tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

1
vote
1answer
2k views

DNS resolve timeout on RHEL 6.3 behind firewall

I have a server running Red Hat 6.3 Enterprise inside a VMWare virtual machine. There's a Juniper SSG 5 firewall sitting between the server and the Internet. I'm trying to diagnose what it looks like ...
-1
votes
1answer
3k views

How can I make tcpdump stop the capture after a certain number of packets captured?

I am debugging a problem where two servers get stuck in a loop when communicates with each other. After a server restart the problem will start at some point, it can be in an hour or in a day. I want ...
3
votes
2answers
2k views

Cheap way to detect client round trip times for http

I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this? There are far to many connections, and pinging each ip is ...
1
vote
4answers
2k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...
5
votes
2answers
372 views

Ubuntu 12 crashed and took down network

We recently set up a new Ubuntu 12.04LTS server on our network. It's not fully configured so it's not doing much beyond sshd and a default apache2 install. But this evening it appears to have ...
5
votes
1answer
4k views

iptables drop packet by hex string match

I got this packet captured with tcpdump but I'm not sure how to use the --hex-string param to match the packet. Can someone show me how to do it? 11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset ...
3
votes
3answers
1k views

TCP segments of an HTTP Request in wrong order

My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...
4
votes
2answers
3k views

tcpdump dns output codes

Captured on the nameserver: 21:54:35.391126 IP resolver.7538 > server.domain: 57385% [1au] A? www.domain.de. (42) What das the percent sign in 57385% mean? As far as I can see 57385 is the ...
-1
votes
3answers
2k views

ping: unknown host google.com

Relevant output: /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 ...
1
vote
1answer
657 views

How to filter out “bad-len 0” packets with tcpdump?

When I listen internal network interface of router on freebsd, I get outputs like this 10:36:02.372026 IP 192.168.1.11.8888 > 192.168.1.2.49831: Flags [.], ack 1097, win 65050, length 0 ...
5
votes
6answers
4k views

Log tcpdump Output

What I basically want is to to write all tcpdump captured packets to a file every 3 days. So basically tcpdump should run for 24 hours on day 1 and write the output to Day1.log and similar for Day2 ...
6
votes
2answers
7k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
0
votes
1answer
757 views

Cannot get a TCPdump from MySQL

I am having quite a few problems on a tricky server. One of my main problems at the moment is that tcpdump cannot seem to get the packets sent to mysql, unless I tinker with MySQL a bit. This is ...
-2
votes
2answers
301 views

TCP dump used for and how can it be used [closed]

What are the advantages and benifits of TCP dump and how can this be used and in which environments it can be used
1
vote
2answers
7k views

How to get http requests details in a tcpdump?

I am trying to get a tcpdump trace of some http requests. Here is what I got so far (I replaced the real IP addresses with REMOTE and LOCAL): C:\>Windump -na -i 3 ip host REMOTE and ip src LOCAL ...
5
votes
2answers
8k views

Pings from VPN network to VPN client work; pings into from VPN client to VPN network fail - why?

We are in the process of setting up an OpenVPN server for some servers running in a cloud. We are stumped with a connectivity problem whereby the hosts on the VPN server's LAN can ping te VPN client, ...
0
votes
1answer
908 views

tcpdump/Wireshark on restricted virtual server

When I try to dump some traffic on my vserver's network interface, I get an error that I'm not allowed to do that: # tcpdump -p -i eth0 tcpdump: eth0: You don't have permission to capture on that ...
4
votes
1answer
555 views

how to view hostnames in traffic entering my webserver (Apache)?

Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver? For example, say the webserver is set up to process incoming traffic for an IP address, ...
1
vote
1answer
342 views

PCAP to Syslog utility

I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time. Example : Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet Feb 16 ...
8
votes
3answers
6k views

Why won't tcpdump write a pcap file?

In the process of debugging a python irc bot that can't seem to connect, I thought "I know, I'll just tcpdump it and see what it's doing." So I ran tcpdump like I usually do and it says it's captured ...
3
votes
1answer
1k views

tcpdump udp data capture latency

I am using tcpdump to capture UDP packets and analyze network latency between a UDP broadcaster and my server. To calculate latency I compare the source host timestamps reported in UDP application ...
8
votes
1answer
18k views

tcpdump filter on network and subnet mask

I'm using the following tcpdump command: tcpdump -w net75.out -s 0 host 65.207.95.222 I want to change the filter on the single host to be all addresses in the following subnet: 65.192.0.0/10 I ...
1
vote
1answer
442 views

Tcpdump says “Illegal instruction”

Following the tutorial on http://www.waitingforthefuture.org/2009/12/25/compiling-tcpdump-for-tomato-firmware/, I tried to compile tcpdump. I did the compilation on an Intel Pentium 4 2.26Ghz computer ...
1
vote
1answer
479 views

Can't see traffic in my guest OS with tcpdump

I've created a virtual machine (Centos 6.0) using QEMU/KVM, which is also running on a Centos 6.0. The virtual machine is configured to have two NICs. The first NIC is using a bridged network (eth0 of ...
0
votes
1answer
934 views

How to sniff request packet on VPN server?

