24

I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands

tcpdump -u port 14550

and

tcpdump udp

and

netstat -uanpc | grep 14550

but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this? When I run the command

netstat -lnpuc

, it shows the following among its output

udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 
4
  • Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system)
    – Thomas Ward
    May 9, 2017 at 11:57
  • Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 May 9, 2017 at 12:16
  • Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound?
    – Thomas Ward
    May 9, 2017 at 12:41
  • 1
    Now it's working. I had to run wireshark with sudo. Many thanks May 9, 2017 at 12:59

2 Answers 2

29

tcpdump supports UDP capturing. example usage:

tcpdump -n udp port 14550

Edit

Because your applications are communicating with lo interface you must specify interface like this:

tcpdump -i lo -n udp port 14550

this command print headers only. if you want to print data part of packet in hex and ASCII use this:

tcpdump -i lo -n udp port 14550 -X

or if you want to save packets to a file and see it's content in Wireshark use this:

tcpdump -i lo -n udp port 14550 -w packets.pcap
8
  • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else! May 9, 2017 at 13:11
  • @SalahuddinAshraf I fixed it :) May 9, 2017 at 13:30
  • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself? May 9, 2017 at 14:05
  • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap May 9, 2017 at 14:11
  • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks May 9, 2017 at 14:14
4

You can use ngrep. Example:

# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .