topic Re: tcp dump in Operating System - HP-UX

tcp dump

navin — Wed, 14 May 2008 20:42:07 GMT

Hello,
i have a rp3440 server..i need to install tcp dump on these.what are the steps
thanks

Re: tcp dump

Tim Nelson — Wed, 14 May 2008 20:46:37 GMT

TCP Dump is included on the HPUX Internet Express. Precompiled and ready to swinstall.

Goto http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

download and swinstall

If you prefer to compile your own then search the web for all the pre-requisites. ( hpux porting center ). and good luck.

Re: tcp dump

Patrick Wallek — Wed, 14 May 2008 20:47:40 GMT

What version of HP-UX are you running?

For HP-UX 11.11 go here and download:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

For HP-UX 11.23 go here and download:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

For HP-UX 11.31 go here and download:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1131

You should then be able to install via swinstall.

Re: tcp dump

Jeff_Traigle — Wed, 14 May 2008 20:48:07 GMT

1. Go to http://software.hp.com
2. Search for tcpdump
3. Select the Internet Express for your version of HP-UX from the resulting list
4. Download tcpdump from it
5. Follow the installation instructions that are available from the download page (should be a simple swinstall command)

Re: tcp dump

navin — Wed, 14 May 2008 21:00:47 GMT

Please let me know how that will be used to capture and analyze
thanks

Re: tcp dump

Patrick Wallek — Wed, 14 May 2008 21:50:59 GMT

I suggest you install it and then read the manual pages / documentation.

Then, if you have further questions you can post.

Re: tcp dump

Laurent Menase — Thu, 15 May 2008 06:56:23 GMT

tcpdump -i lan0 -w alogfile

and then use wireshark to analyse it.

Else on HPUX you have a tool named nettl.
It is more precise than tcpdump.

to use it:
nettl -tn all -e selecteur -f /tmp/myresult -m 80

selecteur can me a combination of subsystems:
it can be
'all' -all subsys
NS_LS_IP to trace IP layer only
NS_LS_TCP to trace IP layer only
IGELAN for igelan lan interface
ILAN, GELAN, BTLAN IETHER
nettl -ss to have the full list
for instance if you have igelan interface and want to trace IP and interface layer :
nettl -tn all -e NS_LS_IP IGELAN -f /tmp/myresult -m 80
-m 80 option is to limit the part of the data acquired to the 80 first byte of message, to limit nettl overhead, and avoid to lose messages.
-tm can be used to specify the size of the trace.

to stop the tracing
nettl -tf -e all
to analyse:
wireshark or netfmt.
http://www.wireshark.org/download.html

Re: tcp dump

Karsten Radke_1 — Thu, 15 May 2008 08:26:02 GMT

for tcpdump usage see
http://dmiessler.com/study/tcpdump_recipes

Regards,
Karsten

Re: tcp dump

Yogeeraj_1 — Thu, 15 May 2008 10:23:26 GMT

hi navin,

Wireshark also available from the Internet Express bundle:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

kind regards
yogeeraj