Tom Judge wrote this message on Wed, Jun 11, 2008 at 15:01 -0500: > Bill Moran wrote: > >In response to R J <[EMAIL PROTECTED]>: > > > >>I am trying to use tcpdump (or snort, but they are both behaving the same > >>in this case) to capture all the lines or contents of an msn > >>chat session, the actual conversation. I am getting partial output; i.e, > >>I'll only get half of a sentence, and I don't see the rest of the lines. > >>And ofcourse, alot of it seems to be hex or obfuscated html? > >> > >>What switches do I need to capture the entire lines of text? > > > >Don't know about snort, but with tcpdump use -s0 > > > This is a good start however you are not guaranteed to see the whole > chat message in a single TCP packet. If you are looking for something > more advanced you will have to write a program around pcap/bpf or > similar to read the TCP stream.
such as tcpflow which read tcpdump streams and outputs each TCP byte stream... -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not." _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"