Questions tagged [packets]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
130 views

Why are network packets getting sent to incorrect switch port

All, I have multiple security monitoring devices that lose communication/connectivity on a regular basis throughout the week. I have set up WireShark to monitor the network traffic going to/from one ...
2 votes
1 answer
5k views

Is there a way to explicitly set the maximum number of packets tcpdump will capture before terminating?

We have a small script that essentially does the following: A) Capture packets using tcpdump and pipe to output file. B) Run our own clean + sort script on output file. C) Display results using | ...
0 votes
1 answer
146 views

How to get syn flags, ack flags, sequence number and acknowledgement number in tcp packets with nfqueue?

I am working on a project which can redirect the network traffic in tcp (packets sent by client to server1 will be redirected to server2) with netfilterqueue, so I need to classify the packets by ...
0 votes
2 answers
46 views

Do routers need to have assigne IP from given VLAN to foward VLAN packages?

(sorry for my basic question but I had noone to ask) Does routers/smart-switches that foward/pass vlan packets inside same network need to have assign IP from that given VLAN that they foward packets (...
19 votes
3 answers
87k views

ifconfig eth0 RX dropped packets

The problem The ifconfig command shows more and more dropped packets in the RX section. So, there seem to be a problem to some packets arriving from the Internet to my server. The questions What ...
0 votes
1 answer
384 views

TCP/IP packet transmission through NAT

Why my TCP packets do not reach the destination? I send http requests from one PC to another PC, both behind NAT: PC1 behind NAT1, runs Wireshark. PC2 behind NAT2, this one sends http requests. To ...
1 vote
1 answer
573 views

In WireGuard on a sending peer, how is packet sent from the `wg0` interface to the UDP port?

I'm trying to understand, once a packet reaches the WireGuard interface (wg0) how is it sent to the UDP port from where it can be sent to the receiving peer. I was reading the WireGuard whitepaper and ...
-2 votes
1 answer
763 views

I need to block all but one IP address from access to Mongo running on my local Mac using packet filter

Could someone help me block all incoming traffic on my network which has port forwarding set up on the router to allow incoming requests on port 27017 to be sent to the Mac running Mongo internally ...
0 votes
1 answer
639 views

iptables-dropped packet understanding

Today I read in my the below iptables-dropped packet logs and I don't really understand this log. I hope somebody can help me. I only opened an inbound SSH port 2221 and for my outgoing traffic I ...
-1 votes
1 answer
872 views

iptables matching pattern followed by 4 random values followed by another pattern

I'm trying to create a iptables rule that matches the following pattern in this UDP packet: 0x0000: 0000 030a 0000 0000 0000 0000 0000 0800 ................ 0x0010: 4500 0027 5d30 0000 6c11 232a ...
1 vote
2 answers
104 views

What do other nodes do with a switch's packets the first time the packets are sent out? [closed]

When it comes to switches I learned that the first time packets are sent from one node to another, the packets are sent to all nodes on that network. The switch then remembers where, for example, ...
1 vote
2 answers
4k views

irqbalance on linux and dropped packets

I am investigating dropped packets on a dual core, quad XEON box running Linux. One thing I see is irqbalance running on the system. I have a couple of questions. Reading the docs here I think I ...
0 votes
1 answer
111 views

Under ddos attack, legit packets increase length also?

I would like to know about packets length, for example, with normal traffic (without DDoS attack) packets length is 20-40, which I believe is normal, once DDoS attack starts packets length goes over ...
0 votes
1 answer
970 views

Cisco 2960-x doesn't ping default-gateway and creates duplicate packets

I need someone's help I have 3 Cisco 2960-X distribution switches stacked (1 master, 2 slaves), Once a week, our monitoring system alert us that the switch is down, until we reboot it. I ping/...
3 votes
1 answer
681 views

UDP. Sending speed is limited by the minimal Ethernet adapter configuration

I have 1Gbit Ethernet adapter on my computer. And I have the other computer with Ethernet adapter 100Mbit. The both in one LAN and connected through the 1Gbit switch. 1 Test: I try to send from my ...
3 votes
2 answers
5k views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
2 votes
1 answer
129 views

when should I raise an alarm if I see dropped packets ( packet_in or packet_out)

I am trying to create a simple anomaly alarm detection by looking at the KPI of my Linux servers. I was wondering when should I flag an alarm if see dropped packets ( both packet_in and/or packet_out)....
0 votes
1 answer
230 views

Network Packets - Is the data always received sequentially?

