4

When I don't have any internet conncetion and I want to capture network between local computers, tcpdump acts like this:

1.I start tcpdump using following command:

tcpdump -ixenbr0

2.After I run it, tcpdump gets in freeze mode for about 1-2 minutes, after that it captures some packets and again freezes, and again capture some and same happen over and over.

I can't even quit tcpdump with ctrl+c or even kill the tcpdump process using killall tcpdump command.

I have this issue on all computers in the network, no just one.

But when I connect network to internet, tcpdump works just fine. Everything is okay with internet connection. Seems very strange to me.

I also tried -l , but no luck.

I'm using Ubuntu 14.04. Tcpdump version is 4.5.1.

Anyone has any idea what's wrong ?

Improve this question
5
  • 3
    What happens if you use -n, i.e. tcpdump -n -i xenbr0?
    – user137177
    Jun 10, 2015 at 7:43
  • @GuyHarris it worked ... What's -n doing ?
    – Michel Gokan Khan
    Jun 10, 2015 at 7:46
  • See man tcpdump.
    – Andrew Schulman
    Jun 10, 2015 at 7:55
  • No it just doesn't try to resolve IP addresses
    – Nabil Bourenane
    Jun 10, 2015 at 7:58
  • I mean its trying to change ip addresses to names with -n
    – Michel Gokan Khan
    Jun 10, 2015 at 8:03

1 Answer 1

Reset to default
9

When I don't have any internet conncetion

...

tcpdump gets in freeze mode for about 1-2 minutes, after that it captures some packets and again freezes, and again capture some and same happen over and over.

You're running it without -w, so, instead of just writing raw packet data to a file, it dissects the packets and prints a summary of them.

This means that, for IP packets, it tries to report the source and destination IP addresses of the packets.

Without -n, it tries to find the host name corresponding to the address, which means that, unless the address is in the hosts file, it'll try to use DNS to find the name. If you don't have any Internet connection, but the local DNS resolver thinks it should search the Internet DNS servers, it'll try to contact those servers and wait for an answer or a timeout. It won't get an answer, so it'll have to wait for the timeout.

Once the timeout occurs, it gets told "I don't have a host name for that address", and just prints packet information, showing the address numerically. Then, when the next packet arrives, if it has an IP address, the same thing happens.

-n disables looking up the name for IP addresses, so there aren't any timeouts.

Improve this answer
2
  • 1
    dns misconfigurations are a mess :D
    – Andor
    Jun 10, 2015 at 12:09
  • this really stumped me! I was using network namespacs and didn't setup internet connection between my two veths. I was wondering why it stalled!
    – Setheron
    Aug 13, 2019 at 23:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .