pdk/docs/guide/tcpdump.jd

page.title=Debugging with tcpdump and other tools
pdk.version=1.0
@jd:body


<a name="toc"/>
<div style="padding:10px">
  <a href="#installing">Installing tcpdump</a><BR>
  <a href="#running">Running tcpdump</a><br/>
  <a href="#other">Other network debugging commands</a><br/>
</div>

<a name="installing"></a>
<h3>Installing tcpdump</h3>
<h4>Pushing the binary to an existing device</h4>
<p>Download tcpdump from <a href="http://www.tcpdump.org/">http://www.tcpdump.org/</a>, then execute:</p>
<pre>
adb root
adb remount
adb push /wherever/you/put/tcpdump /system/xbin/tcpdump
adb shell chmod 6755 /data/local/tmp/tcpdump
</pre>
<h4>Including tcpdump in the build image</h4>
<p>If you are running your own build, execute:</p>
<pre>
mmm external/tcpdump  # install the binary in out/.../system/xbin
make snod             # build a new system.img that includes it
</pre>
<p>Flash the device as usual, for example, <code>fastboot flashball</code>.</p>
<p>If you want to build tcpdump by default, add <code>CUSTOM_TARGETS += tcpdump</code> to your <code>buildspec.mk</code>.</p>
<h3><a name="running"></a>Running tcpdump</h3>
<p>You need to have root access on your device. </p>
<h4>Batch mode capture</h4>
<p>The typical procedure is to capture packets to a file and then examine the file on the desktop, as illustrated below:</p>
<pre>
adb shell tcpdump -i any -p -s 0 -w /sdcard/capture.pcap
# "-i any": listen on any network interface
# "-p": disable promiscuous mode (doesn't work anyway)
# "-s 0": capture the entire packet
# "-w": write packets to a file (rather than printing to stdout)

   ... do whatever you want to capture, then ^C to stop it ...

adb pull /sdcard/capture.pcap .
sudo apt-get install wireshark  # or ethereal, if you're still on dapper
wireshark capture.pcap          # or ethereal

   ... look at your packets and be wise ...
</pre>
<p>You can run <code>tcpdump</code> in the background from an interactive shell or from Terminal. By default, <code>tcpdump</code> captures all traffic without filtering. If you prefer, add an expression like port 80 to the <code>tcpdump</code> command line.</p>
<h4>Real time packet monitoring</h4>
<p>Execute the following if you would like to watch packets go by rather than capturing them to a file (<code>-n</code> skips DNS lookups. <code>-s 0</code> captures the entire packet rather than just the header):</p>
<pre>
adb shell tcpdump -n -s 0
</pre>
<p>Typical <code>tcpdump</code> options apply. For example, if you want to see HTTP traffic:</p>
<pre>
adb shell tcpdump -X -n -s 0 port 80
</pre>
<p>You can also monitor packets with <code>wireshark</code> or <code>ethereal</code>, as shown below:</p>
<pre>
# In one shell, start tcpdump.
adb shell "tcpdump -n -s 0 -w - | nc -l -p 11233"

# In a separate shell, forward data and run ethereal.
adb forward tcp:11233 tcp:11233 && nc 127.0.0.1 11233 | ethereal -k -S -i -
</pre>
<p>Note that you can't restart capture via <code>ethereal</code>. If anything goes wrong, you will need to rerun both commands.</p>
<p>For more immediate output, add <code>-l</code> to the <code>tcpdump</code> command line, but this can cause <code>adb</code> to choke (it helps to use a nonzero argument for <code>-s</code> to limit the amount of data captured per packet; <code>-s 100</code> is sufficient if you just want to see headers).</p>
<h4>Disabling encryption</h4>
<p>If your service runs over <code>https</code>, <code>tcpdump</code> is of limited use. In this case, you can rewrite some service URLs to use <code>http</code>, for example:</p>
<pre>
vendor/google/tools/override-gservices url:calendar_sync_https_proxy \
  https://www.google.com/calendar rewrite http://android.clients.google.com/proxy/calendar
</pre>
<h3><a name="other"></a>Other network debugging commands</h3>
<h4>On the device:</h4>
<ul>
  <li><code>ifconfig interface</code>: note that unlike Linux, you need to give <code>ifconfig</code> an argument</li>
  <li><code>netcfg</code>: lists interfaces and IP addresses</li>
  <li><code>iftop</code>: like top for network</li>
  <li><code>route</code>: examine the routing table</li>
  <li><code>netstat</code>: see active network connections</li>
  <li><code>nc</code>: <code>netcat</code> connection utility</li>
</ul>
<h4>On the desktop:</h4>
<ul>
  <li> <code>curl</code>: fetch URLs directly to emulate device requests</li>
</ul>