1
vote
0answers
61 views

Simple tcp capture tool - output results like chat session? [closed]

I seek a tool which will capture TCP traffic with the resulting output looking almost like an iPhone SMS conversation. Something like: timestamps client stuff is left justified / green server stuff ...
0
votes
0answers
100 views

How can I replay a TCP stream to my client

I need to do some validation testing of a new feed handler I have made. I have some pcap data that I captured from the production network and I would like to have my development feed handler connect ...
0
votes
1answer
87 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...
0
votes
1answer
237 views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
0
votes
0answers
90 views

How to get more NFS packet details from Wireshark?

How can I get Wireshark to give me details about NFS packets at this level of granularity? (as exemplified here here) Specifically, I am interesting in looking at the the "Stable" option toward ...
1
vote
1answer
216 views

Why does OS X spend one more packet to establish and close a TCP connection?

Linux spends 3 packets to establish a TCP connection and 3 packets to close it, as shown by the tcpdump capture # establishing TCP connection 22:37:09.150456 IP 127.0.0.1.49327 > 127.0.0.1.8000: ...
2
votes
1answer
2k views

tcpdump capturing tcp resets by host

I am trying to figure out where my tcp resets on my webserver happen. I have the following capture: tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0' When I look at the ...
3
votes
1answer
463 views

How to debug why WAN TCP/IP throughput is lower than expected?

I'm trying to figure out why tcp/ip throughput between two hosts I control is much lower than expected. Host A: internet connectivity provided by Comcast (Residential) in Boston Metro -- can ...
1
vote
4answers
831 views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
0
votes
0answers
358 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
2
votes
2answers
146 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
1
vote
1answer
57 views

How to diagnose why a port is broadcasting a “ZeroWindow” status

I have two CentOS servers (one is an app server, the other is a DB) communicating over a port. Every once in a while, the application server starts broadcasting that the port connected to the DB has a ...
7
votes
2answers
2k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
5
votes
2answers
5k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
2
votes
2answers
4k views

how to calculate packet loss from a binary TCPDUMP file

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not) It must be some kind of packet loss, because from ...
1
vote
1answer
163 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
6
votes
1answer
2k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
3
votes
1answer
656 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
0
votes
2answers
308 views

What is a RP Paket in a tcpdump log?

I have a tcpdump log with the following entry: 14:53:31.428570 IP 10.4.65.65.16666 > 192.168.201.10.80: RP 587:687(100) ack 48545454154 win 0 My Problem is that i have never seen an RP paket ...
10
votes
6answers
20k views

How to capture ack or syn packets by Tcpdump?

I want to know the filter rule , thanks!
4
votes
1answer
573 views

tcpdump and congestion window

Sniffing http traffic to my (linux) server it seems like it always responds advertising a window size of 14. It isn't affected if I change the default initcwnd size (with ip route), and it doesn't ...
1
vote
2answers
1k views

Why Packet Loss AFTER tcpdump has logged the packet?

We encounter some strange packet loss and want to know the reason for this. We have an imageserver and a server for stressing the imageserver. Both are located in the same datacenter First we run a ...