tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

18
votes
6answers
31k views

How to capture ack or syn packets by Tcpdump?

I want to use a filter rule to capture only ack or syn packets. How do I do this?
-1
votes
0answers
33 views

tcpdump and httpry not capturing tcp packets [on hold]

I have recently formatted my machine with Centos 7. My two interfaces are named enp3s0 and enp4s1. I have used to switch to set port mirroring on both interfaces. I have used httpry and tcpdump -i ...
1
vote
1answer
27 views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
0
votes
1answer
45 views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
3
votes
1answer
68 views

Tcpdump maximum split file size

I refer to this thread : how to split a pcap file into a set of smaller ones I have tried to use the command tcpdump -r old_file -w new_files -C 4096 and tcpdump returns tcpdump: invalid file size ...
2
votes
1answer
49 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ ...
7
votes
2answers
1k views

TCP Dump, cannot understand these 4 lines?

I need support understanding these 4 lines. looks like tcp dump but im actully not understanding what exactly is happening here. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S ...
0
votes
1answer
1k views

using tcpdump to display XML API requests without headers or ack packets

I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command: tcpdump -iany -tpnAXs0 host xxx.xxx.xxx.xxx and ...
3
votes
1answer
601 views

How to debug why WAN TCP/IP throughput is lower than expected?

I'm trying to figure out why tcp/ip throughput between two hosts I control is much lower than expected. Host A: internet connectivity provided by Comcast (Residential) in Boston Metro -- can ...
0
votes
0answers
26 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...
4
votes
6answers
4k views

tcpdump: out.pcap: Permission denied

[root@localhost ~]# cat /etc/issue Fedora release 17 (Beefy Miracle) Kernel \r on an \m (\l) [root@localhost ~]# uname -a Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC ...
0
votes
1answer
37 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
0
votes
3answers
60 views

how to use tcpdump to log only certain data in real time

I'd like to monitor network interfaces but only log things likes errors, collisions and dropped packets. The send that to stdout. – Can tcpdump be configured to do this?
1
vote
2answers
45 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip ...
0
votes
0answers
54 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
6
votes
5answers
7k views

How to display interface in tcpdump output flow?

This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie: # tcpdump -i any -n host ...
0
votes
1answer
63 views

Capturing LDAPS traffic with tcpdump

I have an app server that authenticates against Active Directory using LDAPS. I am connecting to the AD server over port 636. I'm trying to troubleshoot/debug some performance issues and am beginning ...
0
votes
0answers
45 views

Analyzing TCPDUMP results for failed request

I'm making http POST calls to a database every 30 seconds, both the server and database are on the same host. Every 5 minutes or so, I get an error back from the endpoint indicating that the request ...
0
votes
1answer
74 views

How to trace TIME_WAIT sessions using tcpdump (or similar tool)

I have a server with large number of TIME_WAIT sessions. These are sessions that the server closed, but the client didn't close. I want to analyze a sample session, to understand what happens there. ...
2
votes
5answers
262 views

Determine originating process for outbound traffic

I can see that my server is sending out a lot of traffic. If I go to netstat -apln | grep httpd I can see that all the traffic is going to one IP. Is there a way I can see what script / file is ...
0
votes
1answer
136 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
3
votes
2answers
295 views

tcpdump truncates to 1472 bytes useful data in UDP packets during the capture

I am writing an application which work with network. To perform some tests I need to reproduce the flow which I had a day before. But at the same time it is not allowed to stop the current working ...
1
vote
0answers
437 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
0
votes
0answers
51 views

multicast packets: when are they received with the receivers ip and when with a multicast ip

I am trying to connect 2 computers running jack for audio re-routing. Jack communicates through multicast packets on address 225.3.19.154 (port 19000) by default. I have successfully connected linux ...
1
vote
0answers
34 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null ...
0
votes
1answer
77 views

Tcpdump advanced filters

i want ask for command can Get only the IPs have more then 1 connection with different source port xxx.xxx.xxx.xxx:X | xxx.xxx.xxx.xxx:Y (example) if IP1 has connection to server with Src Port X ...
-1
votes
1answer
70 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
2
votes
3answers
9k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
0
votes
1answer
88 views

What can possibly prevent tcpdump from showing request packets?

I am trying to debug a little SOAP issue. I am using a java web app to consume an API over a VPN. ping and telnet on the webservice server are fine.The Environment is aws ec2 for my app. I have no ...
8
votes
2answers
409 views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
0
votes
0answers
70 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
2
votes
1answer
2k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
0
votes
0answers
67 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
0
votes
0answers
178 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...
0
votes
1answer
102 views

Need help examining tcpdump file to block attack

I need some help, my game server has been under fire with DoS attacks for 2 days now. Bandwidth attacks are no problem since I host with OVH and they are filtered out but my game server ports are ...
3
votes
1answer
66 views

tcpdump: decode packet starting at non-zero offset

I'm debugging a Linux embedded platform which has an interface where regular ethernet frames have an additional 82-octet platform header tacked on the front. I am able to sniff from this interface ...
1
vote
2answers
1k views

PPTP traffic logging

I am running pptpd on a Centos 5 machine but I didnt set up any logging. In case of an abuse, I need to determine which of my users did the bad things, meaning I need to log all the traffic. I may ...
0
votes
1answer
758 views

dhcp-server + iptables: Can't share ppp internet connection

I had this configuration before, and it used to work well, but now I got a new server and I can't setup it to share the internet connection from ppp0. I'm on Debian testing. The client connects ...
1
vote
2answers
113 views

TCP packet which is absent in strace log

Can somebody give me ideas about following situation (Linux 2.6.18-348.4.1.el5 ): At some point tcpdump shows [FIN, ACK] packet sent from server port to local client strace log shows no socket ...
2
votes
1answer
231 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
4
votes
1answer
275 views

Making TCP dump without packets loss

How to make a TCP dump where it is guaranteed that all the packets that really pass through the network are captured, and nothing is missed? Details: We have an issue with 3rd party vendor who ...
0
votes
0answers
71 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
0
votes
1answer
104 views

weird bridge issue in KVM

on Centos 6.5 i have a bridge network connected to eth4 and my virtual machine (Centos6.5) running on KVM is also connected to that interface(vnet0) bridge name bridge id STP ...
0
votes
1answer
164 views

tcpdump show strange packet with incorrect src ip and dst ip

I have private LAN with > 100 servers, in which, I have 3 server: x.x.x.37: run memcache on port 11211 (called s37 for short) x.x.x.241: run an application server, which connect to memcache on ...
2
votes
2answers
4k views

multicast tcpdump and subscriptions

From the multicast howto: IP_ADD_MEMBERSHIP. Recall that you need to tell the kernel which multicast groups you are interested in. If no process is interested in a group, packets ...
0
votes
2answers
146 views

How to decode custom port on tcpdump? [closed]

How do we capture/read pcap with option decode a custom port with tcpdump? For example 81 as http port.
1
vote
2answers
1k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
-5
votes
1answer
289 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
4
votes
4answers
674 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
3
votes
4answers
550 views

One second delay before tcpdump returns packets

Using Ubuntu, I'm trying to sync tcpdump sniffing with self-identifying "pings" from a client device. The problem is that getting precise starts and stops is made difficult by what looks like a ...