tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
2answers
1k views

Connecting to Samba share over the internet

I have been trying to connect a Linux box to a remote Samba share, with no success. The Samba share is a NAS, mapped to be accessible from the Internet, and to be used as a secondary backup box. The ...
0
votes
2answers
537 views

tcpdump over vpn/ssh

I'm redirecting tcpdump output from machine A to machine B. A and B must use a "secure" connection, using VPN or ssh tunnel. I only care about authentication, however: I don't need to protect from ...
0
votes
2answers
485 views

tcpdump unknown device

I am trying to run tcpdum on Solaris 10 as root user. I always get unknown device - even though I am using the name provided by ifconfig -a How can I find out the right device name?
2
votes
3answers
1k views

how to monitor traffic at port 53 (DNS)

I am a bit confused with the abundant tcpdump tutorials on internet. I am having a few of the virtual machines running on a virtualization server.Where I am debugging a problem.Port 53 is the one in ...
4
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
3
votes
1answer
619 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
0
votes
2answers
291 views

What is a RP Paket in a tcpdump log?

I have a tcpdump log with the following entry: 14:53:31.428570 IP 10.4.65.65.16666 > 192.168.201.10.80: RP 587:687(100) ack 48545454154 win 0 My Problem is that i have never seen an RP paket ...
4
votes
4answers
4k views

How to display interface in tcpdump output flow?

This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie: # tcpdump -i any -n host ...
0
votes
2answers
649 views

unable to sniff traffic despite network interface being in monitor or promiscuous mode

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon ...
0
votes
2answers
389 views

Sniff packets using tcpdump

I have a completely noob question. I want to see all packets that come to my computer from particular site (google.com). So I start tcpdump sudo tcpdump -i eth0 host google.com and enter google.com ...
9
votes
6answers
16k views

How to capture ack or syn packets by Tcpdump?

I want to know the filter rule , thanks!
2
votes
2answers
2k views

What program sent which packet to the network [duplicate]

I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you ...
1
vote
3answers
262 views

How to collect concise traffic statistics on linux?

I need to have statistics divided by time periods, like this: time_1 - time_1 + 5mins from_ip1 > to_ip2 total_packages_size1 from_ip3 > to_ip4 total_packages_size2 time_1 + 5mins - time_1 + ...
1
vote
3answers
511 views

Dropped packets in Linux

I'am using a machine as a router, it works sort of fine, however if I do a ping -t whatever.server it will always cause a 3-4% package loss, no matter what server. Looking at ifconfig or netstat -i ...
0
votes
3answers
245 views

How to see an application network protocol communication in real time

I would like to see the protocol used by client-server application in real-time. I'm not interested in any statistics. All I want to see is the message sent by server and the client. This is FreeBSD ...
0
votes
1answer
223 views

How to read and create this type of TCPDUMP

I am having an issue with my tcpdump command i have created. Chances are its wrong. What i want to do is this: Run this command: tc qdisc add dev eth0 root tbf rate 6kbit latency 50ms burst 1540 ...
1
vote
4answers
874 views

How to block packets after capturing?

I use tcpdump to capture output packets for one server, but I also need to block these packets. If I use iptables to block them, then I also can not capture anything. Can I block packets with ...
0
votes
1answer
555 views

Log network traffic with process ID on Mac OS X?

I want to log all network traffic on a Mac OS X server (like tcpdump does), but including the ID of the process that is responsible. Using lsof only gives me the current connections, not the past ...
8
votes
5answers
3k views

How do I make tcpdump not print the tcp headers?

I tried this: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)' I need only the ascii part of it. How do I remove the rest?
4
votes
1answer
546 views

tcpdump and congestion window

Sniffing http traffic to my (linux) server it seems like it always responds advertising a window size of 14. It isn't affected if I change the default initcwnd size (with ip route), and it doesn't ...
4
votes
2answers
3k views

What do “Unknown SSAP” and “Unknown DSAP” mean in tcpdump?

While trying to fix a problem with intermittently losing internet connection on a machine with a wireless connection to a router, I ran tcpdump and noticed packets with "Unknown SSAP" and "Unknown ...
1
vote
2answers
1k views

TCPDUMP = How to detect and analyse “Suspicious” Traffic to 192.xxx Addresses?

I just played a little bit with tcpdump (as I wanted to check why my mails are not getting send) and thereby discovered very strange and a lot of traffic to the "Private IPs". Please See examples ...
5
votes
1answer
3k views

tcpdump: capture one of several vlans

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says: The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
6
votes
4answers
3k views

Monitor number of bytes transferred to/from IP address on port

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port. The equivalent tcpdump command would be: tcpdump ...
1
vote
1answer
167 views

tcpdump not giving details

Why does tcpdump not give my more details? Each time it only comes as - 16:22:26.128541 [|ether] # ./tcpdump -vv not port 22 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size ...
2
votes
3answers
2k views

tcpdump filter according to http header content

using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache. that means that i need to filter according to the ...
0
votes
3answers
2k views

tcpdump syntax for only capturing traffic coming to a specific virtual interface / local IP

CentOS 5.x Hello All, I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow ...
1
vote
2answers
1k views

Why Packet Loss AFTER tcpdump has logged the packet?