Let's say you sit on your home computer and request https://google.com through your browser of choice. The TCP Handshake completes and google's server sends out the HTML/JS pages (and whatever other ...
2 votes
1 answer
460 views

Arista switch - Forward multicast traffic from vlan to vlan on different switch ports with different subsets

I have an Arista DCS-7150S-24-R I got a cross connect from provider X into port #1 (port marked as vlan 100) I got a linux host connected to to the switch at port #2 (port marked as vlan 200) Ports ...
-1 votes
1 answer
1k views

How to prevent Source Engine Query DDoS Attack?

I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet(getting thousands of ip addresses sending traffic to a port where a game server is ...
-3 votes
2 answers
184 views

What is the reason to use SSL on websites if it can be decrypted easily?

Since SSL can be decrypted easily using a basic man in the middle node, whats the reason to continue using it? Don't most ISPs decrypt on a daily basis using Deep Packet Inspection? And isn't it ...
5 votes
3 answers
9k views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
1 vote
2 answers
31k views

How to set the UDP Packet Size with iperf3?

How to set the UDP Packet Size with iperf3? The flag "-M" does not work with iperf3. Is there an alternative?
0 votes
1 answer
641 views

Why iptables is not working as expected?

I have put these four filters with iptables: iptables -I FORWARD -p udp -i eth0 -j DROP iptables -I FORWARD -p udp -o eth0 -j DROP iptables -I INPUT -p udp -i eth0 -j DROP iptables -I OUTPUT -p udp -...
2 votes
1 answer
2k views

Proving packets per second bottleneck?

I have a '100Mb' network connection that's currently consistently transmitting at about 20K packets/sec, irrespective of packet size in the range of 300-600 bytes. This yields an observed bandwidth ...
-1 votes
1 answer
992 views

the MAC header of captured wireshark packets

I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
0 votes
1 answer
520 views

Why are duplicated UDP packets being dropped 10 out of 11 times by this iptables configuration?

I am trying to duplicate UDP packets flowing to port 50007 on an Internet address from devices on a local NAT network (192.168.12.0/24) with the intent of processing them locally (on 192.168.12.1:...
1 vote
1 answer
512 views

Mysteriously dropped packets

I have server with Broadcom Corporation NetXtreme II BCM5706 Gigabit Ethernet chips, and 2.6.18-164.2.1.el5 kernel from Red Hat Enterprise Linux Server release 5.4 (Tikanga). During normal work day ...
5 votes
2 answers
2k views

How do I fake dropped packets (or actually make them fail)?

Background One of our clients suffers from an intermittant problem with their internet where it will drop packets when a user downloads a large file (their IT is looking into the problem). I have ...
1 vote
0 answers
1k views

tcp previous segment not captured when NAT

I have a client request web service on a server behide NAT. My client IP is 10.54.10.193 NAT address: 10.54.28.183 Server address: 62.209.39.203 When client request web service on server we have TCP ...
1 vote
1 answer
4k views

High count packets rejects in established connections because of timestamp

I am trying to set up a Wowza media server using a Dell R710 with 24GB memory and a 10Gbit connection and all the calculations say it should be able to handle around 20k connections however when I get ...
2 votes
1 answer
1k views

Packets being routed to the wrong IP

Looked around, can't find a similar issue anywhere... I have been having some very strange and hard to explain problems on my network lately, and in my efforts to find the cause, I came across an ...
2 votes
0 answers
604 views

PHP-FPM slowlog and Mysql lost connection

I was having an issue with PHP-FPM and mysql. When I needed to process an input file that would generate several selects/inserts/updates for each line, it would stop after approximately 60s with ...
1 vote
1 answer
6k views

