tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

1
vote
1answer
417 views

openvpn (tun0 + bridge) : Comunication bridge --> tun0 works but not the opposite direction

My network is composed as follows: Host A with ip 9.x.x.x and vpn ip 192.15.206.x (openvpn client) Host B with ip 9.x.x.x and vpn ip 192.15.206.1 (openvpn server) this host has a bridge br0 with ip ...
7
votes
3answers
13k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
0
votes
1answer
464 views

How to debug SSH “connection timeout”

I'm getting error (sometimes) while connecting from host1 to host2 Errno::ETIMEDOUT: Connection timed out - connect(2) TCP dump on host1 while trying to connect (tcpdump -vv -i eth0 -s 0 'port 22 ...
1
vote
2answers
2k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
1
vote
4answers
685 views

Locally examine network traffic of remote machine

I have root access to my dd-wrt router at 192.168.0.1 and computer at 192.168.0.100. I need to get the traffic comming through the router(in the Internet and out) from some other ...
2
votes
1answer
2k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
0
votes
3answers
781 views

Monitor traffic between two network switches using a transparent firewall

For debugging reasons i need to see what network traffic especially TCP is transmitted or not. I thought about using an Endian firewall for this, but it doesn't support 2 network interfaces with the ...
0
votes
0answers
694 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
0
votes
1answer
201 views

Getting packet rate with tcpdump or iptables

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment. I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the ...
2
votes
2answers
209 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2answers
1k views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
1
vote
1answer
91 views

How to diagnose why a port is broadcasting a “ZeroWindow” status

I have two CentOS servers (one is an app server, the other is a DB) communicating over a port. Every once in a while, the application server starts broadcasting that the port connected to the DB has a ...
0
votes
2answers
284 views

Tcpdump packet-PID correspondence

So I've installed winpcap and use windump: E:\>windump -i 2 -B 5000 -n -s 0 -l -C 1 -W 10 -e -q -X windump: listening on \Device\NPF_{9718B3B1-6C96-4431-889B-2B1A37BED06E} 01:25:23.029278 ...
3
votes
1answer
311 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
-4
votes
1answer
124 views

how to use tcpdump to capture packets with “ACK” flag set [closed]

I want to capture packets with ACK flag set using tcpdump including SYN/ACK, data packet and ACK packets thanks
0
votes
2answers
378 views

How to diagnose large number of TIME_WAIT connections

We have a production issue with only one of our servers and have correlated slow performance to an abundance of sockets in the TIME_WAIT state. Without drawing this question into a huge backstory, we ...
3
votes
2answers
2k views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
3
votes
1answer
1k views

tcpdump shows traffic until I use a filter

I have a server that is receiving traffic from a mirror port on a switch. The interface that is connected to this mirror port is in promisc mode. When I use just a plain catch all tcpdump on the ...
2
votes
1answer
38 views

Network interface reading traffic from 2 different hosts

Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this ...
0
votes
3answers
1k views

logging HTTP traffic with tcpdump on a router

I have a linux box acting as a router between many clients and the internet, and i need to pull some statistics on usage: I need to log which internal IPs access which addresses externally. I use ...
4
votes
6answers
5k views

tcpdump: out.pcap: Permission denied

[root@localhost ~]# cat /etc/issue Fedora release 17 (Beefy Miracle) Kernel \r on an \m (\l) [root@localhost ~]# uname -a Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC ...
0
votes
1answer
277 views

tell tcpdump to not include the port numbers in the output

how can tell tcpdump to not include the port numbers in the output? Right now it includes the resolved IP + resolved port. I just need the resolved IP address (hostnames)
0
votes
1answer
164 views

Application traffic classification with tcpdump

I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be ...
1
vote
1answer
504 views

Counting the number of flows in a tcpdump file

I have a large tcpdump file which I need to parse to identify the number of flows in the capture based on the ( source ip + source port , destination ip + destination port ) pairs. Does tcpdump / any ...
0
votes
1answer
212 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
3
votes
2answers
1k views

Filter tcpdump file AFTER capturing

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller. Is this somehow possible?
3
votes
1answer
110 views

How do I get the network usage of a server per-IP?

I'd like to know a tool to programmatically measure, in KB/s, the load that each IP applies to a server. So far, tcpdump does a good job at telling me the amount of packets sent per second, but I ...
2
votes
1answer
73 views

In tcpdump filtering is “port” redundant with “tcp”?

Why would one want to force "tcp" in a "tcpdump" filter when using "port", given port numbers are defined in TCP Headers (as opposed to IP) In other words, is tcpdump tcp and port 10000 synonym to ...
2
votes
1answer
616 views

Using darkstat to monitor bandwidth — how to exclude my dynamically assigned IP address?

