tcpick is a textmode sniffer libpcap-based that can track, reassemble and reorder tcp streams. tcpick is able to save the captured flows in different files or displays them in the terminal, and so it is useful to sniff files that are transmitted via ftp or http. It can display all the stream on the terminal, when the connection is closed in different display modes like hexdump, hexdump + ascii, only printable charachters, raw mode and so on.

Info: http://tcpick.sourceforge.net/

—-

== Brief Tutorial ==

Example:

{{{

tcpick -i eth0 -yP -C -h “not port 22″

}}}

How to display the connection status:

{{{

tcpick -i eth0 -C

}}}

Display the payload and packet headers:

{{{

tcpick -i eth0 -C -yP -h -a

}}}

Display client data only of the first smtp connection:

{{{

tcpick -i eth0 -C -bCU -T1 “port 25″

}}}

Download a file passively:

{{{

tcpick -i eth0 -wR “port ftp-data”

}}}

Log http data in unique files (client and server mixed together):

{{{

tcpick -i eth0 “port 80″ -wRub

}}}

Redirect the first connection to a software:

{{{

tcpick -i eth0 –pipe client “port 80″ | gzip > http_response.gz

tcpick -i eth0 –pipe server “port 25″ | nc foobar.net 25

}}}

http://sourceforge.net/project/showfiles.php?group_id=64424&package_id=61824

Run it on your local machine, and play with it via your browser

All the lessons are there, and most of them have a solutions in the help.

thanks