tcpdump - just output the packet contents line by line
Some nice alternatives to the -A
switch womble pointed out:
tcpflow
will read a pcap file and split the TCP connections into separate files. Make sure you use a temp directory as it will split it into separate files for each connection.
tcpdump -s0 -w capfile
...
mkdir tmp && cd tmp
tcpflow -r ../capfile
You can also get something from tcpflow very similar to tcpdump -A
, without splitting to different files:
tcpflow -C -r capfile
Personally, I find using wireshark
and its Follow TCP stream option the easiest to read as it color-codes each side of the conversation. You can capture with wireshark directly or read captures made with tcpdump.
The dots are non-printable characters; anything outside of the range ASCII 32-126 (or thereabouts). You're getting the hexdump representation because you used the -X
option; if you instead use the -A
option, you'll get just the ASCII representation.