The tag has no usage guidance.

learn more… | top users | synonyms

16
votes
1answer
26k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
12
votes
4answers
41k views

How do you diagnose packet loss?

I realise this is very subjective and dependent on a number of variables, but I'm wondering what steps most folks go through when they need to diagnose packet loss on a given system?
7
votes
1answer
5k views

Why is the “don't fragment” flag set in https and ssh protocols?

I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
5
votes
2answers
8k views

Can 3G networks be packet sniffed / analyzed?

Just wondering if 3G networks can be sniffed like public wifi networks, via wireshark for example (I'm almost sure this is not possible due to encryption, but I just want to make sure?)
5
votes
1answer
5k views

iptables drop packet by hex string match

I got this packet captured with tcpdump but I'm not sure how to use the --hex-string param to match the packet. Can someone show me how to do it? 11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset ...
5
votes
2answers
5k views

Configuring Frame Relay using a Switch Simulation - Packet Tracer

I have the following set up in Packet Tracer: I am trying to configure frame-relay between the RTR-EDGE router, the RTR_ENG router and the RTR_SAL router using a frame-relay switch simulation (the ...
4
votes
2answers
5k views

How is packet collision avoided in full duplex mode?

While working in full duplex mode, one can send and receive packets simultaneously. Why don't the packets collide?
4
votes
3answers
32k views

Excessive 'TCP Dup ACK' & 'TCP Fast Retransmission' causing issues on network. What's causing this?

I'm getting excessive TCP Dup ACK and TCP Fast Retransmission on our network when I transfer files over the MetroEthernet link. The two sites are connected by one sonicwall router, so the sites are ...
4
votes
1answer
1k views

Packet loss during TCP handshake

I have to implement a pseudo TCP handshake that leads into a file transfer. I have no problem doing the file transfer: simple send-acknowledge. What I can't wrap my head around is how to do the three ...
4
votes
1answer
200 views

udp packet delays in my dedicated WIFI network - can i force UDP nodelay over wifi?

I have a dedicated app and network development for passing UDP packets over a wireless network. The totality of the network is a PC (Mac OSX or Linux) which sends the packet-->router/AP-->WIFI ...
3
votes
1answer
317 views

TCP sequence number and ACK number

Is the TCP sequence number just the ACK number + bytes received? Is it different when doing the 3-way handshake?
2
votes
1answer
1k views

Check what the average packet size is in a network (what firewall/router should I get)

Is there any way to do this? We are looking into buying a Fortigate 100D but are unsure if it will hold up to our requirements. http://www.fortinet.com/products/fortigate/100D.html While the ...
2
votes
1answer
6k views

Linux bridge (brctl) is dropping packets

I have been researching this problem for a few days and have not found an answer yet. Your help will be really appreciated! I have a few VMs (Virtual Machines) running on a physical server. The ...
2
votes
1answer
466 views

Inaccurate bandwidth limiting in altq queues

I'm setting up an environment where I have one Linux server, one OpenBSD router and one Linux client and I want to be able to limit how much bandwidth the client should be able to use. I've been ...
2
votes
1answer
2k views

10GbE be2net low pktgen performance

I am testing the network performance of two workstations, each having 2.4GHz Xeon quad core processors and NC550SFP PCIe Dual Port 10GbE Server Adapters, linked back to back. I've checked the ...
2
votes
1answer
221 views

Confusion about TCP packet analysis terms

I'm analyzing our network and have some confusion about the terms: this is the 2-packet output from source to destination. from these i have to get some features as describe, pls make me clear... ...
2
votes
1answer
536 views

Outbound Packets Dropping / Timeouts - Only with Azure

I have an issue with packets dropping to a third party data center in Florida, USA. The issue only occurs on Azure Virtual Machines, no matter which data center the VM is in. I've done the same tests ...
2
votes
0answers
236 views

Redhat 6.4 configured to log Martian packets but is not logging ll header

I am trying to investigate the source of martian packets I have been seeing on several servers connected to the same subnet. The logging of martian packets has been enabled in /etc/sysctl.conf. ...
1
vote
4answers
2k views

iptables : How to calculate how many bytes there're in a packet?

I'm working on a firewall and I would like to know how to calculate how many bytes there're in a packet or at least have an idea what the averages are. When I googled it, 1500 bytes was mentioned a ...
1
vote
3answers
223 views

Is TCP header the same as TCP segment?

So, is a TCP header actually the same thing as a TCP segment? I was reading this page, where it reads near the end that: Even though it might seem they are, in most cases, when referring to the ...
1
vote
4answers
4k views

Smaller network packets vs bigger packets - confused

Some are saying that bigger packets are better to send then smaller. But in this app: http://media.pearsoncmg.com/aw/aw_kurose_network_2/applets/message/messagesegmentation.html The lower the packet ...
1
vote
2answers
64 views

Computer sleep and wake up announcement on a network

I wonder if there's some sort of network packet that announces a computer going to sleep or waking up again. If not, can you think of reasons why this would be a bad idea?
1
vote
1answer
1k views

PF: Block all, but one subnet firewall rule?

