Tagged Questions
0
votes
1answer
51 views
syn flood attack — packet hits on shared ip
How can I dump the TCP packets to get a better idea to know which website is being attacked?
Here is what I have in my logs:
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
0
votes
2answers
113 views
TCPDump and IPTables DROP by string
by using tcpdump -nlASX -s 0 -vvv port 80 I get something like:
14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480)
206.72.206.58.http > ...
-2
votes
2answers
81 views
Using tcpdump to find strings [closed]
I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server?
One I have the string ...
1
vote
1answer
20 views
How to diagnose why a port is broadcasting a “ZeroWindow” status
I have two CentOS servers (one is an app server, the other is a DB) communicating over a port. Every once in a while, the application server starts broadcasting that the port connected to the DB has a ...
3
votes
1answer
103 views
How to use a switch as a network tap?
I would like to tcpdump all traffic that my router does when it makes a firmware update.
So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8.
I have connected:
Internet ...
2
votes
2answers
118 views
How to use Linux to capture packets on eth0 and send everything to eth1?
Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware.
I would really like to ...
0
votes
0answers
61 views
iSCSI traffic not showing up in tcpdump
Last night we were able to run tcpdump -i eth0 -w iscsi on a RHEL6 box and get iSCSI traffic between the server and NAS. Today we get broadcast traffic only. Server config did not change - iscsi still ...
0
votes
1answer
60 views
TCPdump / DDoS with CF IPs
My nginx file
http {
set_real_ip_from 204.93.240.0/24;
set_real_ip_from 204.93.177.0/24;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
...
1
vote
5answers
295 views
tcpdump: out.pcap: Permission denied
[root@localhost ~]# cat /etc/issue
Fedora release 17 (Beefy Miracle)
Kernel \r on an \m (\l)
[root@localhost ~]# uname -a
Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC ...
0
votes
1answer
103 views
tell tcpdump to not include the port numbers in the output
how can tell tcpdump to not include the port numbers in the output? Right now it includes the resolved IP + resolved port. I just need the resolved IP address (hostnames)
3
votes
1answer
74 views
How do I get the network usage of a server per-IP?
I'd like to know a tool to programmatically measure, in KB/s, the load that each IP applies to a server.
So far, tcpdump does a good job at telling me the amount of packets sent per second, but I ...
2
votes
1answer
205 views
Using darkstat to monitor bandwidth — how to exclude my dynamically assigned IP address?
I am using darkstat to collect data about bandwidth usage on my local box. My internet connection is provided by a 3G USB stick, connecting to a mobile network. Each time I connect to the internet I ...
1
vote
1answer
36 views
How can I print only tcpsequence number with tcpdump
I search for a way to limit or change the output format of tcpdump to print only tcp sequnce number, but i didnt find a way to do this.
Can you please advice?
Running on Ubuntu.
If there is no way to ...
1
vote
2answers
698 views
How filter only keep-alive packet with tcpdump
I need to analyze a traffic-dump on my network to check if all the PCs have enabled tcp keep-live features.
I'm using tcpdump for that purpose.
What I need to know is if there is a possibility to ...
0
votes
1answer
254 views
find common string to block IPs
Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables?
Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
0answers
141 views
using tcpdump to display XML API requests without headers or ack packets
I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command:
tcpdump -iany -tpnAXs0 host xxx.xxx.xxx.xxx and ...
1
vote
1answer
116 views
How to Monitor Aborted Connections on Port 80 With tcpdump
Can I use tcpdump to detect Aborted connections on port 80 (Apache) originating from a specific IP (my remote IP). I can reproduce the Aborted connection in my web browser, but I have no way to verify ...
5
votes
2answers
887 views
Lots of dropped packages when tcpdumping on busy interface
My challenge
I need to do tcpdumping of a lot of data - actually from 2 interfaces left in promiscuous mode that are able to see a lot of traffic.
To sum it up
Log all traffic in promiscuous mode ...
0
votes
1answer
583 views
How can I make tcpdump stop the capture after a certain number of packets captured?
I am debugging a problem where two servers get stuck in a loop when communicates with each other. After a server restart the problem will start at some point, it can be in an hour
or in a day. I want ...
3
votes
2answers
430 views
Cheap way to detect client round trip times for http
I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this?
There are far to many connections, and pinging each ip is ...
5
votes
2answers
2k views
Clarification about Linux TCP window size and delays
I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
0
votes
1answer
339 views
tcpdump/Wireshark on restricted virtual server
When I try to dump some traffic on my vserver's network interface, I get an error that I'm not allowed to do that:
# tcpdump -p -i eth0
tcpdump: eth0: You don't have permission to capture on that ...
1
vote
1answer
123 views
PCAP to Syslog utility
I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time.
Example :
Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet
Feb 16 ...
1
vote
1answer
294 views
Tcpdump says “Illegal instruction”
Following the tutorial on http://www.waitingforthefuture.org/2009/12/25/compiling-tcpdump-for-tomato-firmware/, I tried to compile tcpdump. I did the compilation on an Intel Pentium 4 2.26Ghz computer ...