I am using darkstat to collect data about bandwidth usage on my local box. My internet connection is provided by a 3G USB stick, connecting to a mobile network. Each time I connect to the internet I ...
1
vote
1answer
44 views

How can I print only tcpsequence number with tcpdump

I search for a way to limit or change the output format of tcpdump to print only tcp sequnce number, but i didnt find a way to do this. Can you please advice? Running on Ubuntu. If there is no way to ...
-3
votes
1answer
692 views

Filter tcpdump capture to gather info on DNS/URL/URI [closed]

I'm looking to extract the DNS/URL/URI information from packets and produce a CSV output which I can then feed into flowtag.
4
votes
2answers
4k views

How filter only keep-alive packet with tcpdump

I need to analyze a traffic-dump on my network to check if all the PCs have enabled tcp keep-live features. I'm using tcpdump for that purpose. What I need to know is if there is a possibility to ...
0
votes
1answer
399 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
3
votes
1answer
154 views

Why isn't 'ether proto \ip host host' a legal tcpdump expression?

In its description of valid tcpdump expressions, the pcap-filter man pages state: The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) ...
0
votes
1answer
547 views

IPv6 DNS Lookup

I am trying to prevent a webserver to do IPv6 lookups (AAAA) to the DNS-server. The webserver has no IPv6 addresses set-up on the interfaces. Disabling IPv6 in sysctl.conf had no impact either, the ...
1
vote
1answer
1k views

using tcpdump to display XML API requests without headers or ack packets

I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command: tcpdump -iany -tpnAXs0 host xxx.xxx.xxx.xxx and ...
1
vote
1answer
495 views

How to Monitor Aborted Connections on Port 80 With tcpdump

Can I use tcpdump to detect Aborted connections on port 80 (Apache) originating from a specific IP (my remote IP). I can reproduce the Aborted connection in my web browser, but I have no way to verify ...
1
vote
1answer
3k views

tcpdump failed withi permission denied on centos when using with rotated file option

When I use tcpdump on centos 6, I got a permission denied error even when I was root. My command is like this: sudo tcpdump -i eth0 -G 10 -w test.dmp port 80 i have tried with -Z root or -Z ...
6
votes
2answers
8k views

Lots of dropped packages when tcpdumping on busy interface

My challenge I need to do tcpdumping of a lot of data - actually from 2 interfaces left in promiscuous mode that are able to see a lot of traffic. To sum it up Log all traffic in promiscuous mode ...
2
votes
1answer
3k views

Capture network traffic simultaneously on three interfaces

I need to capture traffic on a CentOS 5 server which acts as a web proxy with 2 wan interfaces and 1 LAN. In order to troubleshoot a weird proxy problem, I would like to have a capture of a full ...
0
votes
1answer
5k views

PPPoE Connection : “Generic-Error ”RP-PPPoE: Child pppd process terminated"

I have 2 Ubuntu 64-bit Virtual Machines installed on Virtual Box.Their name and ip addresses are given below.I am trying to establish PPPoE connection between the two machines. nas ...
3
votes
2answers
365 views

tcpdump file size == traffic size?

I created a tcpdump file: tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp duration was about 3 hours. This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
1
vote
1answer
219 views

Validate send packet against recived packets?

Running Ubuntu. I have machine A -> machine B (one-way connection from A to B) . Machine A goal is to forward tcp packets to machine B (it dosnt has tcp connection with machine B. it just forward tcp ...
7
votes
2answers
3k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
1
vote
1answer
2k views

DNS resolve timeout on RHEL 6.3 behind firewall

I have a server running Red Hat 6.3 Enterprise inside a VMWare virtual machine. There's a Juniper SSG 5 firewall sitting between the server and the Internet. I'm trying to diagnose what it looks like ...
-1
votes
1answer
3k views

How can I make tcpdump stop the capture after a certain number of packets captured?

I am debugging a problem where two servers get stuck in a loop when communicates with each other. After a server restart the problem will start at some point, it can be in an hour or in a day. I want ...
3
votes
2answers
2k views

Cheap way to detect client round trip times for http

I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this? There are far to many connections, and pinging each ip is ...
1
vote
4answers
2k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...
5
votes
2answers
358 views

Ubuntu 12 crashed and took down network

We recently set up a new Ubuntu 12.04LTS server on our network. It's not fully configured so it's not doing much beyond sshd and a default apache2 install. But this evening it appears to have ...
4
votes
1answer
4k views

iptables drop packet by hex string match

I got this packet captured with tcpdump but I'm not sure how to use the --hex-string param to match the packet. Can someone show me how to do it? 11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset ...