tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
1answer
823 views

tcpdump/Wireshark on restricted virtual server

When I try to dump some traffic on my vserver's network interface, I get an error that I'm not allowed to do that: # tcpdump -p -i eth0 tcpdump: eth0: You don't have permission to capture on that ...
4
votes
1answer
529 views

how to view hostnames in traffic entering my webserver (Apache)?

Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver? For example, say the webserver is set up to process incoming traffic for an IP address, ...
1
vote
1answer
307 views

PCAP to Syslog utility

I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time. Example : Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet Feb 16 ...
8
votes
3answers
5k views

Why won't tcpdump write a pcap file?

In the process of debugging a python irc bot that can't seem to connect, I thought "I know, I'll just tcpdump it and see what it's doing." So I ran tcpdump like I usually do and it says it's captured ...
3
votes
1answer
1k views

tcpdump udp data capture latency

I am using tcpdump to capture UDP packets and analyze network latency between a UDP broadcaster and my server. To calculate latency I compare the source host timestamps reported in UDP application ...
6
votes
1answer
15k views

tcpdump filter on network and subnet mask

I'm using the following tcpdump command: tcpdump -w net75.out -s 0 host 65.207.95.222 I want to change the filter on the single host to be all addresses in the following subnet: 65.192.0.0/10 I ...
1
vote
1answer
422 views

Tcpdump says “Illegal instruction”

Following the tutorial on http://www.waitingforthefuture.org/2009/12/25/compiling-tcpdump-for-tomato-firmware/, I tried to compile tcpdump. I did the compilation on an Intel Pentium 4 2.26Ghz computer ...
1
vote
1answer
425 views

Can't see traffic in my guest OS with tcpdump

I've created a virtual machine (Centos 6.0) using QEMU/KVM, which is also running on a Centos 6.0. The virtual machine is configured to have two NICs. The first NIC is using a bridged network (eth0 of ...
0
votes
1answer
781 views

How to sniff request packet on VPN server?

With some safe reasons, I need to sniff pptp cleint request packets, then to get dst ip and src ip, for example 10.5.1.100 -> 218.100.211.100 , I want to know the correct rule in tcpdump
1
vote
7answers
4k views

Firewall blocks traffic - how to find out what ports / ip addresses are used by software?

Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
3
votes
2answers
6k views

how to calculate packet loss from a binary TCPDUMP file

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not) It must be some kind of packet loss, because from ...
-1
votes
1answer
180 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
2
votes
2answers
5k views

multicast tcpdump and subscriptions

From the multicast howto: IP_ADD_MEMBERSHIP. Recall that you need to tell the kernel which multicast groups you are interested in. If no process is interested in a group, packets ...
4
votes
1answer
228 views

Can tcpdump tell accessed port numbers?

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used. Question How do I get tcpdump to tell me the port numbers that is being accessed on eth1?
1
vote
1answer
112 views

I'm being asked to support mapping many SSL keys to one IP but I think it's a bad idea. Am I wrong?

At work, I've been asked to add support for mapping multiple keys to a single (or many even) IP to what is essentially a passive HTTP sniffer. It supports SSL decryption with user-uploaded keys. ...
0
votes
1answer
626 views

TCP Sessions Hanging with Debian and iptables

Up until now I have been using a CentOS 5.x PC with 2x NICs running iptables as a router for my network. It worked great but recently I decided to get a DreamPlug which runs Debian 5.0.3/kernel ...
5
votes
3answers
4k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
1
vote
1answer
87 views

How to save the packets received by a network interface or some port in a file and resend the packets received when needed?

I am doing my work on a server service program on Linux that processes the packets sent to the socket it listens.Their is already a old such service listening on the port doing its job,and I can't ...
1
vote
0answers
86 views

tcpdump strange udp line

I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form: timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength but this is just: ...
0
votes
1answer
775 views

dhcp-server + iptables: Can't share ppp internet connection

I had this configuration before, and it used to work well, but now I got a new server and I can't setup it to share the internet connection from ppp0. I'm on Debian testing. The client connects ...
0
votes
3answers
457 views

shell record UDP stream from a specific address

I'm trying to record an incoming UDP stream (stream the sense that it's a stream of consecutive datagrams). I tried netcat but unfortunately multiple sources send data on the same port address and nc ...
4
votes
1answer
1k views

How to reproduce http traffic of a real site in another environment (e.g. VM)

There is a bug in my web application which I cannot reproduce. All the logs look ok or at least I cannot see anything unusual. But it happens. So I thought I could record all the traffic to/from my ...
0
votes
1answer
626 views

TCPDUMP , SSL , Android, SSL dump

I run an application on Android phone. The application connects to a webservice via internet and I want to intercept the traffic between the application and the webservice. The connection is ...
1
vote
2answers
222 views

Solaris VM Experiencing Frequent Timeouts

We are having an issue with all of our Solaris VMs. The issue we're seeing is frequent timeouts when when connecting via SSH or HTTP. It only seems to affect initial connections... when I connect via ...
1
vote
2answers
580 views

tcpdump - just output the packet contents line by line

I'm trying to use tcpdump on the DEFCON packets. Here's the command I'm using: tcpdump -qns 0 -X -r ulogd.eth0.pcap And here's the output I'm getting: 10:39:12.356410 IP 192.168.103.2.3101 > ...
10
votes
1answer
11k views