We encounter some strange packet loss and want to know the reason for this. We have an imageserver and a server for stressing the imageserver. Both are located in the same datacenter First we run a ...
1
vote
2answers
155 views

Question about tcpdump

On this link I found few informations about use of tcpdump. But, can you give me more information about example showed on that page: tcpdump -s 128 -vvv -T rtcp src orac and port 57393 ...
4
votes
2answers
734 views

Anyone can tell their experience with 10g Ethernet adapters on Linux

I wonder if any of you have an experience with 10g NICs (Intel, Myricom, SMC tiget, napatech, or by any other brand). Questions are: Was it easy to install, or a hassle, How does this adapter ...
1
vote
2answers
587 views

How to understand the output of tcpdump?

15:24:27.156744 IP 192.168.1.106.ssh > 192.168.1.105.1128: P 2327968:2328112(144) ack 30721 win 182 15:24:27.156827 IP 192.168.1.106.ssh > 192.168.1.105.1128: P 2328112:2328256(144) ack 30721 ...
2
votes
3answers
3k views

How can i sniff/dump HTTP protocol as ASCII for a port with tcpdump or altenative?

I need to view how an application is sending and is receiving traffic through a http protocol that it comunicates on localhost (it has an embeded port coded with .gz) I'm sure it's some XML that it ...
3
votes
1answer
1k views

Kill FINished sockets (using libpcap - tcpdump/tcpkill)

I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1): tcpdump "tcp[tcpflags] & tcp-fin != 0" ...
1
vote
2answers
2k views

How can I capture traffic with tcpdump and a sliding window or sort of “logrotate”?

I want to capture some traffic with tcpdump for troubleshooting. The problem is, the error is not reproducible. To not fill up the hole disks with captures, I would like to capture the traffic with ...
0
votes
2answers
539 views

Howto monitor traffic between IIS and MSSQL

I am trying to check how much traffic is flowing between MSSQL Server and IIS Server in different locations. There is 1 ipcop in every location and I download the tcpdump file from one firewall and ...
2
votes
0answers
855 views

How to know the source of certain TCP traffic on AIX

We have two AIX boxes, one for production system and another for testing. both systems are running ATM machine switches, where the ATM device is connected via TCP socket. we had an issue on ...
5
votes
4answers
4k views

Packet loss rate with iperf and tcpdump

I tested a line for its link quality with iperf. The measured speed (UDP port 9005) was 96Mbps, which is fine, because both servers are connected with 100Mbps to the internet. On the other hand the ...
0
votes
3answers
1k views

How can I log all traffic with its exact length?

I want to process all packets with their size going through our gateway server (running Debian 4.0). My idea is to use tcpdump, but I have two questions. The command I'm currently thinking of is ...
13
votes
3answers
18k views

how to split a pcap file into a set of smaller ones

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and ...
7
votes
5answers
4k views

How to Break Up Large tcpdump Files

Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data? Like -C but after the fact.
4
votes
2answers
2k views

tcpdump filter that excludes private ip traffic

For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net ...
1
vote
1answer
41 views

Running Job and Paused Job Writing to the same File

So I ran tcpdump twice overnight by accident, both outputting to the same file. However, I ran them as jobs and one of them has been paused the whole time. Anyone have a recommendations on how to ...
0
votes
2answers
546 views

pcap stream rotation and pruning

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping ...
0
votes
1answer
536 views

openvpn dual install (client and server) routing problem

I have the following install: PROD net (10.88.88.0/24) OFFICE net (192.168.2.0/24) on PROD I have openvpn server (vpnprod), so OFFICE can connect. on OFFICE I have openvpn machine (vpnoffice) ...
2
votes
4answers
1k views

tcpdump and dynamic dns update

So here we have an example of why google is scared.... asking google to find the specific recipe for "what is the tcpdump incantation to sniff / filter only for ddns update packets" winds up with a ...
28
votes
6answers
58k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
2
votes
1answer
7k views

Unknown tcpdump packets

I was just doing tcpdump on a linux server connected directly to a provider, and about every second and a half there is a line like this: 00:19:49.926700 00:15:c6:::** (oui Unknown) > ...
1
vote
4answers
452 views

Change protocol associated with port in tcpdump?

Following on from this question, how can I tell tcpdump to use a specific protocol analyzer for a particular port? I'm doing some DNS development using a test server running on port 5053, but I can't ...
1
vote
2answers
3k views

(D)DOS - tcpdump established connections analysis (too many established connections)

¿How can I debug this problem? (I've got full tcpdump captures) I have a TCP server into which many clients establish persistent connections. Normally all these clients behave, and I never reach ...