16

I'd like to know what are the contents of a packet one application "APM Planner" send to another "MAVProxy". I know they are communicating over UDP port 14550. I tried using tcpdump by running the following commands

tcpdump -u port 14550

and

tcpdump udp

and

netstat -uanpc | grep 14550

but none of them displayed me what these two applications are really exchange. I need something like cutecom for monitoring the UDP connection. Is there anything like this? When I run the command

netstat -lnpuc

, it shows the following among its output

udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 
  • Have you considered the GUI program called wireshark? It'll dissect the packets and show you the information being sent by each, and you can then use udp.port == 14550 or similar as the filtering command to only show that traffic. The problem is, you'll have to piece together what's going back and forth based on the contents of the packet. But it sounds like this is ultimately what you want to do yourself... (Just sniff the lo interface if you do this - that's the 'local' 127.*.*.* range and local IPv6 internally on your system) – Thomas Ward May 9 '17 at 11:57
  • Thanks for your comment. I installed Wireshark and typed udp.port == 14550 in Apply a display filter filed but nothing appeared. I also tried udp port 14550 in the Enter a capture filter field. Also when I run the command netstat -lnpuc, it shows the following among its output udp 5376 0 0.0.0.0:14550 0.0.0.0:* 23598/apmplanner2 – Salahuddin Ahmed May 9 '17 at 12:16
  • Sounds to me like it's not necessarily listening locally. have you tried tracing on other interfaces to see if it's communicating outbound? – Thomas Ward May 9 '17 at 12:41
  • 1
    Now it's working. I had to run wireshark with sudo. Many thanks – Salahuddin Ahmed May 9 '17 at 12:59
21

tcpdump supports UDP capturing. example usage:

tcpdump -n udp port 14550

Edit

Because your applications are communicating with lo interface you must specify interface like this:

tcpdump -i lo -n udp port 14550

this command print headers only. if you want to print data part of packet in hex and ASCII use this:

tcpdump -i lo -n udp port 14550 -X

or if you want to save packets to a file and see it's content in Wireshark use this:

tcpdump -i lo -n udp port 14550 -w packets.pcap
| improve this answer | |
  • I tried this command but it doesn't capture the packets. It outputs the following listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes and nothing else! – Salahuddin Ahmed May 9 '17 at 13:11
  • @SalahuddinAshraf I fixed it :) – Ghasem Pahlavan May 9 '17 at 13:30
  • thanks, it's working now. It displays source, destination and length of transferred data. Is it possible to make it display the transfered data itself? – Salahuddin Ahmed May 9 '17 at 14:05
  • @SalahuddinAshraf yes. you must append option -A to tcpdump to see data. also you can send packet to a file and see packets in Wireshark by -w packets.pcap – Ghasem Pahlavan May 9 '17 at 14:11
  • Pahlvan, Great. Now I can see the data. Is it possible to make the data displayed in hex? Many thanks – Salahuddin Ahmed May 9 '17 at 14:14
2

You can use ngrep. Example:

# Any UDP from any local interfaces to 91.22.38.4:12201
ngrep -W byline -d any udp and host 91.22.38.4 and dst port 12201
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.