Knowledgeable Linux person please assist

John_Gray

On a server, I am booting a Live CD, which has a variant of Linux on it (Fedora 13, but it shouldn't matter), with the intention of not ever, ever, writing anything to the server's hard disk. I need to run diagnostics in a non-Windows operating system.

I wish to write debugging information to a file and the command I have been given to capture packets, run in a Terminal window, is (in part) tcpdump -w test.pcap

In a second Terminal window I will run various commands, whose resulting TCP packets are captured by TCPDUMP in the first Terminal window.

When I terminate this packet capture (with Ctrl+C) in the first Terminal window I presume the file is closed off - but I have no idea where it is located (bearing in mind that I have booted from a Live CD), apart from 'somewhere in memory'.

I need to copy this file for later examination onto a USB Flash drive (which after insertion pops up on the Linux desktop as "1.0 GB File System").

Please could someone provide the exact sequence of commands to enable me to do this? Please assume (my) almost total ignorance of Linux, but contaminated by Windows knowledge...

(If you can tell me what to do to have the packets written directly to a file on the USB Flash drive that would be even better!)

Thanks!

Ximian

You should be able to write the capture file directly to the mounted USB flash drive by specifying the path when you type the tcpdump -w command. For example: tcpdump -w /tmp/test.pcap (which will write the capture file to the /tmp directory)

To write directly to the mounted USB flash drive you will need to know the path/name of the mounted device. If you type "mount" in a terminal you should see all the mounted devices and filesystems, for example:

mount
/dev/sdc1 on /media/Seagate type fuseblk (rw, nosuid, nodev etc...)

This means that I have device that is mounted on /media with the name Seagate.
So if I were to create a tcpdump capture, I would type:
tcpdump -w /media/Seagate/test.pcap
It all depends where the Live CD is mounting the USB flash drive.

HTH

gaming_guy

....................

John_Gray

Thanks, folks - I'll try all this on Monday.

John_Gray

Somewhat delayed, I tried the above suggestions.

The Terminal window prefix comes out as
[liveuser@localhost ~]$

Both cd Desktop and cd desktop gave an error.

Mount -? gave (in part)
/dev/sdl1 on /media/2DF3-1AFC
and so
cd /media/2DF3-1AFC
worked.

So having done su - I was able to capture the TCPDUMP data on the USB Flash drive!

Thanks again to you both...