Setting ToS/QoS for VoIP on Mikrotik

I have a Mikrotik router which looks like iptables. I need to setup QoS to ensure VoIP phones get top traffic priority. How do I know what ToS to use and how would I get it? I searched and can't seem ...
1 vote
1 answer
2k views

Opening a port to only one external ip address

I want my port 2255 on 192.168.1.101 to accept and send packets only from and to 74.22.22.22 What settings needs to be added on the windows firewall and my router?
0 votes
1 answer
562 views

How to connect Network and GRE Tunnel Traffic and control and flow of TCP/UDP Packets?

I need some serious help with a complex routing setup I am doing. Lets I have a /24 IPv4 .I am announcing the same /24 at two different locations. One is a ISP exchange center where all the ISPs peer ...
1 vote
2 answers
1k views

Best way to trace outgoing requests from a server

We have an Ubuntu 14.04.1 LTS server with nginx 1.4.6 that hosts a few dozen websites and received an abuse complaint from another server of hundreds of requests like this: "POST /wp-login.php HTTP/1....
2 votes
0 answers
334 views

Apache Instance in Private Subnet not returning packets

How can we get the Apache instance in a private subnet to work? Configuration Public subnet with 1 NAT instance Private subnet with 1 App instance Details 1. Masquerading is turned on NAT on via ...
0 votes
1 answer
397 views

How can I tell what's happening to my packets?

I'm trying to bring up a little box on my network. I just reflashed the firmware and it's supposed to come up as 192.168.1.1 by default. My router is a DSL modem at 192.168.0.1; it usually uses a ...
0 votes
1 answer
43 views

How to specify packets in traceroute? [closed]

I reading the manual pages for help, but I didn't find a parameter that allows you to specify how many packets to send with the program? Would appreciate tips from you guys, thanks!
0 votes
1 answer
203 views

Windows XP procedurally drop packets [closed]

We have a need in our office network to procedurally drop incoming packets on an Windows XP machine acting as a server. By procedurally we mean to drop a percentage of packets incoming to the XP ...
3 votes
1 answer
3k views

Percona: Got an error writing communication packets

Since a few days, two of our php-applications (symfony2) are reporting the following errors in mysql-logs: [Warning] Aborted connection 253 to db: '$appname' user: '$appname' host: 'localhost' (Got ...
3 votes
1 answer
3k views

Need help understanding capturing from Wireshark?

I am having issues with my FTP servers. Connecting, sending and receiving fail sometimes, and it is not consistent. I manage to capture and filter by IP the packets, I just need pointers on what can ...
4 votes
1 answer
6k views

How does an Access Point handle broadcast packets from the wired side?

I have an Cisco AP 1242AG autonomous AP connected to L2 switches. Let's say I have 100 wired devices each sending 2 broadcast UDP packets per second. Obviously these packets will reach the Access ...
0 votes
1 answer
4k views

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
2 votes
1 answer
5k views

is there such a thing as "too many packets per second"?

we have 2 offices in separate buildings. there is an ethernet link between the two. The link is provided by the company that manages one of the buildings, and they provide us with 100Mbps bandwidth ...
1 vote
2 answers
6k views

F5 Packet filtering or iRules or both?

I need to set-up a custom filter for a virtual host that requires both ip address checks and URL check. Like so: _if_ _(_ http-request matches url _and_ ip is from certain host/net range _)_ ...
2 votes
2 answers
206 views

Wireshark and mirrored ports bringing in 10k+ packets a second

I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
1 vote
0 answers
678 views

Duplicate syn packets sent from Windows server 2003 sp2

My pc is running Windows server 2003 sp2. Whenever I establish an internet connection (e.g., with internet explorer to google.com), my host sends the syn packet twice. It is (probably not) a ...
1 vote
1 answer
809 views

iptables/haproxy limit packets per second

Is it possible to limit incoming tcp packets per second (or bytes per second) with iptables or haproxy? I have found many examples but none of them seem to work.