tcpdump - just output the packet contents line by line

Some nice alternatives to the -A switch womble pointed out:

tcpflow will read a pcap file and split the TCP connections into separate files. Make sure you use a temp directory as it will split it into separate files for each connection.

tcpdump -s0 -w capfile
...
mkdir tmp && cd tmp
tcpflow -r ../capfile

You can also get something from tcpflow very similar to tcpdump -A, without splitting to different files:

tcpflow -C -r capfile

Personally, I find using wireshark and its Follow TCP stream option the easiest to read as it color-codes each side of the conversation. You can capture with wireshark directly or read captures made with tcpdump.


The dots are non-printable characters; anything outside of the range ASCII 32-126 (or thereabouts). You're getting the hexdump representation because you used the -X option; if you instead use the -A option, you'll get just the ASCII representation.