-2
votes
1answer
599 views

What does tcpdump “BOOTP/DHCP, Request from …” mean?

I am seeing extreme amount of network traffic on a host despite it should be idle. When I do tcpdump -nni eth0 not net 10.10.10.10/32 I get lots of these 14:36:07.851048 IP 0.0.0.0.68 > ...
1
vote
2answers
62 views

Is it possible to capture transfered file to my apache server using tcpdump

I have web app installed on apache server(port 80, no ssl). This apps job is to gather some information via transferred from clients files. My goal is to check if my clients are sending proper files. ...
0
votes
2answers
232 views

How to diagnose large number of TIME_WAIT connections

We have a production issue with only one of our servers and have correlated slow performance to an abundance of sockets in the TIME_WAIT state. Without drawing this question into a huge backstory, we ...
3
votes
2answers
955 views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
0
votes
1answer
358 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
1answer
328 views

Can't see traffic in my guest OS with tcpdump

I've created a virtual machine (Centos 6.0) using QEMU/KVM, which is also running on a Centos 6.0. The virtual machine is configured to have two NICs. The first NIC is using a bridged network (eth0 of ...
1
vote
2answers
887 views

PPTP traffic logging

I am running pptpd on a Centos 5 machine but I didnt set up any logging. In case of an abuse, I need to determine which of my users did the bad things, meaning I need to log all the traffic. I may ...
0
votes
2answers
657 views

looking for multicast traffic

We have a j2ee webapp on tomcat which is using ehcache with multicast discovery. Except it's not discovering anything. There appears to to be no multicast traffic visible on the network but we're a ...
0
votes
2answers
1k views

Connecting to Samba share over the internet

I have been trying to connect a Linux box to a remote Samba share, with no success. The Samba share is a NAS, mapped to be accessible from the Internet, and to be used as a secondary backup box. The ...
0
votes
3answers
2k views

tcpdump syntax for only capturing traffic coming to a specific virtual interface / local IP

CentOS 5.x Hello All, I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow ...