How to read and create this type of TCPDUMP

Question

I am having an issue with my tcpdump command i have created. Chances are its wrong. What i want to do is this: Run this command:

tc qdisc add dev eth0 root tbf rate 6kbit latency 50ms burst 1540

run this tcpdump:

sudo tcpdump host wiki and wiki2 -c5 -vvv -w dump

Then alter the tc command to this and run it:

tc qdisc add dev eth0 root tbf rate 60kbit latency 50ms burst 1540

and run the same command:

sudo tcpdump host wiki and wiki2 -c5 -vvv -w dump

and dump the speed change.

What i am getting now shows nothing about this. Can i get some help writing the appropriate tcpdump command?

thanks, Pastelinux

Oh? Well adding host between the two works! Now how do i read the output to show me that the packets take longer once i shape one of the hosts? — John Riselvato, Nov 30, 2010 at 18:33

Gerald Combs · Accepted Answer · 2010-11-30 18:31:24Z

2

First, you're putting arguments after the filter expression. The expression should be last, e.g.

sudo tcpdump -c5 -vvv -w dump host wiki and wiki2

Second, "host wiki and wiki2" matches packets which contain both of the following:

That is, traffic directly between "wiki" and "wiki2". You might have better luck with something like this:

sudo tcpdump -c5 -vvv -w dump host wiki or host wiki2

answered Nov 30, 2010 at 18:31

Gerald Combs

6,48125 silver badges36 bronze badges

Oh? Well adding host between the two works! Now how do i read the output to show me that the packets take longer once i shape one of the hosts?
– John Riselvato
Nov 30, 2010 at 18:34
1

I would open it in Wireshark, go to "Statistics→Conversation List→TCP (IPv4 & IPv6)" and look at the last two (bps) columns. However, my opinion is biased in that regard. If you want to solve the problem using only tcpdump you could probably get useful information using the "-ttttt" flag.
– Gerald Combs
Nov 30, 2010 at 18:53
yeah i wish it was as easy as using wireshark. the outcomes of this will be installed in a python script that automatically creates the tcpdump after i shape one of the hosts.
– John Riselvato
Nov 30, 2010 at 18:58
1

Also, are you sure it wasn't changing the "and" to an "or" that fixed your problem? Does "tcpdump -d host wiki and wiki2" and "tcpdump -d host wiki and host wiki2" generate different output? If so there's a bug in libpcap on your system.
– Gerald Combs
Nov 30, 2010 at 18:58
actually they show the exact thing.
– John Riselvato
Nov 30, 2010 at 19:01

| Show 2 more comments

1 Answer 1