2
votes
1answer
2k views
multicast tcpdump and subscriptions
From the multicast howto:
IP_ADD_MEMBERSHIP.
Recall that you need to tell the kernel which multicast groups you are interested
in. If no process is interested in a group, packets destined to it that ...
4
votes
1answer
172 views
Can tcpdump tell accessed port numbers?
I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used.
Question
How do I get tcpdump to tell me the port numbers that is being accessed on eth1?
0
votes
1answer
67 views
How to save the packets received by a network interface or some port in a file and resend the packets received when needed?
I am doing my work on a server service program on Linux that processes the packets sent to the socket it listens.Their is already a old such service listening on the port doing its job,and
I can't ...
4
votes
1answer
417 views
How to reproduce http traffic of a real site in another environment (e.g. VM)
There is a bug in my web application which I cannot reproduce. All the logs look ok or at least I cannot see anything unusual. But it happens. So I thought I could record all the traffic to/from my ...
0
votes
2answers
287 views
tcpdump - just output the packet contents line by line
I'm trying to use tcpdump on the DEFCON packets.
Here's the command I'm using:
tcpdump -qns 0 -X -r ulogd.eth0.pcap
And here's the output I'm getting:
10:39:12.356410 IP 192.168.103.2.3101 > ...
1
vote
1answer
139 views
TCP stops sending weirdly
In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
2
votes
1answer
683 views
Daemon can't be started from fabric script or on boot - only interactively
I have a daemon script in /etc/init.d that performs some background packet logging using the tcpdump command. The script starts up fine using an interactive shell using sudo /etc/init.d/packetlog ...
0
votes
2answers
245 views
What is a RP Paket in a tcpdump log?
I have a tcpdump log with the following entry:
14:53:31.428570 IP 10.4.65.65.16666 > 192.168.201.10.80: RP 587:687(100) ack 48545454154 win 0
My Problem is that i have never seen an RP paket ...
3
votes
4answers
2k views
How to display interface in tcpdump output flow?
This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie:
# tcpdump -i any -n host ...
0
votes
2answers
324 views
Sniff packets using tcpdump
I have a completely noob question. I want to see all packets that come to my computer from particular site (google.com). So I start tcpdump
sudo tcpdump -i eth0 host google.com
and enter google.com ...
2
votes
2answers
1k views
What program sent which packet to the network [duplicate]
I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you ...
1
vote
3answers
243 views
How to collect concise traffic statistics on linux?
I need to have statistics divided by time periods, like this:
time_1 - time_1 + 5mins
from_ip1 > to_ip2 total_packages_size1
from_ip3 > to_ip4 total_packages_size2
time_1 + 5mins - time_1 + ...
1
vote
3answers
455 views
Dropped packets in Linux
I'am using a machine as a router, it works sort of fine, however if I do a ping -t whatever.server it will always cause a 3-4% package loss, no matter what server. Looking at ifconfig or netstat -i ...
5
votes
4answers
2k views
How do I make tcpdump not print the tcp headers?
I tried this:
tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'
I need only the ascii part of it. How do I remove the rest?
4
votes
1answer
464 views
tcpdump and congestion window
Sniffing http traffic to my (linux) server it seems like it always responds advertising a window size of 14. It isn't affected if I change the default initcwnd size (with ip route), and it doesn't ...
4
votes
1answer
2k views
What do “Unknown SSAP” and “Unknown DSAP” mean in tcpdump?
While trying to fix a problem with intermittently losing internet connection on a machine with a wireless connection to a router, I ran tcpdump and noticed packets with "Unknown SSAP" and "Unknown ...
4
votes
4answers
2k views
Monitor number of bytes transferred to/from IP address on port
Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port.
The equivalent tcpdump command would be:
tcpdump ...
2
votes
3answers
1k views
tcpdump filter according to http header content
using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache.
that means that i need to filter according to the ...
0
votes
3answers
1k views
tcpdump syntax for only capturing traffic coming to a specific virtual interface / local IP
CentOS 5.x
Hello All,
I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow ...
4
votes
2answers
633 views
Anyone can tell their experience with 10g Ethernet adapters on Linux
I wonder if any of you have an experience with 10g NICs (Intel, Myricom, SMC tiget, napatech, or by any other brand).
Questions are:
Was it easy to install, or a hassle,
How does this adapter ...
0
votes
3answers
915 views
How can I log all traffic with its exact length?
I want to process all packets with their size going through our gateway server (running Debian 4.0).
My idea is to use tcpdump, but I have two questions.
The command I'm currently thinking of is ...
2
votes
1answer
6k views
Unknown tcpdump packets
I was just doing tcpdump on a linux server connected directly to a provider, and about every second and a half there is a line like this:
00:19:49.926700 00:15:c6:::** (oui Unknown) > ...
