WinDump.exe CDP packet Capture

-1

I'm trying to capture a CDP packet with WinDump.exe from WinPcap. The command i'm using is

WinDump.exe -i 1 -nn -v -s 0 -c 1 "(ether[12:2]==0x88cc or ether[20:2]==0x2000)"

It captures a CDP packet fine but it seems to be cutting off the data so. The packet ends right after VTP Management Domain. but using the same filter with WireShark or TShark shows the contents of the whole packet.

I'm not sure if it's a limitation of WinDump or if I'm missing a switch, I've tried messing with the snaplen finally setting it to 0 for unlimited makes no difference. I've tried -vv and -vvv no difference.

If I view the raw packet all data is there (in unreadable HEX), it's just doesn't seem to be getting parsed by WinDump. If I use -w and open the resulting file in WireShark all content is there and parsed properly.

here's an example of the packet data I am seeing.

10:05:34.277524 CDPv2, ttl: 180s, checksum: 692 (unverified), length 475
Device-ID (0x01), length: 37 bytes: 'Test_Lab.home.local'
Version String (0x05), length: 247 bytes: 
  Cisco IOS Software, 
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2015 by Cisco Systems, Inc.
  Compiled 
Platform (0x06), length: 22 bytes: ''
Address (0x02), length: 13 bytes: IPv4 (1) 192.168.0.15
Port-ID (0x03), length: 20 bytes: 'GigabitEthernet0/3'
Capability (0x04), length: 4 bytes: (0x00000028): L2 Switch, IGMP snooping
Protocol-Hello option (0x08), length: 32 bytes: 
VTP Management Domain (0x09), length: 0 byte: ''

Some data has been removed by me but that is the line the data stops. In HEX format the entier packet is captured.

tcpdump
cisco
packet-capture
asked on Stack Overflow Oct 10, 2018 by Travis Lange

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0