CentOS - Apr 2010 - Using Wireshark on CentOS without UI

Hi All

Yesterday i had installed wireshark on my centos box which does not have 
the GUI , It is actually a hardened box. I installed the tool using the 
following command:

yum install wireshark

After installation i dont know how to proceed further in capturing the 
packets. I basically want to capture packets and copy them onto my 
windows box. On the windows box i can use the Wireshark UI to open the 
pcap file to view its contents.

Can some one help me in this regard.

Thanks
Jatin

On 22 April 2010 12:57, Jatin Davey <jashokda at cisco.com>
wrote:
> Hi All
>
> Yesterday i had installed wireshark on my centos box which does not have
> the GUI , It is actually a hardened box. I installed the tool using the
> following command:
>
> yum install wireshark
>
> After installation i dont know how to proceed further in capturing the
> packets. I basically want to capture packets and copy them onto my
> windows box. On the windows box i can use the Wireshark UI to open the
> pcap file to view its contents.
>
> Can some one help me in this regard.
>
> Thanks
> Jatin
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
For a box with no GUI use tcpdump to get a packet capture to then scp
over to a box with wireshark on it to analyse the traffic... your
windows box in this case.

James

Hi,
> Yesterday i had installed wireshark on my centos box which does not have
> the GUI , It is actually a hardened box. I installed the tool using the
> following command:
>
> yum install wireshark
>
> After installation i dont know how to proceed further in capturing the
> packets. I basically want to capture packets and copy them onto my
> windows box. On the windows box i can use the Wireshark UI to open the
> pcap file to view its contents.
Wireshark in cli mode is called tshark.

With 'tshark -i eth0 -w outfile' captures all traffic on eth0 to
outfile.

      Regards,


      Michel

Is the installation of tcpdump similar to wireshark ,

which is : yum install tcpdump ?

How about getting started with it , Any documentation available for it ?

Thanks
Jatin

On 4/22/2010 5:30 PM, James Hogarth wrote:
> On 22 April 2010 12:57, Jatin Davey<jashokda at cisco.com>  wrote:
>    
>> Hi All
>>
>> Yesterday i had installed wireshark on my centos box which does not
have
>> the GUI , It is actually a hardened box. I installed the tool using the
>> following command:
>>
>> yum install wireshark
>>
>> After installation i dont know how to proceed further in capturing the
>> packets. I basically want to capture packets and copy them onto my
>> windows box. On the windows box i can use the Wireshark UI to open the
>> pcap file to view its contents.
>>
>> Can some one help me in this regard.
>>
>> Thanks
>> Jatin
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> http://lists.centos.org/mailman/listinfo/centos
>>
>>      
> For a box with no GUI use tcpdump to get a packet capture to then scp
> over to a box with wireshark on it to analyse the traffic... your
> windows box in this case.
>
> James
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
>

Thanks James,

I will install it on my box. Thanks for the support.

Thanks
Jatin

On 4/22/2010 5:40 PM, James Hogarth wrote:
> On 22 April 2010 13:03, Jatin Davey<jashokda at cisco.com>  wrote:
>    
>> Is the installation of tcpdump similar to wireshark ,
>>
>> which is : yum install tcpdump ?
>>
>> How about getting started with it , Any documentation available for it
?
>>
>> Thanks
>> Jatin
>>
>>      
> Indeed yum install tcpdump
>
> man tcpdump will give you lots of documentation after you install it
>
> To get you started...
>
> sudo tcpdump -w networkdump.pcap
>
> scp networkdump.pcap<user>@<yoursystem>:
>
> open networkdump.pcap in your wireshark on your box
>
> ???
>
> profit
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
>

Thanks Michel

I would explore more on the tshark usage. Thanks for the support.

Thanks
Jatin

On 4/22/2010 5:31 PM, Michel van Deventer wrote:
> Hi,
>
>    
>> Yesterday i had installed wireshark on my centos box which does not
have
>> the GUI , It is actually a hardened box. I installed the tool using the
>> following command:
>>
>> yum install wireshark
>>
>> After installation i dont know how to proceed further in capturing the
>> packets. I basically want to capture packets and copy them onto my
>> windows box. On the windows box i can use the Wireshark UI to open the
>> pcap file to view its contents.
>>      
> Wireshark in cli mode is called tshark.
>
> With 'tshark -i eth0 -w outfile' captures all traffic on eth0 to
outfile.
>
>        Regards,
>
>
>        Michel
>
>
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
>

Don't even need wireshark (tshark) for that - just use native tcpdump

Check the man page for it.


-- 
?Don't eat anything you've ever seen advertised on TV?
         - Michael Pollan, author of "In Defense of Food"