tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

4
votes
2answers
2k views

tcpdump filter that excludes private ip traffic

For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net ...
1
vote
1answer
43 views

Running Job and Paused Job Writing to the same File

So I ran tcpdump twice overnight by accident, both outputting to the same file. However, I ran them as jobs and one of them has been paused the whole time. Anyone have a recommendations on how to ...
0
votes
2answers
576 views

pcap stream rotation and pruning

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping ...
0
votes
1answer
538 views

openvpn dual install (client and server) routing problem

I have the following install: PROD net (10.88.88.0/24) OFFICE net (192.168.2.0/24) on PROD I have openvpn server (vpnprod), so OFFICE can connect. on OFFICE I have openvpn machine (vpnoffice) ...
2
votes
4answers
1k views

tcpdump and dynamic dns update

So here we have an example of why google is scared.... asking google to find the specific recipe for "what is the tcpdump incantation to sniff / filter only for ddns update packets" winds up with a ...
29
votes
6answers
61k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
2
votes
1answer
7k views

Unknown tcpdump packets

I was just doing tcpdump on a linux server connected directly to a provider, and about every second and a half there is a line like this: 00:19:49.926700 00:15:c6:::** (oui Unknown) > ...
1
vote
4answers
460 views

Change protocol associated with port in tcpdump?

Following on from this question, how can I tell tcpdump to use a specific protocol analyzer for a particular port? I'm doing some DNS development using a test server running on port 5053, but I can't ...
1
vote
2answers
3k views

(D)DOS - tcpdump established connections analysis (too many established connections)

¿How can I debug this problem? (I've got full tcpdump captures) I have a TCP server into which many clients establish persistent connections. Normally all these clients behave, and I never reach ...
34
votes
8answers
122k views

How can I read pcap files in a friendly format?

a simple cat on the pcap file looks terrible: $cat tcp_dump.pcap ?ò????YVJ? JJ ?@@.?E<??@@ ?CA??qe?U????иh? .Ceh?YVJ?? JJ ?@@.?E<??@@ ...
3
votes
6answers
2k views

Dumping rawdata for a host on a proxy using tcpdump

Im trying to save the rawdata that is beeing sent throu our proxy to a specific url. A friend of mine gave me the tip to use tcpdump, so I started reading about it on their page. But for some reason I ...