Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are the advantages and benifits of TCP dump and how can this be used and in which environments it can be used

share|improve this question

closed as not constructive by Janne Pikkarainen, Khaled, joeqwerty, Ladadadada, Dave M Apr 5 '12 at 12:09

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
implementing an ethernet-to-rfc-1149 bridge? –  symcbean Apr 5 '12 at 12:04
    
@symcbean That's what shotguns with #8 birdshot is for: tcpdump on rfc-1149. –  cjc Apr 5 '12 at 12:15
add comment

2 Answers 2

Packet sniffers are a very valuable tool. When coupled with a protocol decoder such as Wireshark, they can tell you in explicit detail what's actually happening on the network wire. Depending on what you're trying to figure out, they can show you the exact problem, or lead you into the right course of research for the actual problem. Learning to read packet traces is one of the skills most system administrators need at least a little of.

A brief list of things that a packet trace will display in gory detail:

  • DNS resolution problems. You'll see the full resolution failback process, and can highlight configuration problems (why are we hitting THAT server? Why are we attempting to resolve a dns domain that died 5 years ago? Why are we attempting to resolve IPv6 addresses before IPv4?)
  • TCP errors. Retransmits, bad windowing, packet corruption. All these things really slow connections down.
  • SMB Protocol negotiation problems. Of interest to Windows/Samba administrators, this will show protocol negotiation problems (NTLM? NTLMv2? Kerberos? LanMan?) between clients and the server.

And that's just the easy stuff that the dissectors tell you outright. Once you've learned how things are supposed to look, you'll start to see patterns in the traffic that the dissectors don't reveal.

However, not all problems can be broken by packet sniffing. Problems with SSL/TLS communication are almost by definition invisible. Sometimes the problem is with a higher layer protocol (such as a hand built web-API) and doesn't show any artifacts on the wire.

share|improve this answer
    
thanks for your answer.can you suggest me how to learn these and where to start learning –  developer Apr 5 '12 at 11:48
    
@developer The most accessible source is probably the Wireshark Wiki. They even have example captures to download and look at, and pages to tell you what you are looking at. Example-based education! –  sysadmin1138 Apr 5 '12 at 11:54
    
Thanks for the info.can i have your email id. –  developer Apr 5 '12 at 11:56
add comment

You can use it

  • to see all the network traffic generated by application
  • to solve network problems
  • for security testing

Not to mention that they are extremely useful when starting to study computer networks, because you can see exactly what kind of information is flowing through the network and how this information is represented.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.