How to capture only TCP & IP headers wit - TechRepublic
General discussion
March 19, 2002 at 03:20 AM
shanghai sam

How to capture only TCP & IP headers wit

by shanghai sam . Updated 23 years, 11 months ago

I need to provide someone with TCP and IP header data from production network traffic. I’m having trouble coming up with the number of bytes to capture in order to prevent info leakage of usernames/passwords. What is the magic number of bytes?

A TCP header is 20 bytes. An IP header is 20 bytes. Ethernet tacks on 14 bytes so 20 + 20 + 14 = 54. However if I grab 54 bytes it looks like I end up giving away 1 to 3 bytes of data.

I’m capturing using tcpdump like so:
tcpdump -w 51ByteCapture -n -s 51 -c 25

This seems to work however occasionally I get one of the headers truncated.

Can someone explain why at 54 bytes I sometimes see data instead of just header info?

This discussion is locked

All Comments