tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

1
vote
2answers
169 views

Question about tcpdump

On this link I found few informations about use of tcpdump. But, can you give me more information about example showed on that page: tcpdump -s 128 -vvv -T rtcp src orac and port 57393 ...
4
votes
2answers
879 views

Anyone can tell their experience with 10g Ethernet adapters on Linux

I wonder if any of you have an experience with 10g NICs (Intel, Myricom, SMC tiget, napatech, or by any other brand). Questions are: Was it easy to install, or a hassle, How does this adapter ...
2
votes
3answers
4k views

How can i sniff/dump HTTP protocol as ASCII for a port with tcpdump or altenative?

I need to view how an application is sending and is receiving traffic through a http protocol that it comunicates on localhost (it has an embeded port coded with .gz) I'm sure it's some XML that it ...
3
votes
1answer
2k views

Kill FINished sockets (using libpcap - tcpdump/tcpkill)

I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1): tcpdump "tcp[tcpflags] & tcp-fin != 0" ...
1
vote
2answers
3k views

How can I capture traffic with tcpdump and a sliding window or sort of “logrotate”?

I want to capture some traffic with tcpdump for troubleshooting. The problem is, the error is not reproducible. To not fill up the hole disks with captures, I would like to capture the traffic with ...
0
votes
2answers
579 views

Howto monitor traffic between IIS and MSSQL

I am trying to check how much traffic is flowing between MSSQL Server and IIS Server in different locations. There is 1 ipcop in every location and I download the tcpdump file from one firewall and ...
2
votes
0answers
1k views

How to know the source of certain TCP traffic on AIX

We have two AIX boxes, one for production system and another for testing. both systems are running ATM machine switches, where the ATM device is connected via TCP socket. we had an issue on ...
5
votes
4answers
5k views

Packet loss rate with iperf and tcpdump

I tested a line for its link quality with iperf. The measured speed (UDP port 9005) was 96Mbps, which is fine, because both servers are connected with 100Mbps to the internet. On the other hand the ...
0
votes
3answers
1k views

How can I log all traffic with its exact length?

I want to process all packets with their size going through our gateway server (running Debian 4.0). My idea is to use tcpdump, but I have two questions. The command I'm currently thinking of is ...
20
votes
3answers
24k views

how to split a pcap file into a set of smaller ones

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and ...
7
votes
5answers
5k views

How to Break Up Large tcpdump Files

Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data? Like -C but after the fact.
4
votes
2answers
3k views

tcpdump filter that excludes private ip traffic

For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net ...
1
vote
1answer
44 views

Running Job and Paused Job Writing to the same File

So I ran tcpdump twice overnight by accident, both outputting to the same file. However, I ran them as jobs and one of them has been paused the whole time. Anyone have a recommendations on how to ...
0
votes
2answers
624 views

pcap stream rotation and pruning

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping ...
0
votes
1answer
542 views

openvpn dual install (client and server) routing problem

I have the following install: PROD net (10.88.88.0/24) OFFICE net (192.168.2.0/24) on PROD I have openvpn server (vpnprod), so OFFICE can connect. on OFFICE I have openvpn machine (vpnoffice) ...
2
votes
4answers
1k views

tcpdump and dynamic dns update

So here we have an example of why google is scared.... asking google to find the specific recipe for "what is the tcpdump incantation to sniff / filter only for ddns update packets" winds up with a ...
30
votes
6answers
66k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
2
votes
1answer
8k views

Unknown tcpdump packets

I was just doing tcpdump on a linux server connected directly to a provider, and about every second and a half there is a line like this: 00:19:49.926700 00:15:c6:::** (oui Unknown) > ...
1
vote
4answers
481 views

Change protocol associated with port in tcpdump?

Following on from this question, how can I tell tcpdump to use a specific protocol analyzer for a particular port? I'm doing some DNS development using a test server running on port 5053, but I can't ...
1
vote
2answers
3k views

(D)DOS - tcpdump established connections analysis (too many established connections)

¿How can I debug this problem? (I've got full tcpdump captures) I have a TCP server into which many clients establish persistent connections. Normally all these clients behave, and I never reach ...
43
votes
8answers
147k views

How can I read pcap files in a friendly format?

a simple cat on the pcap file looks terrible: $cat tcp_dump.pcap ?ò????YVJ? JJ ?@@.?E<??@@ ?CA??qe?U????иh? .Ceh?YVJ?? JJ ?@@.?E<??@@ ...
3
votes
6answers
3k views

Dumping rawdata for a host on a proxy using tcpdump

Im trying to save the rawdata that is beeing sent throu our proxy to a specific url. A friend of mine gave me the tip to use tcpdump, so I started reading about it on their page. But for some reason I ...