tcpick(1)

NAME
tcpick - tcp stream sniffer

SYNOPSIS
tcpick [ -d ] [ -a ]
[{ -i | --interface } interface ]
[ "filter" ]
[ -v [ verbosity ] ]
[{ -s | --silent }] ]
[{ -h | --show-header }]
[{ -C [{ 1 | 2 }] | --colors }]
[{ -P | --show-printable }]
[{ -R | --show-raw ]
[{ -H | --show-hex }]
[{ -U | --show-hexnonprint }]
[{ -x | }]
[{ -X | --show-hexasciidump }]
[ -w[h][PRUxX] ]
[{ -r | --readfile } file ]
[ --help ] [ --version ]

DESCRIPTION
tcpick - tcpick is a textmode sniffer libpcap-based that can track tcp streams and saves the data captured in files or displays them in the terminal. Useful for picking files in a passive way. It can store all connections in different files, or it can display all the stream on the terminal, when the connection is closed. It is useful to keep track of what users of a network are doing, and is usable with textmode tools like grep, sed, awk. Happy data hunting :)

OPTIONS

-i --interface interface
    listen on selected interface, (i.e. ppp0 or eth0). If option -i is omitted, tcpick is able to select the first open interface (usually a ethernet card).

"filter"
    This is the filter for the capturer engine. You can set it in the same way of setting the tcpdump(1) filter. Read tcpdump(1) manpage for other explanations.

-v verbosity
    Print more information; if verbosity is omitted or has 1 value, it will show packet headers. If verbosity is 2 tcpick will display the data contained in the packets too (like --show-printable). If verbosity is 0, all standard output, all kinds of messages will be suppressed (like --silent option).

-a  Displays host names instead of ip addresses. Warning: for every new ip grabbed a dns query will be generated!

-d  debug mode: print on the screen a lot of unuseful stuff. I think you really don't need this.

-C -C1 --colors
    Uses terminal colors: very nice! It should help you to read the output of tcpick

-C2 Terminal colors are used to display statuses banner with different colors depending on wich connection they belongs. Obviously, the terminal allows only 8 colors, so it is really useful only with few connection tracked.

-s --silent
    Like -v0: suppresses any kind of messages; displays nothing.

-h --show-header
    Shows source and destination ip and port; shows tcp flags as letters.

-P --show-printable
    Shows data contained in the tcp packets. Non-printable charachters are transformed in dots: ".". Newline character is preserved. This is the best way, in my opinion to show data like HTTP requests, IRC communication, SMTP stuff and so on.

-R --show-raw
    Displays all kind of charachters, printable and non printable. If something binary is transmitted, the effect will probably be like watching with "cat" at a gzipped file.

-H --show-hex
    Shows all data after the header in hexadecimal-spaced notation.

-x --show-hexdump
    Shows all data after the header in hexadecimal dump.

-X --show-hexasciidump
    Shows all data after the header in hexadecimal and ascii dump.

-U --show-hexnonprint
    Shows all data after the header, but Unprintable charachters are displayed as hexadecimal values between a "<" and a ">" symbol.

-w -wR
    Write data to file
    server_<ip_client>:<port_client>_<ip_server>:<port_server>
    and client_<ip_client>:<port_client>_<ip_server>:<port_server> in "raw" mode (original connection data *should*) be preserved.

-wh with this options packet headers are written into the connection files.

-wS with this options the connection status is written into the connection files.

-wP is like -w and the non-printable charachters are turned into dots (.)

-wU this is like -w but Unprintable charachters are displayed as hexadecimal values between a "<" and a ">" symbol.

-wx this is like -w but data are stored in hexadecimal dump forma

-wX this is like -w but data are stored in hexadecimal+ascii dump format

-r --readfile
    reads raw packets from a file written with tcpdump -w instead of using a network device.

EXAMPLES
A nice example is:
% tcpick -i ppp0 -whX -hP "port 80"
This means that tcpick is listening on the ppp0 interface, and writes all data of the connections that are sniffed in a hexadecimal+ascii dump ( -wX ) with headers (-wh). In the meanwhile you can see all printable ( -P ) data on the terminal and headers (-h) are displayed too. Now some output files should be written, when you do something with your browser, for example (I tried it on my machine, to be sure it works :)
root@askesio ~ # ls server_* client_*
client_62.98.55.250:32906_216.239.59.99:80 server_62.98.55.250:32906_216.239.59.99:80
client_62.98.55.250:32907_216.239.59.99:80 server_62.98.55.250:32907_216.239.59.99:80
Now you can see and enjoy the output file, that should be something like this:
root@askesio ~ # head server_62.98.55.250:32906_216.239.59.99:80
216.239.59.99:80 AS > 62.98.55.250:32906
62.98.55.250:32906 A > 216.239.59.99:80
62.98.55.250:32906 AP > 216.239.59.99:80
216.239.59.99:80 A > 62.98.55.250:32906
216.239.59.99:80 AP > 62.98.55.250:32906
0x0000 4854 5450 2f31 2e31 2032 3030 204f 4b0d HTTP/1.1.200.OK.
0x0010 0a43 6163 6865 2d63 6f6e 7472 6f6c 3a20 .Cache-control:.
0x0020 7072 6976 6174 650d 0a43 6f6e 7465 6e74 private..Content
0x0030 2d54 7970 653a 2074 6578 742f 6874 6d6c -Type:.text/html
0x0040 0d0a 5365 7276 6572 3a20 4757 532f 322e ..Server:.GWS/2.

AUTHOR
Francesco Stablum "DuskDruid"
email: <duskdruid @ inventati org>
homepage: http://www.linux.it/~stablum/

SEE ALSO
Other nice packet/data sniffers:
tcpdump, ngrep, tcptrack, ettercap, ethereal, snort

BUGS
tcpick is still quite buggy: there may be some segmentation failures. If you find them with gdb, please write me and send the backtrace too. I would be very happy if you can find the reason for some strange behaviours happenings. See KNOWN-BUGS for some details.

LICENSE
Copyright (C) 2003 Francesco Stablum (DuskDruid) <duskdruid @ inventati org>

This program is free software ; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at you option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY ; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.