tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
0answers
16 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
2answers
24 views

Ubuntu server - packets from different networks not coming through (flushed iptables)

I have set up a brand new Ubuntu server, and I'm encountering a very strange network related issue - the processes running on the server cannot 'see' packets originating from external networks, but ...
0
votes
0answers
15 views

Duplicate SYN package forwarded by Docker?

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
0
votes
1answer
43 views

Server send TCP ACK with wrong number after receiving SYN

I have a client establish new TCP connection then sends request to a server per second. Both client and server are on the same linux box (via loopback interface). The client periodically reports ...
0
votes
2answers
25 views

Monitor networking between two interfaces

I need to monitor TCP networking between two hosts which does not have tcpdump installed, and I cannot install on them. Is it possible to do so with tcpdump using some known rule ?
3
votes
0answers
35 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
3
votes
2answers
618 views

TCP Messages Merged?

I have an application that sends 100 of 186-byte (excluding headers) TCP messages back to back without gap from host A to host B. I ran tcpdump to capture the packets on host A (where the sender is), ...
1
vote
2answers
39 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
0answers
70 views

tcpdump on bridge interface (virbr) does not receive any packets destined for one of its addresses

Here's the configuration for the interface: # ifconfig virbr0 virbr0: flags=4355 mtu 1500 inet 192.168.11.1 netmask 255.255.255.255 broadcast 255.255.255.255 ether ...
1
vote
1answer
28 views

How can tcpdump monitor TCP disconnect and log timedate stamp?

I have two servers each running a Java application that creates two separate TCP connections, one from HostA -> HostB and one from HostB -> HostA on separate ports. I am told the TCP connection is ...
0
votes
0answers
22 views

How does TCP PSH and HTTPS works?

Right now I monitor traffic on my VPN server. I'm using tcpdump for it and it works pretty good. sudo tcpdump -n host SENDER_IP In this example you can see one HTTPS request from SENDER_IP to ...
1
vote
0answers
36 views

Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic

We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - ...
0
votes
0answers
22 views

Not getting TCP Update Window packet after TCP Zero Window begins

Once I get TCP Zero Window during data transmission, I can't send data anymore in that desktop sharing session. Even I stopped the data sending to check if it can resume but no benefit! In my test ...
1
vote
1answer
89 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I ...
2
votes
2answers
43 views

wget only works when tcpdump is listening

I am running two Virtual Machines over the XEN hypervisor both with Ubuntu trusty (Linaro-Developer version) with the following simple bridge networking setup: Backend domain (dom0): br0 ...
0
votes
0answers
36 views

“Filtered” port when accessing server

I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines. I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
0
votes
1answer
45 views

On-the-fly decoding HTTP bodies on Linux?

My wish is to monitor HTTP exchanges between my server and a browser. At present time, I use the localhost because I'm developping the app. I installed and used tcpflow and found it quite useful but ...
-1
votes
1answer
23 views

What does “-tnn” mean in “tcpdump -i eth0 -tnn dst port 80 -c 1000”

What does -tnn mean in tcpdump -i eth0 -tnn dst port 80 -c 1000. I didn't find -tnn on the man page, and I didn't find it on the Internet. Can anyone explain it to me?
1
vote
0answers
38 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
1
vote
0answers
71 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
4
votes
1answer
158 views

Finding google unusual traffic

We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
0
votes
0answers
156 views

Sometimes unable to tune Linux TCP stack for improved high-latency performance

I have been unsuccessfully trying to apply the TCP Tuning techniques discussed at http://fasterdata.es.net/host-tuning/ As you'll see when you read through the entire question, sometimes the es.net ...
0
votes
0answers
27 views

pfsend does not send a pcap file at specified rate

I'm replaying traffic using pfsend application that comes from PF_RING. I'm using SMIA pcap file to evaluate Bro and Snort on a multi-core machine. Using pfsend, we can specify at which rate the pcap ...
3
votes
3answers
243 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
0
votes
0answers
37 views

OOM Killer when tcpdump is run in system with low memory

I am working on an embedded system with limited memory. Here is the dump from my vmstat: procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu----- r b swpd free buff ...
1
vote
1answer
74 views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
71 views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
1
vote
1answer
226 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
1
vote
1answer
71 views

Tcp connection breaking, too fast for serial?

