Re: 8 hours of pinging

[bugtraq () NETWORKICE COM (Robert Graham)]

> How do I grab the entire packet with TCPDUMP please?

tcpdump -s 1518 -w foo.tcp proto 1

This will capture all the ICMP traffic on your system and save it into a
file called "foo.tcp".

-s means "snap length". Normally, TCPDUMP only captures the headers. Since
the maxmimum size frame on Ethernet is 1518 (including CRC), this will
capture everything.

-w means "write" to the following file name.

"proto 1" means only capture those packets whose IP "protocol" field is
equal to "1", which means "ICMP" packets.

More on TCPDUMP can be found at:
http://www.tcpdump.org

More on sniffing in general can be found at:
http://www.robertgraham.com/pubs/sniffing-faq.html

Robert Graham