tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
0answers
3 views

pfsend does not send a pcap file at specified rate

I'm replaying traffic using pfsend application that comes from PF_RING. I'm using SMIA pcap file to evaluate Bro and Snort on a multi-core machine. Using pfsend, we can specify at which rate the pcap ...
3
votes
3answers
46 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
0
votes
0answers
14 views

OOM Killer when tcpdump is run in system with low memory

I am working on an embedded system with limited memory. Here is the dump from my vmstat: procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu----- r b swpd free buff ...
1
vote
1answer
51 views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
41 views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
1
vote
1answer
71 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
1
vote
1answer
49 views

Tcp connection breaking, too fast for serial?

I've been having real difficulties getting a tcp connection to work with my web server. I think the issue might have something to do with the speed or ordering of the packets as the connection seems ...
2
votes
2answers
69 views

Sniff outgoing traffic on my server on a SSL channel

Im executing a CURL command on a php application running on my nginx server (centOS). The end point is a https address so the outgoing traffic is of course encrypted. I want to see the network ...
0
votes
0answers
23 views

tcpdump returns no multicast traffic when a DNS entry is being used in resolv.conf

I have noticed on a 6.5 Centos host that when I am using tcpdump to determine if a multicast source is being received/ sent that it does appear to get any results when I have a DNS registered in the ...
0
votes
0answers
29 views

Remote OSX Server does not accept TCP connections from abroad?

Long story short: I am able to connect to the box (which is located in my office) from home. Two different ISP providers. On the contrary, my friend from the US is not able to access it - the ...
1
vote
0answers
40 views

how to use tcpdump on interface with link down

A set of daemon applications communicating over UDP broadcasts on the same machine give me trouble capturing their traffic. The network interface is eth0, it's configured to a static IP and there's no ...
0
votes
0answers
37 views

Two processes stuck on network communication

We have had hang on our Oracle extraction process very intermittantly. Nothing obvious from the Oracle side, and starting to think it is more network related. There are two Oracle processes ...
0
votes
1answer
56 views

tcpdump freezes and not capturing properly without internet connection

When I don't have any internet conncetion and I want to capture network between local computers, tcpdump acts like this: 1.I start tcpdump using following command: tcpdump -ixenbr0 2.After I run ...
-1
votes
1answer
42 views

How i can dump raw packets from an existing tcp socket using tcpdump on Mac and Linux? [closed]

Once I know the IP address and port number combo, I can run this to see some of the packets: tcpdump | grep [IPADDRESS] Anybody know how I can now see the raw packets too? Thanks!
1
vote
0answers
26 views

Unusual Behavior with NIC Interrupt Moderation Disabled

OS: Centos7 I disabled interrupt moderation, ethtool -C eno2 rx-usecs 0, and then started capturing on that interface using tcpdump. The dump file was growing as expected. Maybe an hour later the ...
-1
votes
1answer
77 views

Why is wireshark capturing packets not destined to my host? [closed]

My IP was configured as 192.168.101.91, I don't understand why my host is receiving packets which have a destination address of 192.168.87.203(and many other IPs which I didn't capture) given that I ...
9
votes
1answer
173 views

SynProxy can not return syn ack packets with asymmetric dual bridge topology

I have a asymmetric dual bridge topology as shown below when i connect from 172.16.11.5 and 172.16.10.6 with ssh but i can not connect because of SynProxy. ------- ...
1
vote
1answer
102 views

Tcpdump/Iptables on bridge interface without assigned IP address

I have set up a bridge interface without an ip on it. $ brctl addbr br0 $ brctl addif tap0 $ brctl addif tap1 $ ifconfig br0 up As seen above, this bridge is connecting 2 TAP interfaces setup ...
2
votes
0answers
88 views

Wireshark only capturing broadcast packages [closed]

I've ran Wireshark multiple times on my notebook for wireless networks verifying mobile packages for my devices and it used to work most of the time. I haven't been able to monitor my traffic today ...
12
votes
4answers
338 views

tcpdump increases udp performance

I'm running a set of load tests to determine the performance of the following setup: Node.js test suite (client) --> StatsD (server) --> Graphite (server) In short, the node.js test suite ...
0
votes
0answers
182 views

