1

On this link I found few informations about use of tcpdump.

But, can you give me more information about example showed on that page:

tcpdump -s 128 -vvv -T rtcp src orac and port 57393

11:58:52.027102 orac.erg.abdn.ac.uk.1053 > 224.2.156.220.57393: sr 489542890 @3238744444.18 2584794646 12583800p 2794620371b 489542890
1l 12646339s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19051, len 140)

11:58:55.772400 orac.erg.abdn.ac.uk.1053 > 224.2.156.220.57393: sr 489542890 @3238744447.93 2585131669 12583837p 2794653187b 489542890
1l 12646376s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19089, len 140)

11:59:00.478495 orac.erg.abdn.ac.uk.1053 > 224.2.156.220.57393: sr 489542890 @3238744452.64 2585555168 12583874p 2794686955b 489542890
1l 12646413s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19127, len 140)

11:59:07.916442 orac.erg.abdn.ac.uk.1053 > 224.2.156.220.57393: sr 489542890 @3238744460.07 2586224502 12583901p 2794700449b 489542890
1l 12646440s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19155, len 140)

11:59:13.840491 orac.erg.abdn.ac.uk.1053 > 224.2.156.220.57393: sr 489542890 @3238744466.00 2586757598 12583931p 2794716009b 489542890
1l 12646470s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19186, len 140)

I do not understand exactly what means sign > in this case.

Thank you in advance!

2 Answers 2

2

On the left side of that character you have source ip and port and on the right side destination ip and port. So it means that dumped packets were sent from orac.erg.abdn.ac.uk.1053 to 224.2.156.220.57393. The character itself has no special meaning.

0

danadam is exactly right as to the meaning of the > character. This is TCP flow which described in man tcpdump:

The general format of a tcp protocol line is:
              src > dst: flags data-seqno ack window urgent options 

Src and dst are the source and destination IP addresses and ports. Flags are some combination of S (SYN), F (FIN), P (PUSH), R (RST), W (ECN CWR) or E (ECN-Echo), or a single .' (no flags). Data-seqno describes the portion of sequence space covered by the data in this packet (see example below). Ack is sequence number of the next data expected the other direction on this connection. Window is the number of bytes of receive buffer space available the other direction on this connection. Urg indicates there isurgent' data in the packet. Options are tcp options enclosed in angle brackets (e.g., ).

So tcpdump has different output depending on the protocol / layer. Since you don't have the -n flag, the src and dst fields are the DNS reverse lookup of the IP and the port is the shorthand letter abbreviate for what the port is commonly used for.

I recommend using the -n flag as it gives more real time output.

5
  • what is the case if none of those two addresses are not address of server on which this command is executed?
    – user48058
    Jul 28, 2010 at 19:32
  • @user48058: If that is the case it means that the box is a router passing traffic, or the interface is in promiscuous mode picking up traffic that my not be destined for it (For this to really happen you would need to be on a non-switched network or the mirror port of a switched network). Jul 28, 2010 at 19:39
  • is that machine hacked?
    – user48058
    Jul 28, 2010 at 19:40
  • @user48058 Not always. Sometimes seeing traffic destined for another address is perfectly normal. If this is happening, you see it when the network card is set to promiscuous mode. Recent tcpdump versions set the NIC to promiscuous automatically.
    – sysadmin1138
    Jul 28, 2010 at 19:51
  • how can i check if network card is set to promiscuous mode?
    – user48058
    Jul 28, 2010 at 20:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .