Tagged Questions

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
1answer
11 views

Tcpdump advanced filters

i want ask for command can Get only the IPs have more then 1 connection with different source port xxx.xxx.xxx.xxx:X | xxx.xxx.xxx.xxx:Y (example) if IP1 has connection to server with Src Port X ...
0
votes
0answers
13 views

ipv6 ping host got destination host unreachable until run tcpdump [migrated]

At first (all computer booted) when I ping the gateway (linux computer, two network cards(one is usb)) from a windows computer, I got: "Destination host unreachable", but when I run "tcpdump -i ...
-1
votes
1answer
37 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
0
votes
1answer
36 views

What can possibly prevent tcpdump from showing request packets?

I am trying to debug a little SOAP issue. I am using a java web app to consume an API over a VPN. ping and telnet on the webservice server are fine.The Environment is aws ec2 for my app. I have no ...
0
votes
0answers
29 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
8
votes
2answers
153 views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
0
votes
0answers
22 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
0
votes
0answers
59 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...
0
votes
1answer
62 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
3
votes
1answer
50 views

tcpdump: decode packet starting at non-zero offset

I'm debugging a Linux embedded platform which has an interface where regular ethernet frames have an additional 82-octet platform header tacked on the front. I am able to sniff from this interface ...
2
votes
1answer
98 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
1
vote
2answers
69 views

TCP packet which is absent in strace log

Can somebody give me ideas about following situation (Linux 2.6.18-348.4.1.el5 ): At some point tcpdump shows [FIN, ACK] packet sent from server port to local client strace log shows no socket ...
4
votes
1answer
205 views

Making TCP dump without packets loss

How to make a TCP dump where it is guaranteed that all the packets that really pass through the network are captured, and nothing is missed? Details: We have an issue with 3rd party vendor who ...
0
votes
0answers
50 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
0
votes
1answer
53 views

weird bridge issue in KVM

on Centos 6.5 i have a bridge network connected to eth4 and my virtual machine (Centos6.5) running on KVM is also connected to that interface(vnet0) bridge name bridge id STP ...
0
votes
1answer
80 views

tcpdump show strange packet with incorrect src ip and dst ip

I have private LAN with > 100 servers, in which, I have 3 server: x.x.x.37: run memcache on port 11211 (called s37 for short) x.x.x.241: run an application server, which connect to memcache on ...
0
votes
2answers
76 views

How to decode custom port on tcpdump? [closed]

How do we capture/read pcap with option decode a custom port with tcpdump? For example 81 as http port.
-5
votes
1answer
117 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
2
votes
4answers
299 views

One second delay before tcpdump returns packets

Using Ubuntu, I'm trying to sync tcpdump sniffing with self-identifying "pings" from a client device. The problem is that getting precise starts and stops is made difficult by what looks like a ...
1
vote
1answer
243 views

tcpdump filter sequence number

I have captured a packet trace and would like to write a script that will allow me to isolate a matching pair of acknowledgement and Sequence packets(no other way to filter out all the other packets) ...
1
vote
3answers
635 views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
1
vote
0answers
124 views

Massively large number of packets dropped by interface

I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g. 4 packets captured 402 packets ...
1
vote
0answers
44 views

tcpdump expression to show zero-byte ACKs?

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding ...
0
votes
0answers
45 views

tcpdump, display the data section

i am trying to display only the data section of an udp packet using tcpdump. In some other words, is it any way to filter the header section of the udp package? The below command sudo tcpdump ...
0
votes
0answers
127 views

How can I replay a TCP stream to my client

I need to do some validation testing of a new feed handler I have made. I have some pcap data that I captured from the production network and I would like to have my development feed handler connect ...
1
vote
1answer
45 views

Viewing the packet-size of an incoming IP

I have been looking for a sulution to this for a few hours. after no avail im asking for help here. I need to watch my incoming packets by Size. in a format similar to: IP SIZE I have tried ...
0
votes
1answer
105 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...
0
votes
1answer
313 views

tcpdump Server Hello Certificate Filter

On a devices located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet. So I'm trying to figure out how to get ...
4
votes
4answers
450 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
-1
votes
1answer
84 views

can’t get any data from tcpdump from https server where i actually get the response