With some safe reasons, I need to sniff pptp cleint request packets, then to get dst ip and src ip, for example 10.5.1.100 -> 218.100.211.100 , I want to know the correct rule in tcpdump
1
vote
7answers
5k views

Firewall blocks traffic - how to find out what ports / ip addresses are used by software?

Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
3
votes
2answers
6k views

how to calculate packet loss from a binary TCPDUMP file

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not) It must be some kind of packet loss, because from ...
-1
votes
1answer
182 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
2
votes
2answers
5k views

multicast tcpdump and subscriptions

From the multicast howto: IP_ADD_MEMBERSHIP. Recall that you need to tell the kernel which multicast groups you are interested in. If no process is interested in a group, packets ...
4
votes
1answer
231 views

Can tcpdump tell accessed port numbers?

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used. Question How do I get tcpdump to tell me the port numbers that is being accessed on eth1?
1
vote
1answer
113 views

I'm being asked to support mapping many SSL keys to one IP but I think it's a bad idea. Am I wrong?

At work, I've been asked to add support for mapping multiple keys to a single (or many even) IP to what is essentially a passive HTTP sniffer. It supports SSL decryption with user-uploaded keys. ...
0
votes
1answer
654 views

TCP Sessions Hanging with Debian and iptables

Up until now I have been using a CentOS 5.x PC with 2x NICs running iptables as a router for my network. It worked great but recently I decided to get a DreamPlug which runs Debian 5.0.3/kernel ...
5
votes
3answers
5k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
1
vote
1answer
91 views

How to save the packets received by a network interface or some port in a file and resend the packets received when needed?

I am doing my work on a server service program on Linux that processes the packets sent to the socket it listens.Their is already a old such service listening on the port doing its job,and I can't ...
1
vote
0answers
88 views

tcpdump strange udp line

I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form: timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength but this is just: ...
0
votes
1answer
801 views

dhcp-server + iptables: Can't share ppp internet connection

I had this configuration before, and it used to work well, but now I got a new server and I can't setup it to share the internet connection from ppp0. I'm on Debian testing. The client connects ...
0
votes
3answers
493 views

shell record UDP stream from a specific address

I'm trying to record an incoming UDP stream (stream the sense that it's a stream of consecutive datagrams). I tried netcat but unfortunately multiple sources send data on the same port address and nc ...
4
votes
1answer
1k views

How to reproduce http traffic of a real site in another environment (e.g. VM)

There is a bug in my web application which I cannot reproduce. All the logs look ok or at least I cannot see anything unusual. But it happens. So I thought I could record all the traffic to/from my ...
0
votes
1answer
679 views

TCPDUMP , SSL , Android, SSL dump

I run an application on Android phone. The application connects to a webservice via internet and I want to intercept the traffic between the application and the webservice. The connection is ...
1
vote
2answers
232 views

Solaris VM Experiencing Frequent Timeouts

We are having an issue with all of our Solaris VMs. The issue we're seeing is frequent timeouts when when connecting via SSH or HTTP. It only seems to affect initial connections... when I connect via ...
1
vote
2answers
695 views

tcpdump - just output the packet contents line by line

I'm trying to use tcpdump on the DEFCON packets. Here's the command I'm using: tcpdump -qns 0 -X -r ulogd.eth0.pcap And here's the output I'm getting: 10:39:12.356410 IP 192.168.103.2.3101 > ...
11
votes
1answer
13k views

Too many incorrect checksum errors in TCPDUMP

I find too many incorrect checksum errors from a TCPDUMP done on a GNU Linux 64bit server. There are close to 50% incorrect chekcsums in the export? cksum 0xe61f (incorrect (-> 0x8c37) How can we ...
1
vote
1answer
179 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
1
vote
1answer
13k views

TCPDUMP - Capturing Packets on Multiple IP Address (FIlter)

What I need to do (via 'tcpdump' through Linux): • ECommerce App Servers: 192.168.1.2, 192.168.1.3, 192.168.1.4. - This is what I want to capture on (filtered on these exact IPs). Not an IP range ...
3
votes
1answer
504 views

Incoming packets to server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
0
votes
1answer
342 views

iptables logging packets coming from the outside world

I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this: tcpdump "(dst net 192.168.0.0/24 ...
1
vote
2answers
1k views

PPTP traffic logging

I am running pptpd on a Centos 5 machine but I didnt set up any logging. In case of an abuse, I need to determine which of my users did the bad things, meaning I need to log all the traffic. I may ...
4
votes
1answer
1k views

Daemon can't be started from fabric script or on boot - only interactively

I have a daemon script in /etc/init.d that performs some background packet logging using the tcpdump command. The script starts up fine using an interactive shell using sudo /etc/init.d/packetlog ...
-1
votes
1answer
147 views

tcpdump related [closed]

Can anyone inform about the commands/codes through which we can perform network monitoring or debugging activity with the help of tcpdump?
1
vote
1answer
229 views

Network flooded with ARP requests

I am having networking problems on a virtual Debian server. The VPS provider I think may be the cause of these network problems as it's a fairly new/fairly standard Debian install. However, as their ...