tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
0answers
10 views

tcpdump - shows VLAN tag, but filtering doesn't work?

I'm running tcpdump on a mirrored port and when I use a simple tcpdump command it shows the VLAN id: tcpdump -i eth1 -n -e 22:02:53.308715 78:31:c1:c6:c8:9e (oui Unknown) > Broadcast, ethertype ...
0
votes
0answers
15 views

Two identical SYN packets sent to two different ips when connecting to port 80 on my VPS

I can't connect to my VPS (IP = V) from my home machine (IP = H); I can connect easilly from other IPs (office for example); Here is what I see when I do a TCPdump: 14:45:54.686642 IP H.49558 > V....
0
votes
0answers
10 views

Capturing HTTP requests for JMeter Raw Data Source

I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
-1
votes
1answer
47 views

How to dump VXLAN/VLAN ID in packet capture? [closed]

Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
0
votes
1answer
59 views

How to figure out why my NAT-box sends TCP RST packets?

TL;DR: I see that an ubuntu (which I have an absolute control of) host sends a packet under certain circumstances. How to find the application/kernel module responsible for that packet? I am ...
1
vote
1answer
135 views

icmp ping reply not received by ping process, seen by tcpdump/wireshark

I'm having an issue with getting the actual ping process to receive the reply even though I can clearly see the response in the tcpdump output. I'm running on: Mac OS X 10.11.4 El Capitan Bridge ...
2
votes
1answer
35 views

tcpdump - prevent interpreting/decoding protocols

Is there a way to stop tcpdump from (mis)interpreting protocols in captured packets? It assumes that traffic coming from port 4500/udp is always IPSec traffic, 53/udp is DNS query, etc and tries to ...
0
votes
0answers
56 views

“No route to host” when i do a telnet in azure

I have two VM's in azure with different public IP's and whose private IP's are : 10.10.1.9 10.10.1.6 When i do a telnet with following command from the server 10.10.1.6, i get the a error: telnet ...
0
votes
0answers
27 views

Large payload - connection get's Hung with CLOSE_WAIT or LAST_ACK state

We have a webservice client which posts data to a 3rd party Webservice. We are having an issue when the payload is a bit large (Around 600KB) xml. Once we pay the process hangs forever. The Netstat -...
0
votes
2answers
42 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
-1
votes
2answers
87 views

How does TCP offload NIC cause the TCP checksum to be invalid?

A tcpdump pcap exported and being investigated on another machine with wireshark is showing a lot of invalid TCP checksum messages. This is a known and documented phenomenon when using TCP offload ...
0
votes
1answer
52 views

Linux server failing to send SYN/ACK after receiving SYN remotely, works locally

Problem: A server process can be accessed by a device on the LAN or by the server itself, but it cannot be accessed outside the LAN (port forwarding is configured correctly as the server does receive ...
0
votes
2answers
39 views

Count number of incoming connection on a port - Linux

We have a server which listens on port X. The server has a large number of clients, from time to time the process gets hung, I am seeing SYN flooding messages in the log. I have been trying to tune ...
1
vote
2answers
55 views

How do I see absolute time stamps in Wireshark?

There is an example of pcap file opened in wireshark The second column is time. Is it possible to see absolute timestamps here instead of relative?
0
votes
1answer
24 views

Is it possible to specify tcpdump that I want it to interpret packet differently before printing it to STDOUT?

I am using iperf to pinpoint packet reordering issue. Unfortunately, tcpdump does not know how to parse iperf's UDP payload that I could use to pinpoint the issue. I know that iperf stores packet ...
0
votes
1answer
46 views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
1
vote
2answers
27 views

tcpdump http containing non expected payload bytes

I am monitoring an openvpn link with tcpdump a la tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n There is http/xml traffic going over that link which is basically caputered just fine. However, ...
0
votes
1answer
37 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
1
vote
1answer
119 views

Use tcpdump to capture an ICMP destination unreachable message

I am new in this area. I am asked to use tcpdump to capture an ICMP destination unreachable message in my network course. So I am trying to capture one message that is an ICMP destination unreachable ...
0
votes
0answers
49 views

NATted host cannot talk to itself unless virbr0 is in promiscuous mode

We have the following situation: A hypervisor using KVM-Qemu/libvirt with a single VM. The VM has the internal IP 192.168.122.151 on the default network pool using virbr0 on the hypervisor. We've ...
0
votes
1answer
28 views

tcpdump - filter applies after some time?

