tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
1answer
1k views

using tcpdump to display XML API requests without headers or ack packets

I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command: tcpdump -iany -tpnAXs0 host xxx.xxx.xxx.xxx and ...
0
votes
0answers
12 views

Analyzing TCPDUMP results for failed request

I'm making http POST calls to a database every 30 seconds, both the server and database are on the same host. Every 5 minutes or so, I get an error back from the endpoint indicating that the request ...
0
votes
1answer
25 views

How to trace TIME_WAIT sessions using tcpdump (or similar tool)

I have a server with large number of TIME_WAIT sessions. These are sessions that the server closed, but the client didn't close. I want to analyze a sample session, to understand what happens there. ...
15
votes
6answers
26k views

How to capture ack or syn packets by Tcpdump?

I want to use a filter rule to capture only ack or syn packets. How do I do this?
2
votes
5answers
116 views

Determine originating process for outbound traffic

I can see that my server is sending out a lot of traffic. If I go to netstat -apln | grep httpd I can see that all the traffic is going to one IP. Is there a way I can see what script / file is ...
2
votes
1answer
34 views

Tcpdump maximum split file size

I refer to this thread : how to split a pcap file into a set of smaller ones I have tried to use the command tcpdump -r old_file -w new_files -C 4096 and tcpdump returns tcpdump: invalid file size ...
0
votes
1answer
35 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
3
votes
2answers
213 views

tcpdump truncates to 1472 bytes useful data in UDP packets during the capture

I am writing an application which work with network. To perform some tests I need to reproduce the flow which I had a day before. But at the same time it is not allowed to stop the current working ...
0
votes
0answers
103 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
6
votes
2answers
822 views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
0
votes
0answers
17 views

multicast packets: when are they received with the receivers ip and when with a multicast ip

I am trying to connect 2 computers running jack for audio re-routing. Jack communicates through multicast packets on address 225.3.19.154 (port 19000) by default. I have successfully connected linux ...
1
vote
0answers
24 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null ...
0
votes
1answer
27 views

Tcpdump advanced filters

i want ask for command can Get only the IPs have more then 1 connection with different source port xxx.xxx.xxx.xxx:X | xxx.xxx.xxx.xxx:Y (example) if IP1 has connection to server with Src Port X ...
-1
votes
1answer
49 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
2
votes
3answers
6k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
0
votes
1answer
48 views

What can possibly prevent tcpdump from showing request packets?

I am trying to debug a little SOAP issue. I am using a java web app to consume an API over a VPN. ping and telnet on the webservice server are fine.The Environment is aws ec2 for my app. I have no ...
8
votes
2answers
211 views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
0
votes
0answers
46 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
1
vote
1answer
1k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
0
votes
0answers
38 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
0
votes
0answers
101 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...
0
votes
1answer
74 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
3
votes
1answer
58 views

tcpdump: decode packet starting at non-zero offset

I'm debugging a Linux embedded platform which has an interface where regular ethernet frames have an additional 82-octet platform header tacked on the front. I am able to sniff from this interface ...
1
vote
2answers
1k views

PPTP traffic logging

I am running pptpd on a Centos 5 machine but I didnt set up any logging. In case of an abuse, I need to determine which of my users did the bad things, meaning I need to log all the traffic. I may ...
0
votes
1answer
716 views

dhcp-server + iptables: Can't share ppp internet connection

I had this configuration before, and it used to work well, but now I got a new server and I can't setup it to share the internet connection from ppp0. I'm on Debian testing. The client connects ...
1
vote
2answers
85 views

TCP packet which is absent in strace log

Can somebody give me ideas about following situation (Linux 2.6.18-348.4.1.el5 ): At some point tcpdump shows [FIN, ACK] packet sent from server port to local client strace log shows no socket ...
2
votes
1answer
142 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
4
votes
1answer
227 views

Making TCP dump without packets loss

How to make a TCP dump where it is guaranteed that all the packets that really pass through the network are captured, and nothing is missed? Details: We have an issue with 3rd party vendor who ...
0
votes
0answers
61 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
0
votes
1answer
78 views

weird bridge issue in KVM

on Centos 6.5 i have a bridge network connected to eth4 and my virtual machine (Centos6.5) running on KVM is also connected to that interface(vnet0) bridge name bridge id STP ...
0
votes
1answer
107 views

tcpdump show strange packet with incorrect src ip and dst ip

I have private LAN with > 100 servers, in which, I have 3 server: x.x.x.37: run memcache on port 11211 (called s37 for short) x.x.x.241: run an application server, which connect to memcache on ...
2
votes
2answers
4k views

multicast tcpdump and subscriptions

From the multicast howto: IP_ADD_MEMBERSHIP. Recall that you need to tell the kernel which multicast groups you are interested in. If no process is interested in a group, packets ...
0
votes
2answers
95 views

How to decode custom port on tcpdump? [closed]

How do we capture/read pcap with option decode a custom port with tcpdump? For example 81 as http port.
1
vote
2answers
1k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
-5
votes
1answer
160 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
4
votes
4answers
546 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
2
votes
4answers
418 views

One second delay before tcpdump returns packets

Using Ubuntu, I'm trying to sync tcpdump sniffing with self-identifying "pings" from a client device. The problem is that getting precise starts and stops is made difficult by what looks like a ...
5
votes
2answers
4k views

What do “Unknown SSAP” and “Unknown DSAP” mean in tcpdump?

While trying to fix a problem with intermittently losing internet connection on a machine with a wireless connection to a router, I ran tcpdump and noticed packets with "Unknown SSAP" and "Unknown ...
1
vote
1answer
299 views

tcpdump filter sequence number

I have captured a packet trace and would like to write a script that will allow me to isolate a matching pair of acknowledgement and Sequence packets(no other way to filter out all the other packets) ...
1
vote
3answers
735 views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
5
votes
3answers
3k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
0
votes
1answer
418 views

tcpdump Server Hello Certificate Filter

On a devices located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet. So I'm trying to figure out how to get ...
1
vote
0answers
142 views

Massively large number of packets dropped by interface

I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g. 4 packets captured 402 packets ...
1
vote
0answers
51 views

tcpdump expression to show zero-byte ACKs?

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding ...
0
votes
0answers
47 views

tcpdump, display the data section

i am trying to display only the data section of an udp packet using tcpdump. In some other words, is it any way to filter the header section of the udp package? The below command sudo tcpdump ...
0
votes
0answers
143 views

How can I replay a TCP stream to my client

I need to do some validation testing of a new feed handler I have made. I have some pcap data that I captured from the production network and I would like to have my development feed handler connect ...
1
vote
1answer
45 views

Viewing the packet-size of an incoming IP

I have been looking for a sulution to this for a few hours. after no avail im asking for help here. I need to watch my incoming packets by Size. in a format similar to: IP SIZE I have tried ...
0
votes
1answer
563 views

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the ...
8
votes
5answers
6k views

How do I make tcpdump not print the tcp headers?

I tried this: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)' I need only the ascii part of it. How do I remove the rest?
0
votes
1answer
122 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...