[ckohler]

Is there a software package or tool I can use in OSX that lets me watch and keeps a log of my network traffic?

By network traffic, I mean I'd like to be able to see what outside computers I'm talking to (by their IP or hostname) and see which computers are trying to talk to me.

[Art Vandelay]

tcpdump (run in the Terminal) will show you everything.

[ckohler]

That works but I'm on a cable modem so the log is filled with all this garbage coming from other people. "ARP" requests or something. Is there a way to filter that so I only see the important stuff?

[coolmacdude]

Originally posted by ckohler:
That works but I'm on a cable modem so the log is filled with all this garbage coming from other people. "ARP" requests or something. Is there a way to filter that so I only see the important stuff?

pipe to grep -v arp

Ex: sudo tcpdump -i en0 | grep -v arp

[ckohler]

Wonderful, thanks! One more question. What if I want to exclude additional lines? What is the correct grep syntax? For example, I tried:

sudo tcpdump -i en0 | grep -v arp exampledomain.com

...to also exclude listings from "exampledomain.com" but the above syntax just errors out.

[Art Vandelay]

Have you looked at the man page for it? It might give you some pointers for the correct syntax for filtering.

[Moonray]

Originally posted by ckohler:
Wonderful, thanks! One more question. What if I want to exclude additional lines? What is the correct grep syntax? For example, I tried:

sudo tcpdump -i en0 | grep -v arp exampledomain.com

...to also exclude listings from "exampledomain.com" but the above syntax just errors out.

sudo tcpdump -i en0 | grep -v arp | grep -v exampledomain.com

If your grep pattern contains characters that the shell would interpret as "wildcards" (+?[]{}), surround it by 'quotes'. If you want wildcards you need to use regular expressions (for beginners: use . instead of ?, use .* instead of *, use \. if you mean a real .).

You also can make a shell script out of such a line if you want to invoke it frequently and save some typing.

-

[Freeflyer]

How would this work for an airport connected machine. I see en0 as the ethernet port, but not sure which one is the airport.

How would I find this out (yes, I know, I need to brush up my unix knowledge ;-) )

Thanks,

J.

[Art Vandelay]

The AirPort card is usually en1. You can verify this using the Network Utility in the Utilities folder.

If you're on an AirPort network, you won't see much external network traffic since AirPort creates its own network, unless you are in bridged mode.

[Scarpa]

You may want to look into installing Ethereal, which is available via fink. It is a very nice network analyzer that is free software. It requires X11 to run btw.