Nginx TCP Fast Open Issue

I have configured Nginx and Apache on one of my servers. The nginx server listens on port 80 and Apache on port 81. Nginx works as a reverse proxy. In nginx I configured TCP Fast Open: server { ...
4
votes
4answers
136 views

Monitor and collect statistics on TCP connection to src or dst host

I would like to collect stats on TCP/UDP packets sent between two hosts (A and B). I am looking for a tool to install on A and B to get the following information: kb/seconds packets/seconds ...
2
votes
1answer
836 views

Filtering GRE enacpsulated packets with tcpdump

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre: 15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > ...
0
votes
1answer
33 views

tcpdump capture destined to other server

I´d like to ask for help in understanding this tcpdump capture. Tcpdump is running on server 10.13.255.27 and received the packet: root@server27 ~]# tcpdump -i eth0 dst host 10.13.255.26 and not src ...
1
vote
1answer
127 views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
2
votes
1answer
103 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ ...
0
votes
0answers
51 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...
0
votes
1answer
136 views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
0
votes
1answer
116 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
0
votes
3answers
114 views

how to use tcpdump to log only certain data in real time

I'd like to monitor network interfaces but only log things likes errors, collisions and dropped packets. The send that to stdout. – Can tcpdump be configured to do this?
1
vote
2answers
174 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip ...
0
votes
0answers
81 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
1answer
317 views

Capturing LDAPS traffic with tcpdump

I have an app server that authenticates against Active Directory using LDAPS. I am connecting to the AD server over port 636. I'm trying to troubleshoot/debug some performance issues and am beginning ...
0
votes
0answers
88 views

Analyzing TCPDUMP results for failed request

I'm making http POST calls to a database every 30 seconds, both the server and database are on the same host. Every 5 minutes or so, I get an error back from the endpoint indicating that the request ...
0
votes
1answer
160 views

How to trace TIME_WAIT sessions using tcpdump (or similar tool)

I have a server with large number of TIME_WAIT sessions. These are sessions that the server closed, but the client didn't close. I want to analyze a sample session, to understand what happens there. ...
2
votes
5answers
743 views

Determine originating process for outbound traffic

I can see that my server is sending out a lot of traffic. If I go to netstat -apln | grep httpd I can see that all the traffic is going to one IP. Is there a way I can see what script / file is ...
3
votes
1answer
158 views

Tcpdump maximum split file size

I refer to this thread : how to split a pcap file into a set of smaller ones I have tried to use the command tcpdump -r old_file -w new_files -C 4096 and tcpdump returns tcpdump: invalid file size ...
0
votes
1answer
326 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
3
votes
2answers
442 views

tcpdump truncates to 1472 bytes useful data in UDP packets during the capture

I am writing an application which work with network. To perform some tests I need to reproduce the flow which I had a day before. But at the same time it is not allowed to stop the current working ...
1
vote
0answers
1k views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
7
votes
2answers
2k views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
0
votes
0answers
100 views

multicast packets: when are they received with the receivers ip and when with a multicast ip

I am trying to connect 2 computers running jack for audio re-routing. Jack communicates through multicast packets on address 225.3.19.154 (port 19000) by default. I have successfully connected linux ...
1
vote
0answers
45 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null ...
0
votes
1answer
123 views

Tcpdump advanced filters

i want ask for command can Get only the IPs have more then 1 connection with different source port xxx.xxx.xxx.xxx:X | xxx.xxx.xxx.xxx:Y (example) if IP1 has connection to server with Src Port X ...
-1
votes
1answer
108 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
0
votes
1answer
204 views

What can possibly prevent tcpdump from showing request packets?

I am trying to debug a little SOAP issue. I am using a java web app to consume an API over a VPN. ping and telnet on the webservice server are fine.The Environment is aws ec2 for my app. I have no ...
0
votes
0answers
98 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
7
votes
2answers
856 views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
0
votes
0answers
175 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
0
votes
0answers
284 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...