tcpdump

1 Introduction

This is a small tool for capturing IP packets based on RT-Thread. The captured data can be saved through the file system, or imported into the PC through the rdb tool, and analyzed by the wireshark software.

1.1, dependency

Rely on optparse package
Rely on dfs file system
Rely on env tool
RT-Thread 3.0+, no dependency on bsp

1.2、How to get

Use menuconfig to enable tcpdump, the details are as follows:

  RT-Thread online packages --->
      IOT internet of things --->
          [*] netutils: Networking utilities for RT-Thread --->
          [*] Enable tcpdump tool
          [] Enable tcpdump data to print on the console
          [*] Enable tcpdump debug log output

After saving the menuconfig configuration, use the pkgs --update command to download the package

Note: The debugging information is not recommended

2. Use

2.1, the meaning of tcpdump command

-i: Specify the listening network interface
-m: select the save mode (file system or rdb)
-w: user-specified file name xx.pcap
-p: stop capturing packets
-h: help information

2.2、Command details

msh />tcpdump -h

|>------------------------- help -------------------------<|
| tcpdump [-p] [-h] [-i interface] [-m mode] [-w file]     |
|                                                          |
| -h: help                                                 |
| -i: specify the network interface for listening          |
| -m: choose what mode(file-system or rdb) to save the file|
| -w: write the captured packets into an xx.pcap file      |
| -p: stop capturing packets                               |
|                                                          |
| e.g.:                                                    |
| specify network interface and select save mode \         |
| and specify filename                                     |
| tcpdump -ie0 -mfile -wtext.pcap                          |
| tcpdump -ie0 -mrdb -wtext.pcap                           |
|                                                          |
| -m: file-system mode                                     |
| tcpdump -mfile                                           |
|                                                          |
| -m: rdb mode                                             |
| tcpdump -mrdb                                            |
|                                                          |
| -w: file                                                 |
| tcpdump -wtext.pcap                                      |
|                                                          |
| -p: stop                                                 |
| tcpdump -p                                               |
|                                                          |
| -h: help                                                 |
| tcpdump -h                                               |
|                                                          |
| write commands but no arguments are illegal!!            |
| e.g.: tcpdump -i / -i -mfile  / -i -mfile -wtext.pcap    |
|>------------------------- help -------------------------<|

msh />

3. Use the file system to save the captured data

We are here to mount the sd-card to the file system

3.1, prepare before capturing

Before powering on the development board, insert the sd-card

If the mount is successful, it will prompt:

SD card capacity 31023104 KB
probe mmcsd block device!
found part[0], begin: 10485760, size: 29.580GB
File System initialized!

If the mount fails, it will prompt:

sdcard init fail or timeout: -2!

The mount is successful, enter list_device to see the sd0 device, the details are as follows:

msh />list_device
device         type         ref count
------ -------------------- ---------
sd0    Block Device         1       
e0     Network Interface    0             
usbd   USB Slave Device     0                   
rtc    RTC                  1       
spi4   SPI Bus              0       
pin    Miscellaneous Device 0       
uart1  Character Device     3       
msh />

3.2, check before capturing packets

Please confirm the IP address of the board before capturing packets

In msh />, enter ifconfig to view, the details are as follows:

msh />
network interface: e0 (Default)
MTU: 1500
MAC: 00 04 9f 05 44 e5
FLAGS: UP LINK_UP ETHARP BROADCAST
ip address: 192.168.1.137
gw address: 192.168.1.1
net mask: 255.255.255.0
dns server #0: 192.168.1.1
dns server #1: 0.0.0.0
msh />

3.3, start capturing packets

In msh />, enter tcpdump -ie0 -mfile -wtext.pcap, the details are as follows:

msh />tcpdump -ie0 -msd -wtext.pcap
[TCPDUMP]select [e0] network card device
[TCPDUMP]select [file-system] mode
[TCPDUMP]save in [text.pcap]
[TCPDUMP]tcpdump start!
msh />

Use the capture command to create a thread, the thread priority is 12.
Enter the list_thread command to view the running threads, the thread name is tdth, details are as follows:

thread   pri  status      sp     stack size max used left tick  error
-------- ---  ------- ---------- ----------  ------  ---------- ---
tdth      12  suspend 0x000000ac 0x00000800    08%   0x0000000a 000
tshell    20  ready   0x00000070 0x00001000    22%   0x00000003 000
rp80       8  suspend 0x0000009c 0x00000400    15%   0x0000000a 000
phy       30  suspend 0x00000070 0x00000200    28%   0x00000001 000
usbd       8  suspend 0x00000098 0x00001000    03%   0x00000014 000
tcpip     10  suspend 0x000000b4 0x00000400    39%   0x00000014 000
etx       12  suspend 0x00000084 0x00000400    12%   0x00000010 000
erx       12  suspend 0x00000084 0x00000400    34%   0x00000010 000
mmcsd_de  22  suspend 0x0000008c 0x00000400    49%   0x00000013 000
tidle     31  ready   0x00000054 0x00000100    32%   0x0000001a 000
main      10  suspend 0x00000064 0x00000800    35%   0x00000010 000
msh />

