tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
1answer
412 views

Routing traffic through a virtual machine [closed]

I have OpenWRT running in a virtual machine. It's network adapter is bridged to the host. Host ifconfig root@michael-VirtualBox:/home/michael/Scripts/python# ifconfig eth0 Link encap:Ethernet ...
3
votes
3answers
190 views

Recording network traffic on one linux box, transferring it to another in real time

I have a situation where I want to capture all of the network traffic on one Linux box (currently using tcpdump) but have that data transferred in real time to another Linux on a separate (but ...
1
vote
2answers
1k views

Tap0 not receiving traffic

I have created a tap device tap0 address 10.2.1.4 and added it to a host bridge br1 with address 10.2.1.1 I have "nc 10.2.1.4 -l 1234" running on the host and from another machine I do a "nc ...
0
votes
1answer
637 views

Random TCP Resets

We got randomly TCP "reset" error when we send request to remote server. Log from remote server Cisco TCP Connection Terminated,Nov 05 14:43:39 EST: %ASA-session-6-302014: Teardown TCP connection ...
0
votes
0answers
241 views

Tcpdump stops capturing wifi data while running in the background

I have a problem capturing wifi data using tcpdump while running in the background. OK, lets get some facts: my wifi-device is named wlan0 wlan0 is in monitor mode (that's what I want) I'm using ...
0
votes
1answer
276 views

pretty-printing IP packets [closed]

I'm receiving IP packets using the SLIP protocol, and I'd like to pretty-print them similarly to how tcpdump does it. My program is able to decode the SLIP protocol and create a single string ...
1
vote
1answer
219 views

tcpdump on a capture card

I have a server with a NT20E Capture Card (2x10Gb Packet Capture Card over PCI Express). I want to be able to dump the output to a pcap format but because this isn't listed as an ethX-interface ...
0
votes
1answer
18 views

Is there a way to explicitly set the maximum number of packets tcpdump will capture before terminating?

We have a small script that essentially does the following: A) Capture packets using tcpdump and pipe to output file. B) Run our own clean + sort script on output file. C) Display results using | ...
-1
votes
1answer
1k views

What does tcpdump “BOOTP/DHCP, Request from …” mean?

I am seeing extreme amount of network traffic on a host despite it should be idle. When I do tcpdump -nni eth0 not net 10.10.10.10/32 I get lots of these 14:36:07.851048 IP 0.0.0.0.68 > ...
0
votes
1answer
4k views

Limit tcpdump capture files by time and size

I am having some problems getting tcpdump to log all internet traffic on an interface with the following limitations: I would like a new pcap file every hour with time and date tag in the name If ...
0
votes
1answer
652 views

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
1
vote
2answers
69 views

Is it possible to capture transfered file to my apache server using tcpdump

I have web app installed on apache server(port 80, no ssl). This apps job is to gather some information via transferred from clients files. My goal is to check if my clients are sending proper files. ...
0
votes
1answer
374 views

How to install tcpdump on Cloud Linux

I am new on Linux, and I own a server with Cloud Linux installed. What I like to do is to install the tcpdump but I cannot. I have try to execute the following command from SSH: yum install ...
0
votes
1answer
1k views

Login my Linux with root ,executing command sshd、tcpdump failed

root# /usr/sbin/sshd Privilege separation user sshd does not exist root# tcpdump -i eth0 udp tcpdump : Couldn't find user 'tcpdump' but the users tcpdump and sshd are in the files ...
0
votes
2answers
2k views

Using tcpdump with iptables?

I use iptables to block different kind of attacks on my server. We have a different set of rules along with different rate-limit rules. Now I also use a script that would observe the threshold if it ...
1
vote
0answers
170 views

Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”

I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets. The CPU is a freaking i7, and i have yet to see CPU usage go above ...
0
votes
1answer
312 views

How can I dump nginx requests for a specific location while nginx is secured?

I want to dump all request that nginx is getting for a specific location so I can debug a strange problem that I have. Usually tcpdump would be the solution but remember that nginx is accessed using ...
1
vote
1answer
254 views

Why does OS X spend one more packet to establish and close a TCP connection?

Linux spends 3 packets to establish a TCP connection and 3 packets to close it, as shown by the tcpdump capture # establishing TCP connection 22:37:09.150456 IP 127.0.0.1.49327 > 127.0.0.1.8000: ...
0
votes
1answer
52 views

Check if traffic is gzipped

I have an application server running on port 80. How can I check if the incoming and outgoing traffic is gzipped? Also, the application communicates with another server (also HTTP requests). I'd like ...
0
votes
0answers
203 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
5
votes
1answer
430 views

How can I filter MongoDB Replica Set Heartbeats with tcpdump?

Occasionally, when troubleshooting the health of a replica set, I'd like to filter out the heartbeat packets specifically, track them going out, and the subsequent reply (or lack thereof) without all ...
0
votes
1answer
3k views

tcpdump - how to check rate of packets?

I'm using this script that actually checks for the rate of incoming packets and it gets triggered if the rate hits 5mbps or more. The packets are then logged to a tcpdump file. interface=eth0 ...
0
votes
2answers
169 views

How to run tcpdump on Centos right after reboot?

