Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On this link I found few informations about use of tcpdump.

But, can you give me more information about example showed on that page:

tcpdump -s 128 -vvv -T rtcp src orac and port 57393

11:58:52.027102 > sr 489542890 @3238744444.18 2584794646 12583800p 2794620371b 489542890
1l 12646339s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19051, len 140)

11:58:55.772400 > sr 489542890 @3238744447.93 2585131669 12583837p 2794653187b 489542890
1l 12646376s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19089, len 140)

11:59:00.478495 > sr 489542890 @3238744452.64 2585555168 12583874p 2794686955b 489542890
1l 12646413s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19127, len 140)

11:59:07.916442 > sr 489542890 @3238744460.07 2586224502 12583901p 2794700449b 489542890
1l 12646440s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19155, len 140)

11:59:13.840491 > sr 489542890 @3238744466.00 2586757598 12583931p 2794716009b 489542890
1l 12646470s 0j @0.00+0.00 sdes 60 489542890 (ttl 127, id 19186, len 140)

I do not understand exactly what means sign > in this case.

Thank you in advance!

share|improve this question

On the left side of that character you have source ip and port and on the right side destination ip and port. So it means that dumped packets were sent from to The character itself has no special meaning.

share|improve this answer

danadam is exactly right as to the meaning of the > character. This is TCP flow which described in man tcpdump:

The general format of a tcp protocol line is:
              src > dst: flags data-seqno ack window urgent options 

Src and dst are the source and destination IP addresses and ports. Flags are some combination of S (SYN), F (FIN), P (PUSH), R (RST), W (ECN CWR) or E (ECN-Echo), or a single .' (no flags). Data-seqno describes the portion of sequence space covered by the data in this packet (see example below). Ack is sequence number of the next data expected the other direction on this connection. Window is the number of bytes of receive buffer space available the other direction on this connection. Urg indicates there isurgent' data in the packet. Options are tcp options enclosed in angle brackets (e.g., ).

So tcpdump has different output depending on the protocol / layer. Since you don't have the -n flag, the src and dst fields are the DNS reverse lookup of the IP and the port is the shorthand letter abbreviate for what the port is commonly used for.

I recommend using the -n flag as it gives more real time output.

share|improve this answer
what is the case if none of those two addresses are not address of server on which this command is executed? – user48058 Jul 28 '10 at 19:32
@user48058: If that is the case it means that the box is a router passing traffic, or the interface is in promiscuous mode picking up traffic that my not be destined for it (For this to really happen you would need to be on a non-switched network or the mirror port of a switched network). – Kyle Brandt Jul 28 '10 at 19:39
is that machine hacked? – user48058 Jul 28 '10 at 19:40
@user48058 Not always. Sometimes seeing traffic destined for another address is perfectly normal. If this is happening, you see it when the network card is set to promiscuous mode. Recent tcpdump versions set the NIC to promiscuous automatically. – sysadmin1138 Jul 28 '10 at 19:51
how can i check if network card is set to promiscuous mode? – user48058 Jul 28 '10 at 20:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.