1
vote
3answers
221 views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
0
votes
0answers
24 views

tcpdump, display the data section

i am trying to display only the data section of an udp packet using tcpdump. In some other words, is it any way to filter the header section of the udp package? The below command sudo tcpdump ...
4
votes
1answer
129 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
2
votes
3answers
220 views

identifying vlan packets using tcpdump

I'm trying to figure out the vlan tagged packets that my host receives or sends to other hosts. I tried tcpdump -i eth1 vlan 0x0070 But it didnt work. Has anyone tried to view the vlan ...
0
votes
1answer
172 views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
-2
votes
1answer
297 views

What does tcpdump “BOOTP/DHCP, Request from …” mean?

I am seeing extreme amount of network traffic on a host despite it should be idle. When I do tcpdump -nni eth0 not net 10.10.10.10/32 I get lots of these 14:36:07.851048 IP 0.0.0.0.68 > ...
0
votes
1answer
246 views

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
1
vote
2answers
59 views

Is it possible to capture transfered file to my apache server using tcpdump

I have web app installed on apache server(port 80, no ssl). This apps job is to gather some information via transferred from clients files. My goal is to check if my clients are sending proper files. ...
0
votes
1answer
40 views

Check if traffic is gzipped

I have an application server running on port 80. How can I check if the incoming and outgoing traffic is gzipped? Also, the application communicates with another server (also HTTP requests). I'd like ...
5
votes
1answer
196 views

How can I filter MongoDB Replica Set Heartbeats with tcpdump?

Occasionally, when troubleshooting the health of a replica set, I'd like to filter out the heartbeat packets specifically, track them going out, and the subsequent reply (or lack thereof) without all ...
1
vote
1answer
1k views

tcpdump capturing tcp resets by host

I am trying to figure out where my tcp resets on my webserver happen. I have the following capture: tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0' When I look at the ...
0
votes
2answers
1k views

Fragmentation and packet size,using tcpdump

i am trying to understand concept of fragmentation: i have two virtual machines with public ip connected to a switch. tracepath shows packet not going through gateway from vm1: Trying to send ...
0
votes
0answers
263 views

PPTP refusing to connect when client is windows

I have a PPTP server running and I can connect to it from linux. When I try from windows 7 (2 instances tested) it fails. Here's the syslog for such a conn: pptpd[540]: CTRL: Client 109.xxx.158.201 ...
1
vote
2answers
719 views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
0
votes
0answers
204 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
2
votes
2answers
121 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2answers
385 views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
1
vote
1answer
45 views

How to diagnose why a port is broadcasting a “ZeroWindow” status

I have two CentOS servers (one is an app server, the other is a DB) communicating over a port. Every once in a while, the application server starts broadcasting that the port connected to the DB has a ...
3
votes
1answer
199 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
-4
votes
1answer
62 views

how to use tcpdump to capture packets with “ACK” flag set [closed]

I want to capture packets with ACK flag set using tcpdump including SYN/ACK, data packet and ACK packets thanks
0
votes
2answers
174 views

How to diagnose large number of TIME_WAIT connections

We have a production issue with only one of our servers and have correlated slow performance to an abundance of sockets in the TIME_WAIT state. Without drawing this question into a huge backstory, we ...
3
votes
2answers
625 views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
2
votes
1answer
34 views

Network interface reading traffic from 2 different hosts

Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this ...
0
votes
1answer
166 views

tell tcpdump to not include the port numbers in the output

how can tell tcpdump to not include the port numbers in the output? Right now it includes the resolved IP + resolved port. I just need the resolved IP address (hostnames)
3
votes
1answer
126 views

Why isn't 'ether proto \ip host host' a legal tcpdump expression?

In its description of valid tcpdump expressions, the pcap-filter man pages state: The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) ...
5
votes
2answers
3k views

Lots of dropped packages when tcpdumping on busy interface

My challenge I need to do tcpdumping of a lot of data - actually from 2 interfaces left in promiscuous mode that are able to see a lot of traffic. To sum it up Log all traffic in promiscuous mode ...
1
vote
1answer
144 views

Capture network traffic simultaneously on three interfaces

I need to capture traffic on a CentOS 5 server which acts as a web proxy with 2 wan interfaces and 1 LAN. In order to troubleshoot a weird proxy problem, I would like to have a capture of a full ...
0
votes
1answer
3k views

PPPoE Connection : “Generic-Error ”RP-PPPoE: Child pppd process terminated"

I have 2 Ubuntu 64-bit Virtual Machines installed on Virtual Box.Their name and ip addresses are given below.I am trying to establish PPPoE connection between the two machines. nas ...
1
vote
1answer
156 views

Validate send packet against recived packets?