I see that my Amazon EC2 has a lot of traffic coming inbound after I reboot my Linux machine. I would like to find out what is going on right after the servers comes back after reboot. I thought ...
0
votes
1answer
76 views

missing network usage through iptables

I inserted a rule to iptables to track the input usage to a certain ip address. The vps server's IP is 192.168.1.5 and the guest os's IP is 192.168.1.115. I ran 'yum update' inside the guest OS to get ...
1
vote
1answer
892 views

How to parse OpenFlow packets using tcpdump capture file programmatically

I am working with OpenFlow packets and am analyzing the network via tcpdump. Currently, I use the WireShark GUI to parse the generated capture file and it does serve my need. However, I was ...
2
votes
1answer
4k views

tcpdump capturing tcp resets by host

I am trying to figure out where my tcp resets on my webserver happen. I have the following capture: tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0' When I look at the ...
3
votes
2answers
639 views

Packets only get forwarded when tcpdump running on bridge

I ran into the oddest thing when trying to debug a networking issue with OpenStack. I was doing a ping test between virtual machines. The ICMP request packets only made it to the destination host if I ...
0
votes
0answers
50 views

why tcpdump drop package for long running request?

I turn on tcpdump to capture requests going to my webserver. However, some of the requests are not captured by tcpdump but they showed up in apache access log. Those requests are usually long running ...
2
votes
1answer
2k views

Which are the possible reasons for an arp request that is not being solved/answered?

This weekend I was testing a new data link connection from a service provider, and I went through some address resolutions problems. I tested reachability to hosts at the far end using a laptop on my ...
3
votes
1answer
587 views

How to debug why WAN TCP/IP throughput is lower than expected?

I'm trying to figure out why tcp/ip throughput between two hosts I control is much lower than expected. Host A: internet connectivity provided by Comcast (Residential) in Boston Metro -- can ...
0
votes
2answers
4k views

Fragmentation and packet size,using tcpdump

i am trying to understand concept of fragmentation: i have two virtual machines with public ip connected to a switch. tracepath shows packet not going through gateway from vm1: Trying to send ...
0
votes
0answers
791 views

PPTP refusing to connect when client is windows

I have a PPTP server running and I can connect to it from linux. When I try from windows 7 (2 instances tested) it fails. Here's the syslog for such a conn: pptpd[540]: CTRL: Client 109.xxx.158.201 ...
1
vote
4answers
1k views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
0
votes
1answer
453 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
1
vote
1answer
370 views

openvpn (tun0 + bridge) : Comunication bridge --> tun0 works but not the opposite direction

My network is composed as follows: Host A with ip 9.x.x.x and vpn ip 192.15.206.x (openvpn client) Host B with ip 9.x.x.x and vpn ip 192.15.206.1 (openvpn server) this host has a bridge br0 with ip ...
2
votes
3answers
8k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
0
votes
1answer
354 views

How to debug SSH “connection timeout”

I'm getting error (sometimes) while connecting from host1 to host2 Errno::ETIMEDOUT: Connection timed out - connect(2) TCP dump on host1 while trying to connect (tcpdump -vv -i eth0 -s 0 'port 22 ...
1
vote
2answers
1k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
1
vote
4answers
562 views

Locally examine network traffic of remote machine

I have root access to my dd-wrt router at 192.168.0.1 and computer at 192.168.0.100. I need to get the traffic comming through the router(in the Internet and out) from some other ...
1
vote
1answer
2k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
0
votes
3answers
644 views

Monitor traffic between two network switches using a transparent firewall

For debugging reasons i need to see what network traffic especially TCP is transmitted or not. I thought about using an Endian firewall for this, but it doesn't support 2 network interfaces with the ...
0
votes
0answers
526 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
0
votes
1answer
164 views

Getting packet rate with tcpdump or iptables

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment. I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the ...
2
votes
2answers
189 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2answers
907 views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
1
vote
1answer
72 views

How to diagnose why a port is broadcasting a “ZeroWindow” status

I have two CentOS servers (one is an app server, the other is a DB) communicating over a port. Every once in a while, the application server starts broadcasting that the port connected to the DB has a ...
0
votes
2answers
207 views

Tcpdump packet-PID correspondence

So I've installed winpcap and use windump: E:\>windump -i 2 -B 5000 -n -s 0 -l -C 1 -W 10 -e -q -X windump: listening on \Device\NPF_{9718B3B1-6C96-4431-889B-2B1A37BED06E} 01:25:23.029278 ...
3
votes
1answer
274 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
-4
votes
1answer
108 views

how to use tcpdump to capture packets with “ACK” flag set [closed]

I want to capture packets with ACK flag set using tcpdump including SYN/ACK, data packet and ACK packets thanks
0
votes
2answers
308 views

How to diagnose large number of TIME_WAIT connections

We have a production issue with only one of our servers and have correlated slow performance to an abundance of sockets in the TIME_WAIT state. Without drawing this question into a huge backstory, we ...