I've been having real difficulties getting a tcp connection to work with my web server. I think the issue might have something to do with the speed or ordering of the packets as the connection seems ...
2
votes
1answer
94 views

Sniff outgoing traffic on my server on a SSL channel

Im executing a CURL command on a php application running on my nginx server (centOS). The end point is a https address so the outgoing traffic is of course encrypted. I want to see the network ...
0
votes
0answers
31 views

tcpdump returns no multicast traffic when a DNS entry is being used in resolv.conf

I have noticed on a 6.5 Centos host that when I am using tcpdump to determine if a multicast source is being received/ sent that it does appear to get any results when I have a DNS registered in the ...
0
votes
0answers
40 views

Remote OSX Server does not accept TCP connections from abroad?

Long story short: I am able to connect to the box (which is located in my office) from home. Two different ISP providers. On the contrary, my friend from the US is not able to access it - the ...
1
vote
0answers
110 views

how to use tcpdump on interface with link down

A set of daemon applications communicating over UDP broadcasts on the same machine give me trouble capturing their traffic. The network interface is eth0, it's configured to a static IP and there's no ...
0
votes
0answers
55 views

Two processes stuck on network communication

We have had hang on our Oracle extraction process very intermittantly. Nothing obvious from the Oracle side, and starting to think it is more network related. There are two Oracle processes ...
0
votes
1answer
160 views

tcpdump freezes and not capturing properly without internet connection

When I don't have any internet conncetion and I want to capture network between local computers, tcpdump acts like this: 1.I start tcpdump using following command: tcpdump -ixenbr0 2.After I run ...
-1
votes
1answer
243 views

How i can dump raw packets from an existing tcp socket using tcpdump on Mac and Linux? [closed]

Once I know the IP address and port number combo, I can run this to see some of the packets: tcpdump | grep [IPADDRESS] Anybody know how I can now see the raw packets too? Thanks!
1
vote
0answers
39 views

Unusual Behavior with NIC Interrupt Moderation Disabled

OS: Centos7 I disabled interrupt moderation, ethtool -C eno2 rx-usecs 0, and then started capturing on that interface using tcpdump. The dump file was growing as expected. Maybe an hour later the ...
-1
votes
1answer
99 views

Why is wireshark capturing packets not destined to my host? [closed]

My IP was configured as 192.168.101.91, I don't understand why my host is receiving packets which have a destination address of 192.168.87.203(and many other IPs which I didn't capture) given that I ...
10
votes
1answer
345 views

SynProxy can not return syn ack packets with asymmetric dual bridge topology

I have a asymmetric dual bridge topology as shown below when i connect from 172.16.11.5 and 172.16.10.6 with ssh but i can not connect because of SynProxy. ------- ...
1
vote
1answer
317 views

Tcpdump/Iptables on bridge interface without assigned IP address

I have set up a bridge interface without an ip on it. $ brctl addbr br0 $ brctl addif tap0 $ brctl addif tap1 $ ifconfig br0 up As seen above, this bridge is connecting 2 TAP interfaces setup ...
2
votes
0answers
145 views

Wireshark only capturing broadcast packages [closed]

I've ran Wireshark multiple times on my notebook for wireless networks verifying mobile packages for my devices and it used to work most of the time. I haven't been able to monitor my traffic today ...
12
votes
4answers
443 views

tcpdump increases udp performance

I'm running a set of load tests to determine the performance of the following setup: Node.js test suite (client) --> StatsD (server) --> Graphite (server) In short, the node.js test suite ...
0
votes
0answers
406 views

Nginx TCP Fast Open Issue

I have configured Nginx and Apache on one of my servers. The nginx server listens on port 80 and Apache on port 81. Nginx works as a reverse proxy. In nginx I configured TCP Fast Open: server { ...
4
votes
4answers
212 views

Monitor and collect statistics on TCP connection to src or dst host

I would like to collect stats on TCP/UDP packets sent between two hosts (A and B). I am looking for a tool to install on A and B to get the following information: kb/seconds packets/seconds ...
2
votes
2answers
2k views

Filtering GRE enacpsulated packets with tcpdump

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre: 15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > ...
0
votes
1answer
40 views

tcpdump capture destined to other server

I´d like to ask for help in understanding this tcpdump capture. Tcpdump is running on server 10.13.255.27 and received the packet: root@server27 ~]# tcpdump -i eth0 dst host 10.13.255.26 and not src ...
1
vote
1answer
212 views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
2
votes
1answer
148 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ ...
0
votes
0answers
70 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...