Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can I use tcpdump to detect Aborted connections on port 80 (Apache) originating from a specific IP (my remote IP). I can reproduce the Aborted connection in my web browser, but I have no way to verify if the request is getting to my server. I tried this, but couldn't really tell if a connection was Aborted.

tcpdump -n -i eth0 -s 0 src or dst port 80|grep -F "XXX.XXX.XXX.XXX"
share|improve this question

1 Answer 1

up vote 0 down vote accepted

I would think that an "Aborted" connection happens when a TCP packet is sent the tells the connection to reset, the flag that represents this is the RST flag.

You can filter for RST using tcpdump -i eth1 'tcp[13] & 4 = 4'. Also, a bit off point but grepping tcp dump is a little lazy, you can always add dst host X or src host X to your filter.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.