When i access https://xxx.xxx.xxx.xxx:5432/, i can get reseponse from the server. (https with 5432, for test purpose). But when i do tcpdump on server ‘xxx.xxx.xxx.xxx’, it doesn’t show me anything ...
2
votes
3answers
1k views

identifying vlan packets using tcpdump

I'm trying to figure out the vlan tagged packets that my host receives or sends to other hosts. I tried tcpdump -i eth1 vlan 0x0070 But it didnt work. Has anyone tried to view the vlan ...
2
votes
0answers
68 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
0
votes
1answer
92 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
0
votes
1answer
295 views

Routing traffic through a virtual machine [closed]

I have OpenWRT running in a virtual machine. It's network adapter is bridged to the host. Host ifconfig root@michael-VirtualBox:/home/michael/Scripts/python# ifconfig eth0 Link encap:Ethernet ...
0
votes
0answers
84 views

VLAN configuration on Ubuntu

I need some help with vlans because I'm a bit confused. I setup a transparent vlan over a topology like the one bellow: Host_1 (vlan 11) <---> [switch] <--(vlan 11)--> [switch] <---> Host_2 ...
3
votes
3answers
161 views

Recording network traffic on one linux box, transferring it to another in real time

I have a situation where I want to capture all of the network traffic on one Linux box (currently using tcpdump) but have that data transferred in real time to another Linux on a separate (but ...
1
vote
2answers
902 views

Tap0 not receiving traffic

I have created a tap device tap0 address 10.2.1.4 and added it to a host bridge br1 with address 10.2.1.1 I have "nc 10.2.1.4 -l 1234" running on the host and from another machine I do a "nc ...
0
votes
1answer
294 views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
0
votes
0answers
185 views

Tcpdump stops capturing wifi data while running in the background

I have a problem capturing wifi data using tcpdump while running in the background. OK, lets get some facts: my wifi-device is named wlan0 wlan0 is in monitor mode (that's what I want) I'm using ...
0
votes
1answer
215 views

pretty-printing IP packets [closed]

I'm receiving IP packets using the SLIP protocol, and I'd like to pretty-print them similarly to how tcpdump does it. My program is able to decode the SLIP protocol and create a single string ...
1
vote
1answer
148 views

tcpdump on a capture card

I have a server with a NT20E Capture Card (2x10Gb Packet Capture Card over PCI Express). I want to be able to dump the output to a pcap format but because this isn't listed as an ethX-interface ...
0
votes
1answer
17 views

Is there a way to explicitly set the maximum number of packets tcpdump will capture before terminating?

We have a small script that essentially does the following: A) Capture packets using tcpdump and pipe to output file. B) Run our own clean + sort script on output file. C) Display results using | ...
-2
votes
1answer
757 views

What does tcpdump “BOOTP/DHCP, Request from …” mean?

I am seeing extreme amount of network traffic on a host despite it should be idle. When I do tcpdump -nni eth0 not net 10.10.10.10/32 I get lots of these 14:36:07.851048 IP 0.0.0.0.68 > ...
0
votes
1answer
3k views

Limit tcpdump capture files by time and size

I am having some problems getting tcpdump to log all internet traffic on an interface with the following limitations: I would like a new pcap file every hour with time and date tag in the name If ...
0
votes
1answer
480 views

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
1
vote
2answers
66 views

Is it possible to capture transfered file to my apache server using tcpdump

I have web app installed on apache server(port 80, no ssl). This apps job is to gather some information via transferred from clients files. My goal is to check if my clients are sending proper files. ...
0
votes
1answer
284 views

How to install tcpdump on Cloud Linux

I am new on Linux, and I own a server with Cloud Linux installed. What I like to do is to install the tcpdump but I cannot. I have try to execute the following command from SSH: yum install ...
0
votes
1answer
992 views

Login my Linux with root ,executing command sshd、tcpdump failed

root# /usr/sbin/sshd Privilege separation user sshd does not exist root# tcpdump -i eth0 udp tcpdump : Couldn't find user 'tcpdump' but the users tcpdump and sshd are in the files ...
0
votes
2answers
1k views

Using tcpdump with iptables?

I use iptables to block different kind of attacks on my server. We have a different set of rules along with different rate-limit rules. Now I also use a script that would observe the threshold if it ...
1
vote
0answers
153 views

Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”

I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets. The CPU is a freaking i7, and i have yet to see CPU usage go above ...