tcpick(8)

📦
version 0.2.1 · 2 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 tcpick 💖 — the manual, but make it make sense

okay bestie, listen. this is the manual page for tcpick, straight out of the System Manager's Manual, section 8. yes, that section 8, the sysadmin one. we're doing this together and we're gonna have fun, i promise. 🫶

✨ NAME ✨

tcpick — tcp stream sniffer and connection tracker

like, it sniffs tcp streams. and it tracks connections. that's the whole vibe. 👑

🌸 SYNOPSIS 🌸

tcpick [ -a ] [ -n ] [ -C ]
       [ -e count ]
       [ -i interface | -r  file ]
       [ -X timeout ]
       [ -D  ] [ -F1 | -F2 ]
       [ -yH | -yP | -yR | -yU | -yx | -yX ]
       [ -bH | -bP | -bR | -bU | -bx | -bX ]
       [ -wH[ub] | -wP[ub] | -wR[ub] | -wU[ub] ]
       [ -v  [ verbosity ]] [ -S ] [ -h ]
       [ --separator ]
       [ -T | -Tf  [ number ]]
       [ -E | -Ef  [ number ]]
       [ -Pc  |  -Ps ]
       [  "filter" ]
       [ --help ] [ --version ]

🦋 DESCRIPTION 🦋

so. tcpick is a textmode sniffer built on libpcap. it tracks tcp streams, and it can save whatever data it catches into different files — one file for every single connection, no cap — or it can just show you that data right there in your terminal in a bunch of different formats (hexdump, printable characters, raw… you get the range 💅).

it's genuinely so useful for picking files in a passive way. like, it is useful for keeping track of what the users of a network are doing, and it plays so nicely with textmode tools like grep, sed, awk. it's giving pipeline main character energy fr fr.

Happy data hunting :-) 🎀

👑 BASE OPTIONS 👑

  • -i, --interface _interface_ — listen on the interface you picked, i.e. ppp0 or eth0. and here's the thing: if you just… don't pass -i at all, tcpick is smart enough to select the first open interface all by itself (usually a ethernet card). iconique behavior honestly.
  • -r, --readfile — reads raw packets from a file instead of using a network device. specifically, a file that was written with tcpdump -w. yes bestie, you can replay the past. 🕰️
  • "filter" — this is the filter for the capturer engine. you set it up the exact same way you'd set the filter for tcpdump(1). go read the tcpdump(1) manpage for the other explanations, it's all there. 🔍
  • -a — Displays host names instead of ip addresses. > Warning: for every new ip grabbed a dns query will be generated! Use it carefully on high-traffic network devices! 🚨 so like, on a busy network this is a lot of dns queries. be mindful, bestie.
  • -C, --colors — Uses terminal colors: very nice! 🌈 It should help you to read the output of tcpick. (they're right, it does.)
  • -D _number_, --dirs _number_ — Create directories to store sniffed sessions. When a directory contains _number_ sessions, a new one will be created. 📁
  • -e _count_ — Exits when _count_ packets have been sniffed. bye when the count hits. 👋
  • -E _number_ — Exit when _number_ sniffed connections are detected as "CLOSED".
  • -Ef _number_ — Exit when the first _number_ connections are detected as "CLOSED".
  • -F1 -F2, --filenaming 1|2 — Choose the filenaming system. two options, pick your fighter:
    • -F1 : tcpick_clientip_serverip.side.dat (side means clnt, serv or both)
    • -F2 : tcpick_connectionnumber_clientip_serverip.side.dat
  • -h — Shows source and destination ip and port; shows tcp flags as letters. 🔤
  • --help — Displays a short help summary.
  • -p — Don't put the network interface in promiscuous mode. > Note that the interface might be in promiscuous mode for some other reason. so like, don't assume it's not. it might be. 👀
  • -S — Suppresses the "status of the connection" banner. silence is golden. 🤫
  • --separator — Add a separator for the payloads displayed. cute little divider, but for packets.
  • -t — Adds timestamp in hour:minutes:seconds:microseconds format. ⏰
  • -td — Like -t with date timestamp in day-month-year format. 📅
  • -T _number_ — Track _number_ connections. It could be very useful on a high-traffic network device. If _number_ is not specified, it will be set to 1.
  • -Tf _number_ — Track only the first _number_ connections; the following will be discarded. If _number_ is not specified, it will be set to 1.
  • -v _verbosity_ — Quite useless, yet. Set verbosity level. Actually there are not really many extra messages to display, this means it is enabled by default (-v1). Set verbosity level to 0 to suppress extra messages (-v0) except error messages. Set verbosity level to 5 to display debug messages (-v5). There are not other verbosity levels. so like, 0, default, or 5. that's the whole menu. 🍓
  • -X _timeout_ — Connections are considered EXPIRED when there is no traffic for at least _timeout_ seconds. Default is 600.
  • --version — Displays the tcpick version.

