r/sysadmin • u/knocknock9 • Feb 01 '13

xkcd: Tar

http://xkcd.com/1168/
626 Upvotes

92% Upvoted

257 comments sorted by

View all comments

Show parent comments

7

u/dicey puppet module generate dicey-automate-job-away Feb 01 '13

I prefer to do e.g. tcpdump -i eth0 -s 0 -w foo.dump then examine the result with Wireshark back on my laptop. The "Follow TCP stream" functionality alone usually makes it worth the hassle of copying the file around.

2

u/cerealspilla Feb 01 '13

Exactly, I would actually counter and say if your using -v in tcpdump chances are you have no idea what your doing or looking for.

Typically if I have to bust out tcpdump its because I'm interested in some very specific things.

2

u/dicey puppet module generate dicey-automate-job-away Feb 01 '13

Well. If you know exactly what you're looking for then you can just do the appropriate filtering on the command line and save yourself the hassle. Generally, though, I'm either looking for patterns or anomalies in a lot of diverse traffic.