I'm trying to do something that I thought would be relatively simple: Block all the traffic to a test server, other than my company's subnet. I've tried things along these lines (111.111.0.0 is my ...
1
vote
1answer
488 views

iptables connlimit: exclude multiple IP addresses

I have currently this IPTABLES command: iptables -A INPUT -s ! 192.168.0.2 -p tcp --syn -m connlimit [...] -j DROP As far as I know, such rule limit some number of connections following various ...
1
vote
2answers
1k views

Tracking actual packet path on a LAN

Is it possible to track the path a packet takes on a switched network. When I run a traceroute I get only the router and the destination. I know for a fact, however, that the packet must pass through ...
1
vote
2answers
8k views

Intel 82579LM Gbit Ethernet Controller - magic packet (WOL) right after ping is not working

I am experiencing a very annoying and mysterious behavior when sending magic packets (for Wake On LAN) shortly after pinging an Intel 82579LM GigaBit Ethernet Controller (the onboard ethernet ...
1
vote
2answers
182 views

What does “all packets that fall through to the default rule should be dropped” mean?

Does “all packets that fall through to the default rule should be dropped” mean that my iptables rule should drop everything at the start, like this? # Set the default policy to drop $IPT --policy ...
1
vote
1answer
93 views

Viewing the packet-size of an incoming IP

I have been looking for a sulution to this for a few hours. after no avail im asking for help here. I need to watch my incoming packets by Size. in a format similar to: IP SIZE I have tried ...
1
vote
1answer
2k views

VMWare-ESXi server dropping packets, shaky connection

I have a few virtual servers running on a VMWare-ESXi server. One of those is a mailserver running Windows server 2003, Has been running quite well for a while now. About 4 days ago, the mailserver ...
1
vote
0answers
34 views

Split TCP packet - Data layer vs IPv4Layer

What is the different between split TCP packet in the Data layer compare to split the packet in IPv4Layer ?
1
vote
1answer
101 views

Understanding ARP traces during OS load

Consider the following ARP packets captured while a unix machine was booting. From the packets I understand that this machine whose MAC address is 00:22:22:22:22:22 is requesting information about ...
1
vote
1answer
899 views

UDP maximum segment size

Environment: I am writing a UDP client-server application. the path MTU between client and server is 1500 bytes (with only a wireless link between them, so this value is pretty much stable). My system ...
1
vote
0answers
1k views

Calculating the round trip time for ping packets

I am currently practicing for my network & communications course and have managed to confuse myself slightly on a question about packet round trip time. I have made a start but am now a bit stuck! ...
0
votes
1answer
325 views

What is Reverse Gossip Transfer Protocol?

Playing with wireshark, I see a bunch of packets that say something like rgtp > https [ACK] Seq=???? Ack=?????? Win=????? Len=0 What is a Reverse Gossip Ttransfer Protocol? What is it used for, ...
0
votes
1answer
3k views

TCP Sequence & Acknowledgment numbers

I have looked through other questions on here involving the relevant topics, but I am still not clear on this. I have just been reading this explanation of TCP sequence & acknowledgment numbers. ...
0
votes
1answer
126 views

Tools to inspect an ethernet packet travels through host's interfaces?

I am debugging a local ethernet connection on a Linux machine. I want to inspect the ethernet packets as they travel. in and out current machines' interfaces. I do not have a GUI on the machine. Is ...
0
votes
1answer
244 views

iptables: is it possible to spoof NEW packets and make them look like ESTABLISHED packets?

See title for the question. This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED ...
0
votes
2answers
2k views

When analyzing packets with Wireshark, is there a way to know which program is sending which packet?

is there an easy way to know from where the packets come from? Which program? My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I ...
0
votes
1answer
46 views

Force Windows to send packets as soon as they arrive the nic

I have a network application running on Windows Server 2008 R2, that must send small packets in a very short time interval, each microsecond matters. My problem is that windows accumulates the packets ...
0
votes
2answers
319 views

How to redirect a packet with iptables that match a certain pattern? (eg a QUERY command with UDP)

I have a certain packet that I want at all times to be redirected to a specific ip on my virtual network interface. As for now my iptables is setup like this: (the commands, I use \ as for now to ...
0
votes
1answer
748 views

What does a packet capture in pfsense do?

I have some issues with a third party to establish a VPN connection. To debug it, I made a packet capture on the device that represents our synchronous DSL line. The solution I'm using is an old ...
0
votes
2answers
257 views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...
0
votes
1answer
480 views

How to block specific UDP packet outgoing from machine using iptables

I want to block specific UDP packet OUTGOING from my machine using iptables. Packet has a string in "hex in RAW"(?) i want to check packet by it. Like: If UDP packet hex RAW match "test_text" - block ...
0
votes
1answer
52 views

Sharing connections on a circuit-switched network possible?

Is it possible to somehow share a circuit-switched connection? For example, could multiple computers be connected to a router which is connected to a circuit-switched network?
0
votes
1answer
548 views

How does ospf control flooding?

What method is used by ospf protocol to prevent looping of flooded packets for link state advertisements? The packet header does not contain any timestamp. How do the routers recognize that it is the ...
0
votes
1answer
66 views

How many times does switch calculates FCS?

Does a switch calculate the Frame check sequence (FCS) before sending packets? Because packet shouldn't change, so FCS should also stay the same.
0
votes
3answers
385 views

How many packets will it take to send particular data?

If I know the maximum packet size is 1500 bytes say for Ethernet frame v2 then for example I want to transfer 1 KB over the Internet which is roughly 1024 bytes. Will the packet be split into many ...
0
votes
1answer
37 views

forwarding of small and large packets: any difference?

When it comes to simple forwarding of packets (no errors being generated), are packets processed faster by routers when they are small as opposed to when they contain a large payload? Or do routers ...
0
votes
1answer
2k views

Dropping Packets Randomly

I have a SuperMicro Server based on the X9DR3-LN4F+ motherboard from SuperMicro. Original intentions for the system were quite different from what it has ended up serving, but that happens. It is ...
0
votes
1answer
296 views

Getting packet rate with tcpdump or iptables

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment. I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the ...