11











    • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

      – Salahuddin Ahmed
      May 9 '17 at 14:14














    8












    8








    8







    tcpdump supports UDP capturing. example usage:



    tcpdump -n udp port 14550


    Edit



    Because of your applications are communicating with lo interface you must specify interface like this:



    tcpdump -i lo -n udp port 14550


    this command print headers only. if you want to print data part of packet in hex and ASCII use this:



    tcpdump -i lo -n udp port 14550 -X


    or if you want to save packets to a file and see it's content in Wireshark use this:



    tcpdump -i lo -n udp port 14550 -w packets.pcap





    share|improve this answer















    tcpdump supports UDP capturing. example usage:



    tcpdump -n udp port 14550


    Edit



    Because of your applications are communicating with lo interface you must specify interface like this:



    tcpdump -i lo -n udp port 14550


    this command print headers only. if you want to print data part of packet in hex and ASCII use this:



    tcpdump -i lo -n udp port 14550 -X


    or if you want to save packets to a file and see it's content in Wireshark use this:



    tcpdump -i lo -n udp port 14550 -w packets.pcap






    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited May 9 '17 at 14:19

























    answered May 9 '17 at 13:07









    Ghasem PahlavanGhasem Pahlavan

    1,231717




    1,231717













    • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

      – Salahuddin Ahmed
      May 9 '17 at 13:11











    • @SalahuddinAshraf I fixed it :)

      – Ghasem Pahlavan
      May 9 '17 at 13:30













    • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

      – Salahuddin Ahmed
      May 9 '17 at 14:05











    • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

      – Ghasem Pahlavan
      May 9 '17 at 14:11











    • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

      – Salahuddin Ahmed
      May 9 '17 at 14:14



















    • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

      – Salahuddin Ahmed
      May 9 '17 at 13:11











    • @SalahuddinAshraf I fixed it :)

      – Ghasem Pahlavan
      May 9 '17 at 13:30













    • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

      – Salahuddin Ahmed
      May 9 '17 at 14:05











    • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

      – Ghasem Pahlavan
      May 9 '17 at 14:11











    • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

      – Salahuddin Ahmed
      May 9 '17 at 14:14

















    I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

    – Salahuddin Ahmed
    May 9 '17 at 13:11





    I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else!

    – Salahuddin Ahmed
    May 9 '17 at 13:11













    @SalahuddinAshraf I fixed it :)

    – Ghasem Pahlavan
    May 9 '17 at 13:30







    @SalahuddinAshraf I fixed it :)

    – Ghasem Pahlavan
    May 9 '17 at 13:30















    thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

    – Salahuddin Ahmed
    May 9 '17 at 14:05





    thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself?

    – Salahuddin Ahmed
    May 9 '17 at 14:05













    @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

    – Ghasem Pahlavan
    May 9 '17 at 14:11





    @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap

    – Ghasem Pahlavan
    May 9 '17 at 14:11













    Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 14:14





    Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks

    – Salahuddin Ahmed
    May 9 '17 at 14:14













    0














    You can use ngrep. Example:



    # Any UDP from any local interfaces to 91.22.38.4:12201
    ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201





    share|improve this answer




























      0














      You can use ngrep. Example:



      # Any UDP from any local interfaces to 91.22.38.4:12201
      ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201





      share|improve this answer


























        0












        0








        0







        You can use ngrep. Example:



        # Any UDP from any local interfaces to 91.22.38.4:12201
        ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201





        share|improve this answer













        You can use ngrep. Example:



        # Any UDP from any local interfaces to 91.22.38.4:12201
        ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201






        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Feb 6 at 8:26









        Alexander YancharukAlexander Yancharuk

        1012




        1012






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Ask Ubuntu!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f913393%2fsniff-udp-packets-on-a-local-port%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Questions related to Moebius Transform of Characteristic Function of the Primes

            List of scandals in India

            Can not write log (Is /dev/pts mounted?) - openpty in Ubuntu-on-Windows?