tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

1
vote
1answer
35 views

Tcpdump/Iptables on bridge interface without assigned IP address

I have set up a bridge interface without an ip on it. $ brctl addbr br0 $ brctl addif tap0 $ brctl addif tap1 $ ifconfig br0 up As seen above, this bridge is connecting 2 TAP interfaces setup ...
2
votes
0answers
28 views

Wireshark only capturing broadcast packages [closed]

I've ran Wireshark multiple times on my notebook for wireless networks verifying mobile packages for my devices and it used to work most of the time. I haven't been able to monitor my traffic today ...
12
votes
4answers
236 views

tcpdump increases udp performance

I'm running a set of load tests to determine the performance of the following setup: Node.js test suite (client) --> StatsD (server) --> Graphite (server) In short, the node.js test suite ...
0
votes
0answers
50 views

Nginx TCP Fast Open Issue

I have configured Nginx and Apache on one of my servers. The nginx server listens on port 80 and Apache on port 81. Nginx works as a reverse proxy. In nginx I configured TCP Fast Open: server { ...
4
votes
4answers
77 views

Monitor and collect statistics on TCP connection to src or dst host

I would like to collect stats on TCP/UDP packets sent between two hosts (A and B). I am looking for a tool to install on A and B to get the following information: kb/seconds packets/seconds ...
0
votes
0answers
46 views

Filtering GRE enacpsulated packets with tcpdump

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre: 15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > ...
0
votes
1answer
24 views

tcpdump capture destined to other server

I´d like to ask for help in understanding this tcpdump capture. Tcpdump is running on server 10.13.255.27 and received the packet: root@server27 ~]# tcpdump -i eth0 dst host 10.13.255.26 and not src ...
1
vote
1answer
43 views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
2
votes
1answer
76 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ ...
0
votes
0answers
37 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...
0
votes
1answer
76 views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
0
votes
1answer
62 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
0
votes
3answers
72 views

how to use tcpdump to log only certain data in real time

I'd like to monitor network interfaces but only log things likes errors, collisions and dropped packets. The send that to stdout. – Can tcpdump be configured to do this?
1
vote
2answers
83 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip ...
0
votes
0answers
58 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
1answer
99 views

Capturing LDAPS traffic with tcpdump

I have an app server that authenticates against Active Directory using LDAPS. I am connecting to the AD server over port 636. I'm trying to troubleshoot/debug some performance issues and am beginning ...
0
votes
0answers
62 views

Analyzing TCPDUMP results for failed request

I'm making http POST calls to a database every 30 seconds, both the server and database are on the same host. Every 5 minutes or so, I get an error back from the endpoint indicating that the request ...
0
votes
1answer
105 views

How to trace TIME_WAIT sessions using tcpdump (or similar tool)

I have a server with large number of TIME_WAIT sessions. These are sessions that the server closed, but the client didn't close. I want to analyze a sample session, to understand what happens there. ...
2
votes
5answers
397 views

Determine originating process for outbound traffic

I can see that my server is sending out a lot of traffic. If I go to netstat -apln | grep httpd I can see that all the traffic is going to one IP. Is there a way I can see what script / file is ...
3
votes
1answer
96 views

Tcpdump maximum split file size

I refer to this thread : how to split a pcap file into a set of smaller ones I have tried to use the command tcpdump -r old_file -w new_files -C 4096 and tcpdump returns tcpdump: invalid file size ...
0
votes
1answer
221 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
3
votes
2answers
344 views

tcpdump truncates to 1472 bytes useful data in UDP packets during the capture

I am writing an application which work with network. To perform some tests I need to reproduce the flow which I had a day before. But at the same time it is not allowed to stop the current working ...
1
vote
0answers
693 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
7
votes
2answers
2k views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
0
votes
0answers
69 views

multicast packets: when are they received with the receivers ip and when with a multicast ip

I am trying to connect 2 computers running jack for audio re-routing. Jack communicates through multicast packets on address 225.3.19.154 (port 19000) by default. I have successfully connected linux ...
1
vote
0answers
34 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null ...
0
votes
1answer
100 views

Tcpdump advanced filters

i want ask for command can Get only the IPs have more then 1 connection with different source port xxx.xxx.xxx.xxx:X | xxx.xxx.xxx.xxx:Y (example) if IP1 has connection to server with Src Port X ...
-1
votes
1answer
77 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
0
votes
1answer
113 views

What can possibly prevent tcpdump from showing request packets?

I am trying to debug a little SOAP issue. I am using a java web app to consume an API over a VPN. ping and telnet on the webservice server are fine.The Environment is aws ec2 for my app. I have no ...
0
votes
0answers
78 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
8
votes
2answers
529 views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
0
votes
0answers
90 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
0
votes
0answers
209 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...
0
votes
1answer
109 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
3
votes
1answer
70 views

tcpdump: decode packet starting at non-zero offset

I'm debugging a Linux embedded platform which has an interface where regular ethernet frames have an additional 82-octet platform header tacked on the front. I am able to sniff from this interface ...
2
votes
1answer
303 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
1
vote
2answers
121 views

TCP packet which is absent in strace log

Can somebody give me ideas about following situation (Linux 2.6.18-348.4.1.el5 ): At some point tcpdump shows [FIN, ACK] packet sent from server port to local client strace log shows no socket ...
4
votes
1answer
307 views

Making TCP dump without packets loss

How to make a TCP dump where it is guaranteed that all the packets that really pass through the network are captured, and nothing is missed? Details: We have an issue with 3rd party vendor who ...
0
votes
0answers
76 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
0
votes
1answer
116 views

weird bridge issue in KVM

on Centos 6.5 i have a bridge network connected to eth4 and my virtual machine (Centos6.5) running on KVM is also connected to that interface(vnet0) bridge name bridge id STP ...
0
votes
1answer
177 views

tcpdump show strange packet with incorrect src ip and dst ip

I have private LAN with > 100 servers, in which, I have 3 server: x.x.x.37: run memcache on port 11211 (called s37 for short) x.x.x.241: run an application server, which connect to memcache on ...
0
votes
2answers
177 views

How to decode custom port on tcpdump? [closed]

How do we capture/read pcap with option decode a custom port with tcpdump? For example 81 as http port.
-5
votes
1answer
331 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
4
votes
4answers
628 views

One second delay before tcpdump returns packets

Using Ubuntu, I'm trying to sync tcpdump sniffing with self-identifying "pings" from a client device. The problem is that getting precise starts and stops is made difficult by what looks like a ...
1
vote
1answer
486 views

tcpdump filter sequence number

I have captured a packet trace and would like to write a script that will allow me to isolate a matching pair of acknowledgement and Sequence packets(no other way to filter out all the other packets) ...
1
vote
3answers
909 views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
1
vote
0answers
198 views

Massively large number of packets dropped by interface

I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g. 4 packets captured 402 packets ...
1
vote
0answers
71 views

tcpdump expression to show zero-byte ACKs?

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding ...
1
vote
1answer
57 views

Viewing the packet-size of an incoming IP

I have been looking for a sulution to this for a few hours. after no avail im asking for help here. I need to watch my incoming packets by Size. in a format similar to: IP SIZE I have tried ...
0
votes
1answer
136 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...