page.title=Debugging with tcpdump and other tools pdk.version=1.0 doc.type=guide @jd:body <a name="toc"/> <div style="padding:10px"> <a href="#installing">Installing tcpdump</a><BR> <a href="#running">Running tcpdump</a><br/> <a href="#other">Other network debugging commands</a><br/> </div> <a name="installing"></a> <h3>Installing tcpdump</h3> <h4>Pushing the binary to an existing device</h4> <p>Download tcpdump from <a href="http://www.tcpdump.org/">http://www.tcpdump.org/</a>, then execute:</p> <pre> adb root adb remount adb push /wherever/you/put/tcpdump /system/xbin/tcpdump adb shell chmod 6755 /data/local/tmp/tcpdump </pre> <h4>Including tcpdump in the build image</h4> <p>If you are running your own build, execute:</p> <pre> mmm external/tcpdump # install the binary in out/.../system/xbin make snod # build a new system.img that includes it </pre> <p>Flash the device as usual, for example, <code>fastboot flashball</code>.</p> <p>If you want to build tcpdump by default, add <code>CUSTOM_TARGETS += tcpdump</code> to your <code>buildspec.mk</code>.</p> <h3><a name="running"></a>Running tcpdump</h3> <p>You need to have root access on your device. </p> <h4>Batch mode capture</h4> <p>The typical procedure is to capture packets to a file and then examine the file on the desktop, as illustrated below:</p> <pre> adb shell tcpdump -i any -p -s 0 -w /sdcard/capture.pcap # "-i any": listen on any network interface # "-p": disable promiscuous mode (doesn't work anyway) # "-s 0": capture the entire packet # "-w": write packets to a file (rather than printing to stdout) ... do whatever you want to capture, then ^C to stop it ... adb pull /sdcard/capture.pcap . sudo apt-get install wireshark # or ethereal, if you're still on dapper wireshark capture.pcap # or ethereal ... look at your packets and be wise ... </pre> <p>You can run <code>tcpdump</code> in the background from an interactive shell or from Terminal. By default, <code>tcpdump</code> captures all traffic without filtering. If you prefer, add an expression like port 80 to the <code>tcpdump</code> command line.</p> <h4>Real time packet monitoring</h4> <p>Execute the following if you would like to watch packets go by rather than capturing them to a file (<code>-n</code> skips DNS lookups. <code>-s 0</code> captures the entire packet rather than just the header):</p> <pre> adb shell tcpdump -n -s 0 </pre> <p>Typical <code>tcpdump</code> options apply. For example, if you want to see HTTP traffic:</p> <pre> adb shell tcpdump -X -n -s 0 port 80 </pre> <p>You can also monitor packets with <code>wireshark</code> or <code>ethereal</code>, as shown below:</p> <pre> # In one shell, start tcpdump. adb shell "tcpdump -n -s 0 -w - | nc -l -p 11233" # In a separate shell, forward data and run ethereal. adb forward tcp:11233 tcp:11233 && nc 127.0.0.1 11233 | ethereal -k -S -i - </pre> <p>Note that you can't restart capture via <code>ethereal</code>. If anything goes wrong, you will need to rerun both commands.</p> <p>For more immediate output, add <code>-l</code> to the <code>tcpdump</code> command line, but this can cause <code>adb</code> to choke (it helps to use a nonzero argument for <code>-s</code> to limit the amount of data captured per packet; <code>-s 100</code> is sufficient if you just want to see headers).</p> <h4>Disabling encryption</h4> <p>If your service runs over <code>https</code>, <code>tcpdump</code> is of limited use. In this case, you can rewrite some service URLs to use <code>http</code>, for example:</p> <pre> vendor/google/tools/override-gservices url:calendar_sync_https_proxy \ https://www.google.com/calendar rewrite http://android.clients.google.com/proxy/calendar </pre> <h3><a name="other"></a>Other network debugging commands</h3> <h4>On the device:</h4> <ul> <li><code>ifconfig interface</code>: note that unlike Linux, you need to give <code>ifconfig</code> an argument</li> <li><code>netcfg</code>: lists interfaces and IP addresses</li> <li><code>iftop</code>: like top for network</li> <li><code>route</code>: examine the routing table</li> <li><code>netstat</code>: see active network connections</li> <li><code>nc</code>: <code>netcat</code> connection utility</li> </ul> <h4>On the desktop:</h4> <ul> <li> <code>curl</code>: fetch URLs directly to emulate device requests</li> </ul>