Too many incorrect checksum errors in TCPDUMP

I find too many incorrect checksum errors from a TCPDUMP done on a GNU Linux 64bit server. There are close to 50% incorrect chekcsums in the export? cksum 0xe61f (incorrect (-> 0x8c37) How can we ...
1
vote
1answer
174 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
0
votes
1answer
11k views

TCPDUMP - Capturing Packets on Multiple IP Address (FIlter)

What I need to do (via 'tcpdump' through Linux): • ECommerce App Servers: 192.168.1.2, 192.168.1.3, 192.168.1.4. - This is what I want to capture on (filtered on these exact IPs). Not an IP range ...
3
votes
1answer
470 views

Incoming packets to server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
0
votes
1answer
326 views

iptables logging packets coming from the outside world

I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this: tcpdump "(dst net 192.168.0.0/24 ...
1
vote
2answers
1k views

PPTP traffic logging

I am running pptpd on a Centos 5 machine but I didnt set up any logging. In case of an abuse, I need to determine which of my users did the bad things, meaning I need to log all the traffic. I may ...
3
votes
1answer
1k views

Daemon can't be started from fabric script or on boot - only interactively

I have a daemon script in /etc/init.d that performs some background packet logging using the tcpdump command. The script starts up fine using an interactive shell using sudo /etc/init.d/packetlog ...
1
vote
1answer
210 views

Network flooded with ARP requests

I am having networking problems on a virtual Debian server. The VPS provider I think may be the cause of these network problems as it's a fairly new/fairly standard Debian install. However, as their ...
0
votes
1answer
767 views

Port forwarding not working, tcpdump shows “reset connection”

I have an home web server that I use to serve a few pages for personal purposes. The server runs Ubuntu and is behind an ADSL connection, and it's working nicely. Recently I subscribed to a Hiperlan ...
0
votes
2answers
728 views

looking for multicast traffic

We have a j2ee webapp on tomcat which is using ehcache with multicast discovery. Except it's not discovering anything. There appears to to be no multicast traffic visible on the network but we're a ...
3
votes
1answer
6k views

tcpdump How do I use it to capture all traffic headers

I'm quite new to tcpdump. I've never used it except for very trivial tasks. Recently, I was asked to complete the following job. What I have: A server with a network interface connected to a switch. ...
0
votes
3answers
157 views

MySQL RESET [integer]

In an audit of queries running on our databases using tcpdump and Maatkit tools, the number one query is RESET [int] Running this statement from the MySQL command line results in an error as RESET ...
0
votes
2answers
1k views

Connecting to Samba share over the internet

I have been trying to connect a Linux box to a remote Samba share, with no success. The Samba share is a NAS, mapped to be accessible from the Internet, and to be used as a secondary backup box. The ...
0
votes
2answers
634 views

tcpdump over vpn/ssh

I'm redirecting tcpdump output from machine A to machine B. A and B must use a "secure" connection, using VPN or ssh tunnel. I only care about authentication, however: I don't need to protect from ...
0
votes
2answers
799 views

tcpdump unknown device

I am trying to run tcpdum on Solaris 10 as root user. I always get unknown device - even though I am using the name provided by ifconfig -a How can I find out the right device name?
2
votes
3answers
2k views

how to monitor traffic at port 53 (DNS)

I am a bit confused with the abundant tcpdump tutorials on internet. I am having a few of the virtual machines running on a virtualization server.Where I am debugging a problem.Port 53 is the one in ...
6
votes
1answer
2k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
4
votes
1answer
772 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
0
votes
2answers
341 views

What is a RP Paket in a tcpdump log?

I have a tcpdump log with the following entry: 14:53:31.428570 IP 10.4.65.65.16666 > 192.168.201.10.80: RP 587:687(100) ack 48545454154 win 0 My Problem is that i have never seen an RP paket ...
6
votes
5answers
7k views

How to display interface in tcpdump output flow?

This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie: # tcpdump -i any -n host ...
0
votes
2answers
806 views

unable to sniff traffic despite network interface being in monitor or promiscuous mode

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon ...
0
votes
2answers
499 views

Sniff packets using tcpdump

I have a completely noob question. I want to see all packets that come to my computer from particular site (google.com). So I start tcpdump sudo tcpdump -i eth0 host google.com and enter google.com ...
20
votes
6answers
33k views

How to capture ack or syn packets by Tcpdump?

I want to use a filter rule to capture only ack or syn packets. How do I do this?
3
votes
2answers
3k views

What program sent which packet to the network [duplicate]

I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you ...
1
vote
3answers
280 views

How to collect concise traffic statistics on linux?

I need to have statistics divided by time periods, like this: time_1 - time_1 + 5mins from_ip1 > to_ip2 total_packages_size1 from_ip3 > to_ip4 total_packages_size2 time_1 + 5mins - time_1 + ...