I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos. Does anyone know what the analog would be? I've tried the following, but none seem to work as I expect:697  sudo /usr/sbin/tcpdump -w test.pcap -i eth01010  sudo /usr/sbin/tcpdump port 801012  sudo /usr/sbin/tcpdump port 80 -i eth01015  sudo /usr/sbin/tcpdump -A port 80 -i eth01017  sudo /usr/sbin/tcpdump -w ~/capture.pcap port 80 -i eth0I can see the header data in wireshark, but I can't seem to see the actual packet data.
iptrace for linux: how can I trace full packet contents?
networking;ip;tcpdump
The saved portion of each captured packet is defined by the snaplen option. In some distributions, the default snaplen is set to around 68 bytes. The packets are then truncated to 68 bytes, hiding some of the payload. You can save the complete packets by setting the snaplen to 0 (i.e. maximum) as follows: tcpdump -s0 -w test.pcap -i eth0