🔥 DISPLAY THE DATA IN THE TCP PACKETS 🔥

okay so these options all start with -y, and they're here to show you the content of the sniffed packet (the data, which we call the payload) in various ways, once it arrives at the listening interface. 💫

and here's the important part: the way these work, the tcp duplicates will not be discarded and the packets will not be reordered — everything gets displayed "as is". if what you actually want is a fully acknowledged stream, go look at the -w and -b set of options instead. iykyk. 💅

  • -yH — View data in hexadecimal-spaced mode (for the hexdump see -yx and -yX options.
  • -yP — Shows data contained in the tcp packets. Non-printable characters are transformed in dots: ".". Newline character is preserved. This is the best way, in my opinion, to show data like HTTP requests, IRC communication, SMTP stuff and so on. 💖
  • -yR — Displays all kind of characters, printable and non printable. > If something binary is transmitted, the effect will probably be like watching with "cat" at a gzipped file. 💀 yeah. exactly that energy. you've been warned.
  • -yx — Shows all data after the header in hexadecimal dump of 16 bytes per line.
  • -yX — Shows all data after the header in hexadecimal and ascii dump with 16 bytes per line.
  • -yU — Shows all data after the header, but Unprintable characters are displayed as hexadecimal values between a "<" and a ">" symbol.

🧚 REBUILD AND WRITE THE TCP STREAM TO FILE 🧚

the prefix for these options is -w. the TCP stream that has been sniffed with these options will be written to file named:

client_<ip_client>_<ip_server>_<port_server>.tcpick
server_<ip_client>_<ip_server>_<port_server>.tcpick

With the u flag of the -w option (i.e. -wRu) both client and server data will be written to a unique file named in that way:

<ip_client>_<ip_server>_<port_server>.tcpick

If you use the additional flag b of the -w option (i.e. -wPub), in the file will be written this banner:

[client|server] offset before:offset after (length of rebuilded segment)

to distinguish between client and server data. 🏷️

The flow is rebuilded, reordered and the duplicates are dropped. and the way that this slays is: it is possible to sniff entire files transmitted via ftp without data corruption (you can see this with md5sum). 🤯

If no argument is given to -w the data will be written like -wR. You can decide to write only client or server data by setting the flag C (output only client data) and S (output only server data) to the -w set.

  • -wR — This is the preferred option: data will be written without any changes. Useful for sniffing binary or compressed files. (-wRC only the client, -wRS only the server)
  • -wP — Unprintable characters are written like dots. (-wPC only the client, -wPS only the server)
  • -wU — Unprintable characters are displayed as hexadecimal values between a "<" and a ">" symbol. (-wPC only the client, -wPS only the server)
  • -wH — The flow is written in hexadecimal-spaced mode. (-wHC only the client, -wHS only the server)