I have a strange problem with tcpdump - it's like the filter I want to be applied to captured packets doesn't work instantly. Maybe it's perfectly normal but to be honest I've never seen this before. ...
0
votes
0answers
52 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
2answers
29 views

Ubuntu server - packets from different networks not coming through (flushed iptables)

I have set up a brand new Ubuntu server, and I'm encountering a very strange network related issue - the processes running on the server cannot 'see' packets originating from external networks, but ...
1
vote
0answers
41 views

Duplicate SYN package forwarded by Docker?

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
0
votes
1answer
194 views

Server send TCP ACK with wrong number after receiving SYN

I have a client establish new TCP connection then sends request to a server per second. Both client and server are on the same linux box (via loopback interface). The client periodically reports ...
0
votes
2answers
36 views

Monitor networking between two interfaces

I need to monitor TCP networking between two hosts which does not have tcpdump installed, and I cannot install on them. Is it possible to do so with tcpdump using some known rule ?
3
votes
0answers
94 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
3
votes
2answers
5k views

TCP Messages Merged?

I have an application that sends 100 of 186-byte (excluding headers) TCP messages back to back without gap from host A to host B. I ran tcpdump to capture the packets on host A (where the sender is), ...
1
vote
2answers
56 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
133 views

tcpdump on bridge interface (virbr) does not receive any packets destined for one of its addresses

Here's the configuration for the interface: # ifconfig virbr0 virbr0: flags=4355 mtu 1500 inet 192.168.11.1 netmask 255.255.255.255 broadcast 255.255.255.255 ether 52:54:00:99:e3:...
1
vote
1answer
77 views

How can tcpdump monitor TCP disconnect and log timedate stamp?

I have two servers each running a Java application that creates two separate TCP connections, one from HostA -> HostB and one from HostB -> HostA on separate ports. I am told the TCP connection is ...
0
votes
0answers
34 views

How does TCP PSH and HTTPS works?

Right now I monitor traffic on my VPN server. I'm using tcpdump for it and it works pretty good. sudo tcpdump -n host SENDER_IP In this example you can see one HTTPS request from SENDER_IP to ...
1
vote
0answers
49 views

Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic

We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
0
votes
0answers
26 views

Not getting TCP Update Window packet after TCP Zero Window begins

Once I get TCP Zero Window during data transmission, I can't send data anymore in that desktop sharing session. Even I stopped the data sending to check if it can resume but no benefit! In my test ...
1
vote
1answer
252 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I don'...
2
votes
2answers
76 views

wget only works when tcpdump is listening

I am running two Virtual Machines over the XEN hypervisor both with Ubuntu trusty (Linaro-Developer version) with the following simple bridge networking setup: Backend domain (dom0): br0 ...
0
votes
0answers
79 views

“Filtered” port when accessing server

I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines. I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
1
vote
1answer
122 views

On-the-fly decoding HTTP bodies on Linux?

My wish is to monitor HTTP exchanges between my server and a browser. At present time, I use the localhost because I'm developping the app. I installed and used tcpflow and found it quite useful but ...
-1
votes
1answer
27 views

What does “-tnn” mean in “tcpdump -i eth0 -tnn dst port 80 -c 1000”

What does -tnn mean in tcpdump -i eth0 -tnn dst port 80 -c 1000. I didn't find -tnn on the man page, and I didn't find it on the Internet. Can anyone explain it to me?
1
vote
0answers
51 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
1
vote
0answers
95 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
4
votes
1answer
207 views

Finding google unusual traffic

We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
0
votes
0answers
383 views

Sometimes unable to tune Linux TCP stack for improved high-latency performance

I have been unsuccessfully trying to apply the TCP Tuning techniques discussed at http://fasterdata.es.net/host-tuning/ As you'll see when you read through the entire question, sometimes the es.net ...
0
votes
0answers
57 views

pfsend does not send a pcap file at specified rate

I'm replaying traffic using pfsend application that comes from PF_RING. I'm using SMIA pcap file to evaluate Bro and Snort on a multi-core machine. Using pfsend, we can specify at which rate the pcap ...
3
votes
3answers
811 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
0
votes
0answers
59 views

OOM Killer when tcpdump is run in system with low memory

I am working on an embedded system with limited memory. Here is the dump from my vmstat: procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu----- r b swpd free buff ...
1
vote
1answer
98 views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
101 views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
1
vote
1answer
441 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...