Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I use tcpdump to detect Aborted connections on port 80 (Apache) originating from a specific IP (my remote IP). I can reproduce the Aborted connection in my web browser, but I have no way to verify if the request is getting to my server. I tried this, but couldn't really tell if a connection was Aborted.

tcpdump -n -i eth0 -s 0 src or dst port 80|grep -F "XXX.XXX.XXX.XXX"
share|improve this question
up vote 0 down vote accepted

I would think that an "Aborted" connection happens when a TCP packet is sent the tells the connection to reset, the flag that represents this is the RST flag.

You can filter for RST using tcpdump -i eth1 'tcp[13] & 4 = 4'. Also, a bit off point but grepping tcp dump is a little lazy, you can always add dst host X or src host X to your filter.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.