Running Ubuntu. I have machine A -> machine B (one-way connection from A to B) . Machine A goal is to forward tcp packets to machine B (it dosnt has tcp connection with machine B. it just forward tcp ...
7
votes
2answers
1k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
3
votes
2answers
852 views

Cheap way to detect client round trip times for http

I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this? There are far to many connections, and pinging each ip is ...
3
votes
3answers
1k views

TCP segments of an HTTP Request in wrong order

My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...
3
votes
6answers
2k views

Log tcpdump Output

What I basically want is to to write all tcpdump captured packets to a file every 3 days. So basically tcpdump should run for 24 hours on day 1 and write the output to Day1.log and similar for Day2 ...
8
votes
3answers
4k views

Why won't tcpdump write a pcap file?

In the process of debugging a python irc bot that can't seem to connect, I thought "I know, I'll just tcpdump it and see what it's doing." So I ran tcpdump like I usually do and it says it's captured ...
2
votes
2answers
3k views

how to calculate packet loss from a binary TCPDUMP file

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not) It must be some kind of packet loss, because from ...
-1
votes
1answer
148 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
1
vote
1answer
105 views

I'm being asked to support mapping many SSL keys to one IP but I think it's a bad idea. Am I wrong?

At work, I've been asked to add support for mapping multiple keys to a single (or many even) IP to what is essentially a passive HTTP sniffer. It supports SSL decryption with user-uploaded keys. ...
0
votes
1answer
75 views

How to save the packets received by a network interface or some port in a file and resend the packets received when needed?

I am doing my work on a server service program on Linux that processes the packets sent to the socket it listens.Their is already a old such service listening on the port doing its job,and I can't ...
1
vote
1answer
157 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
3
votes
1answer
331 views

Incoming packets to server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
0
votes
1answer
252 views

iptables logging packets coming from the outside world

I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this: tcpdump "(dst net 192.168.0.0/24 ...
1
vote
1answer
100 views

Network flooded with ARP requests

I am having networking problems on a virtual Debian server. The VPS provider I think may be the cause of these network problems as it's a fairly new/fairly standard Debian install. However, as their ...
4
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
0
votes
2answers
292 views

What is a RP Paket in a tcpdump log?

I have a tcpdump log with the following entry: 14:53:31.428570 IP 10.4.65.65.16666 > 192.168.201.10.80: RP 587:687(100) ack 48545454154 win 0 My Problem is that i have never seen an RP paket ...
2
votes
2answers
2k views

What program sent which packet to the network [duplicate]

I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you ...
1
vote
3answers
262 views

How to collect concise traffic statistics on linux?

I need to have statistics divided by time periods, like this: time_1 - time_1 + 5mins from_ip1 > to_ip2 total_packages_size1 from_ip3 > to_ip4 total_packages_size2 time_1 + 5mins - time_1 + ...
1
vote
3answers
511 views

Dropped packets in Linux

I'am using a machine as a router, it works sort of fine, however if I do a ping -t whatever.server it will always cause a 3-4% package loss, no matter what server. Looking at ifconfig or netstat -i ...
1
vote
2answers
1k views

TCPDUMP = How to detect and analyse “Suspicious” Traffic to 192.xxx Addresses?

I just played a little bit with tcpdump (as I wanted to check why my mails are not getting send) and thereby discovered very strange and a lot of traffic to the "Private IPs". Please See examples ...
1
vote
2answers
2k views

How can I capture traffic with tcpdump and a sliding window or sort of “logrotate”?

I want to capture some traffic with tcpdump for troubleshooting. The problem is, the error is not reproducible. To not fill up the hole disks with captures, I would like to capture the traffic with ...
0
votes
2answers
539 views

Howto monitor traffic between IIS and MSSQL

I am trying to check how much traffic is flowing between MSSQL Server and IIS Server in different locations. There is 1 ipcop in every location and I download the tcpdump file from one firewall and ...