tcpdump, snort, looking for a string on a network interface ...

[A. Daniel King_1]

I'm working with a complex, proprietary application, with many tcp/ip clients.

Occasionally, a client (under HP-UX 11i) will go nuts -- manifesting in application stoppage.

The logs (as well as fuser and lsof/netstat against the application process and logs) are not sufficient to isolate the particular client. There are frequent stops, reconnects, etc.

The only thing I have to go on is a logged string repeated over and over again, which I believe is an explicit query. Is there a way to detect IF any of the hundreds of connected clients are issuing this string repeatedly (or at all) from a network perspective? The string is fairly unique, but also fairly small given the amount of network traffic we see.

Needle in a network haystack, anyone?

[A. Clay Stephenson · Accepted solution]

I would download and install ethereal.
http://gatekeep.cs.utah.edu/hppd/hpux/Gtk/Applications/ethereal-0.10.11/

Its filters are rather amazing in their ability to spot strings and other data.

There are also Windows versions of ethereal available for free download.

[Florian Heigl (new acc)]

for searching out a single string, I'd use dsniff, but for debugging the whole issue in context ethereal is definitely Your first choice.

grep' from dsniffs output to keep in compliance with any privacy rules/laws in place at Your site.

Consider a combination of the two and, well, good luck ;)


*both should be able to handle a tcpdump/pcap file as input.

[A. Daniel King_1]

Ethereal did the trick, with display filter:

data contains xyzzy

10 more points for the first person who can tell me how to do the same thing from the command line (i.e., identify an IP and the packet contents containing a given string).