🌈 DISPLAY THE REBUILDED TCP STREAM 🌈

the prefix for these options is -b. this set of options is very useful if you want to redirect the sniffed flow to anoter program with a pipe, and there should be no data corruption. 🫧

of course the most useful one is -bR to show the data as they are (raw). and a very useful feature is the flag C (output only client data) and S (output only server data). I.e.: -bRC will display only the data from the client in raw mode; in that way you can put them in a file with a pipe redirection. 🎀

The sub-options are quite the same of the -y set, so you have:

  • -bH — hex-spaced (-bHC only the client, -bHS only the server)
  • -bP — unprintable displayed as dots (-bPC only the client, -bPS only the server)
  • -bR — raw mode (-bRC only the client, -bRS only the server)
  • -bU — unprintable as <hex>. (-bUC only the client, -bUS only the server)
  • -bx — hexdump (-bxC only the client, -bxS only the server)
  • -bU — hexdump + ascii (-bXC only the client, -bXS only the server)
  • -PC, --pipe client — This is an alias for -bRC -S -v0 -Tf1 -Ef1. With this option you are able to track only the first connection (-T1) matched by tcpick and data are displayed as raw. Only data from the client are put on stdout. All messages and banners are suppressed, except error messages (-S -v0), so this option is particularly useful to download an entire fully rebuilded and acknowledged connection. 🫶
  • -PS, --pipe server — This is an alias for -bRS -S -v0 -Tf1 -Ef1.

💅 EXAMPLES 💅

how to display the connection status:

# tcpick -i eth0 -C

display the payload and packet headers:

# tcpick -i eth0 -C -yP -h -a

display client data only of the first smtp connection:

# tcpick -i eth0 -C -bCU -T1 "port 25"

download a file passively:

# tcpick -i eth0 -wR "port ftp-data"

log http data in unique files (client and server mixed together):

# tcpick -i eth0 "port 80" -wRub

redirect the first connection to a software:

# tcpick -i eth0 --pipe client "port 80" | gzip >
       http_response.gz
# tcpick -i eth0 --pipe server "port 25" | nc foobar.net 25

💜 MAILING-LIST 💜

If you have new ideas, patches, feature requests or simply need help, don't wait! I will be grateful if you send a message to the mailing list (even if you want to say what you liked most on tcpick). 🥹

⭐ TCPICK WEBSITE ⭐

The tcpick website is at http://tcpick.sf.net.

You can find the project page here: http://sourceforge.net/projects/tcpick kindly hosted by the sourceforge team. 🌐

🎀 AUTHORS 🎀

Please check AUTHORS file.

🙈 BUGS 🙈

Tcpick is an experimental software, and maybe some bugs are described in the KNOWN-BUGS file.

On some versions of MacOSX Segmentation Fault happens and connections aren't tracked properly.

If you find any other bug, please write to the tcpick mailing list. 🐛

🔍 SEE ALSO 🔍

Other nice packet/data sniffers:

tcpdump, ngrep, tcptrack, ettercap, ethereal, snort

📜 LICENSE 📜

okay bestie this is the part where the lawyers get their moment and honestly? it's kind of iconic. ✨

This program is free software — you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. slay, freedom fr fr 🕊️

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. yeah so — no promises, no cap. 😭 See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., and the address is:

Free Software Foundation, Inc.
59 Temple Place - Suite 330
Boston, MA  02111, USA.
💖 tl;dr — it's GPL v2-or-later, it comes with absolutely zero warranty, and if you somehow don't have a copy of the license lying around you can just write to the FSF at that address above. that's it. that's the whole vibe.

and that's a wrap on the whole page, bestie!! 🎀 you made it all the way to the end, which is honestly main character energy 👑 this whole thing was the tcpick(8) manual page, and that last little line down at the bottom — the one with the page name, the source and version info, and the date? yeah, that's just the footer doing its quiet little cameo. not me getting emotional over a manpage footer 🙈🦋

go forth and sniff some streams responsibly, fr fr 💅💜

📦 where this page comes from