3.4, packet capture test

Use ping command to perform packet capture test, ping command needs to be enabled in menuconfig configuration, Details are as follows:

  RT-Thread online packages --->
      IOT internet of things --->
          [*] Enable Ping utility

After saving the menuconfig configuration, use the pkgs --update command to download the package

3.4.1, ping domain name

Enter ping rt-thread.org in msh />, the details are as follows:

msh />ping rt-thread.org
60 bytes from 116.62.244.242 icmp_seq=0 ttl=49 time=11 ticks
60 bytes from 116.62.244.242 icmp_seq=1 ttl=49 time=10 ticks
60 bytes from 116.62.244.242 icmp_seq=2 ttl=49 time=12 ticks
60 bytes from 116.62.244.242 icmp_seq=3 ttl=49 time=10 ticks
msh />

3.4.2, ping IP

Enter ping 192.168.1.121 in msh />, the details are as follows:

msh />ping 192.168.1.121
60 bytes from 192.168.10.121 icmp_seq=0 ttl=64 time=5 ticks
60 bytes from 192.168.10.121 icmp_seq=1 ttl=64 time=1 ticks
60 bytes from 192.168.10.121 icmp_seq=2 ttl=64 time=2 ticks
60 bytes from 192.168.10.121 icmp_seq=3 ttl=64 time=3 ticks
msh />

3.5, stop capturing packets

In msh />, enter tcpdump -p, the details are as follows:

msh />tcpdump -p
[TCPDUMP]tcpdump stop and tcpdump thread exit!
msh />

3.6, view the results

In msh />, enter ls to view the saved results, the details are as follows:

msh />ls
Directory /:
System Volume Information<DIR>
text.pcap 1012
msh />

3.7, post-capture processing

Use a card reader to copy the xx.pcap file saved in the sd-card to the PC, and use the packet capture software wireshark to directly analyze the network flow

4. Import the captured file into the PC through the rdb tool

4.1, open packet capture

In msh />, enter tcpdump -ie0 -mrdb -wtext.pcap, the details are as follows:

msh />tcpdump -ie0 -mrdb -wtext.pcap
[TCPDUMP]select [e0] network card device
[TCPDUMP]select [rdb] mode
[TCPDUMP]save in [text.pcap]
[TCPDUMP]tcpdump start!
msh />

4.2, packet capture test

Please refer to 3.4 operation

4.3, stop capturing packets

In msh />, enter tcpdump -p, the details are as follows:

msh />tcpdump -p
[TCPDUMP]tcpdump stop and tcpdump thread exit!
msh />

4.4, view results

In msh />, enter ls to view the saved results, the details are as follows:

msh />ls
Directory /:
System Volume Information<DIR>
text.pcap 1012
msh />

4.5, post-capture processing

Use the rdb tool to import the xx.pcap file to the PC, and use the packet capture software wireshark to directly analyze the network flow

5. Matters needing attention

The tcpdump tool needs to open the sending and receiving threads of lwip
The packet capture is over or you don’t want to capture the packet anymore, please enter tcpdump -p to end the packet capture

6. Contact & Thanks

Thanks: liu2guang made the optprase package
Thanks: uestczyh222 for making rdb tool & rdb host computer
Maintenance: never
Homepage: https://github.com/RT-Thread-packages/netutils

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

README-en.md

README-en.md

tcpdump

1 Introduction

1.1, dependency

1.2、How to get

2. Use

2.1, the meaning of tcpdump command

2.2、Command details

3. Use the file system to save the captured data

3.1, prepare before capturing

3.2, check before capturing packets

3.3, start capturing packets

3.4, packet capture test

3.4.1, ping domain name

3.4.2, ping IP

3.5, stop capturing packets

3.6, view the results

3.7, post-capture processing

4. Import the captured file into the PC through the rdb tool

4.1, open packet capture

4.2, packet capture test

4.3, stop capturing packets

4.4, view results

4.5, post-capture processing

5. Matters needing attention

6. Contact & Thanks

Files

README-en.md

Latest commit

History

README-en.md

File metadata and controls

tcpdump

1 Introduction

1.1, dependency

1.2、How to get

2. Use

2.1, the meaning of tcpdump command

2.2、Command details

3. Use the file system to save the captured data

3.1, prepare before capturing

3.2, check before capturing packets

3.3, start capturing packets

3.4, packet capture test

3.4.1, ping domain name

3.4.2, ping IP

3.5, stop capturing packets

3.6, view the results

3.7, post-capture processing

4. Import the captured file into the PC through the rdb tool

4.1, open packet capture

4.2, packet capture test

4.3, stop capturing packets

4.4, view results

4.5, post-capture processing

5. Matters needing attention

6. Contact & Thanks