tcp dump

[navin]

Hello,
i have a rp3440 server..i need to install tcp dump on these.what are the steps
thanks

[Tim Nelson · Accepted solution]

TCP Dump is included on the HPUX Internet Express. Precompiled and ready to swinstall.

Goto http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

download and swinstall

If you prefer to compile your own then search the web for all the pre-requisites. ( hpux porting center ). and good luck.

[Patrick Wallek]

What version of HP-UX are you running?

For HP-UX 11.11 go here and download:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

For HP-UX 11.23 go here and download:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

For HP-UX 11.31 go here and download:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1131

You should then be able to install via swinstall.

[Jeff_Traigle]

1. Go to http://software.hp.com
2. Search for tcpdump
3. Select the Internet Express for your version of HP-UX from the resulting list
4. Download tcpdump from it
5. Follow the installation instructions that are available from the download page (should be a simple swinstall command)

[navin]

Please let me know how that will be used to capture and analyze
thanks

[Patrick Wallek]

I suggest you install it and then read the manual pages / documentation.

Then, if you have further questions you can post.

[Laurent Menase]

tcpdump -i lan0 -w alogfile

and then use wireshark to analyse it.

Else on HPUX you have a tool named nettl.
It is more precise than tcpdump.

to use it:
nettl -tn all -e selecteur -f /tmp/myresult -m 80

selecteur can me a combination of subsystems:
it can be
'all' -all subsys
NS_LS_IP to trace IP layer only
NS_LS_TCP to trace IP layer only
IGELAN for igelan lan interface
ILAN, GELAN, BTLAN IETHER
nettl -ss to have the full list
for instance if you have igelan interface and want to trace IP and interface layer :
nettl -tn all -e NS_LS_IP IGELAN -f /tmp/myresult -m 80
-m 80 option is to limit the part of the data acquired to the 80 first byte of message, to limit nettl overhead, and avoid to lose messages.
-tm can be used to specify the size of the trace.

to stop the tracing
nettl -tf -e all
to analyse:
wireshark or netfmt.
http://www.wireshark.org/download.html

[Karsten Radke_1]

for tcpdump usage see
http://dmiessler.com/study/tcpdump_recipes

Regards,
Karsten

[Yogeeraj_1]

hi navin,

Wireshark also available from the Internet Express bundle:
http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123


kind regards
yogeeraj