Jump to content

Tcpdump


Whistle Master

Recommended Posts

Hi everyone !

I present my new module for our pineapple, a tcpdump interface smile.gif

Module will be available through module system.

Still need more test but if some of you want to beta test, ask me by PM and I will send you the test version wink.gif

Features

- Dump history

- Tcpdump options selection

- Filter creation

0a9cea8c20d455094a2a54e65a34b39bed76de0605efaa57b82348a3b1a02fb82g.jpg5297137f067b19bae03f425329b60b1f9de8db8b65e843fc31423b9e886a4cb02g.jpg

Edited by Whistle Master
Link to comment
Share on other sites

...and it's been published. Playing with it while I write this. Lovely. Thanks!

Edit:

Been having success with this filter to capture all http posts, but admittedly my tcpdump-fu is weak:

tcpdump -i 3g-wan2 'port 80 and (tcp[20:4] = 1347375956 or tcp[24:4] = 1347375956 or tcp[28:4] = 1347375956 or tcp[32:4] = 1347375956 or tcp[36:4] = 1347375956 or tcp[40:4] = 1347375956 or tcp[44:4] = 1347375956 or tcp[48:4] = 1347375956 or tcp[52:4] = 1347375956 or tcp[56:4] = 1347375956 or tcp[60:4] = 1347375956)'

Based on this post: http://superuser.com/questions/286062/practical-tcpdump-examples

Edited by MarcusW
Link to comment
Share on other sites

Ask and you shall receive! FROM WM! Thanks dude!

telot

Link to comment
Share on other sites

  • 1 year later...

Hopefully I am posting this in the right location if not mods feel free to move this.

I noticed with the tcpdump infusion it spits out that it fails to load libpcap.so.1.3

With a little browsing around the system I noticed that libpcap.so.1.3 isn't on there... however libpcap.so.1.1.1 is.

Anyone who runs into this issue should be able to symlink libpcap.so.1.3 to libpcap.so.1.1.1 and it should work (or atleast did for me) by doing the following over either ssh or from the "Execute Commands" menu in the gui.

ln -s /usr/lib/libpcap.so /usr/lib/libpcap.so.1.3

NOTE: /usr/lib/libpcap.so is itself linked to libpcap.so.1.1.1 on my pineapple.

Link to comment
Share on other sites

  • 4 weeks later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...