Very Computer

Hi:

    I wonder if Linux has the tools similar to Solaris's "truss" (for
finding out what syscalls a process is making) and "snoop" (for
monitoring network traffic).

    I know "tcpdump", but tcpdump does not print out the packet in
string, making it hard to see what is int he packet. I am already
running version 3.4 of tcpdump, which I believe is the latest version.
Anyone modified tcpdump to do it?

drwang

Sent via Deja.com http://www.deja.com/
Before you buy.

"strace" is used to trace a program's system calls.  The trick
is to pick the right options so that you get the info you need
without having to sift through mountains of chaff.

Quote:>and "snoop" (for monitoring network traffic).

Under X11, I use ethereal.

--
Grant Edwards                   grante             Yow!  I am a jelly donut. I
                                  at               am a jelly donut.
                               visi.com            

Quote:>     I know "tcpdump", but tcpdump does not print out the packet in
> string, making it hard to see what is int he packet. I am already
> running version 3.4 of tcpdump, which I believe is the latest version.
> Anyone modified tcpdump to do it?

Ethereal is reasonably useful for looking inside packets

ajn

Quote:> Hi:

>     I wonder if Linux has the tools similar to Solaris's "truss" (for
> finding out what syscalls a process is making) and "snoop" (for
> monitoring network traffic).

>     I know "tcpdump", but tcpdump does not print out the packet in
> string, making it hard to see what is int he packet. I am already
> running version 3.4 of tcpdump, which I believe is the latest version.
> Anyone modified tcpdump to do it?

I looked into it once, but eventually decided it was going to be a lot
easier to run strings against the the log file that tcpdump generates.
Actually I created a modified version that treated an escape character as
ascii text, but that was a darn site easier the figureing out how tcpdump
works.

Oh yea, you have to use the -s option to tell tcpdump to log the complete
packet.  Otherwise it just logs the tcp headers.