TCPDUMP question

Is there any advantage in displaying hex output? ( -x switch)?
Currently I use tcpdump with the -n -e -s 1514 switches.  Does viewing hex have any advantages? Are you viewing the actual encapsulated data when you do this?
Thanks
dissolvedAsked:
Who is Participating?
 
net_sec_guruCommented:
tcpdump –x looks at packages in hex format

tcpdump –X looks at packages in hex and Ascii format

I use the -X option myself... so yes, there is an advantage to using at as I get to see hex & ascii characters...
0
 
ahoffmannCommented:
-x will show you non-printables too

> Are you viewing the actual encapsulated data when you do this?
if you mean encapsulated in IP or TCP or UDP or ARP, yes
0
 
dissolvedAuthor Commented:
Thank you. What is the point of viewing the hex and ascii?  Does it give any pertinent information?  
0
 
ahoffmannCommented:
> Does it give any pertinent information?
depends on your definition of that ;-)
simply testit it out
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.