tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
0answers
10 views

tcpdump - shows VLAN tag, but filtering doesn't work?

I'm running tcpdump on a mirrored port and when I use a simple tcpdump command it shows the VLAN id: tcpdump -i eth1 -n -e 22:02:53.308715 78:31:c1:c6:c8:9e (oui Unknown) > Broadcast, ethertype ...
0
votes
0answers
14 views

Two identical SYN packets sent to two different ips when connecting to port 80 on my VPS

I can't connect to my VPS (IP = V) from my home machine (IP = H); I can connect easilly from other IPs (office for example); Here is what I see when I do a TCPdump: 14:45:54.686642 IP H.49558 > V....
2
votes
1answer
166 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
2
votes
2answers
2k views

How to parse OpenFlow packets using tcpdump capture file programmatically

I am working with OpenFlow packets and am analyzing the network via tcpdump. Currently, I use the WireShark GUI to parse the generated capture file and it does serve my need. However, I was ...
0
votes
0answers
10 views

Capturing HTTP requests for JMeter Raw Data Source

I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
0
votes
1answer
3k views

Login my Linux with root ,executing command sshd、tcpdump failed

root# /usr/sbin/sshd Privilege separation user sshd does not exist root# tcpdump -i eth0 udp tcpdump : Couldn't find user 'tcpdump' but the users tcpdump and sshd are in the files /...
33
votes
4answers
41k views

how to split a pcap file into a set of smaller ones

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? ...
-1
votes
1answer
47 views

How to dump VXLAN/VLAN ID in packet capture? [closed]

Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
1
vote
1answer
133 views

tcpdump on bridge interface (virbr) does not receive any packets destined for one of its addresses

Here's the configuration for the interface: # ifconfig virbr0 virbr0: flags=4355 mtu 1500 inet 192.168.11.1 netmask 255.255.255.255 broadcast 255.255.255.255 ether 52:54:00:99:e3:...
0
votes
1answer
59 views

How to figure out why my NAT-box sends TCP RST packets?

TL;DR: I see that an ubuntu (which I have an absolute control of) host sends a packet under certain circumstances. How to find the application/kernel module responsible for that packet? I am ...
0
votes
3answers
915 views

Log network traffic with process ID on Mac OS X?

I want to log all network traffic on a Mac OS X server (like tcpdump does), but including the ID of the process that is responsible. Using lsof only gives me the current connections, not the past ones....
1
vote
1answer
135 views

icmp ping reply not received by ping process, seen by tcpdump/wireshark

I'm having an issue with getting the actual ping process to receive the reply even though I can clearly see the response in the tcpdump output. I'm running on: Mac OS X 10.11.4 El Capitan Bridge ...
1
vote
2answers
166 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
2
votes
1answer
35 views

tcpdump - prevent interpreting/decoding protocols

Is there a way to stop tcpdump from (mis)interpreting protocols in captured packets? It assumes that traffic coming from port 4500/udp is always IPSec traffic, 53/udp is DNS query, etc and tries to ...
0
votes
0answers
56 views

“No route to host” when i do a telnet in azure

I have two VM's in azure with different public IP's and whose private IP's are : 10.10.1.9 10.10.1.6 When i do a telnet with following command from the server 10.10.1.6, i get the a error: telnet ...
0
votes
0answers
27 views

Large payload - connection get's Hung with CLOSE_WAIT or LAST_ACK state

We have a webservice client which posts data to a 3rd party Webservice. We are having an issue when the payload is a bit large (Around 600KB) xml. Once we pay the process hangs forever. The Netstat -...
0
votes
2answers
42 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
0
votes
1answer
52 views

Linux server failing to send SYN/ACK after receiving SYN remotely, works locally

Problem: A server process can be accessed by a device on the LAN or by the server itself, but it cannot be accessed outside the LAN (port forwarding is configured correctly as the server does receive ...
-1
votes
2answers
87 views

How does TCP offload NIC cause the TCP checksum to be invalid?

A tcpdump pcap exported and being investigated on another machine with wireshark is showing a lot of invalid TCP checksum messages. This is a known and documented phenomenon when using TCP offload ...
0
votes
2answers
39 views

Count number of incoming connection on a port - Linux

We have a server which listens on port X. The server has a large number of clients, from time to time the process gets hung, I am seeing SYN flooding messages in the log. I have been trying to tune ...
16
votes
5answers
13k views

How do I make tcpdump not print the tcp headers?

I tried this: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)' I need only the ascii part of it. How do I remove the rest?
1
vote
2answers
55 views

How do I see absolute time stamps in Wireshark?

There is an example of pcap file opened in wireshark The second column is time. Is it possible to see absolute timestamps here instead of relative?
7
votes
2answers
9k views

tcpdump: capture one of several vlans

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says: The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
0
votes
1answer
24 views

Is it possible to specify tcpdump that I want it to interpret packet differently before printing it to STDOUT?

I am using iperf to pinpoint packet reordering issue. Unfortunately, tcpdump does not know how to parse iperf's UDP payload that I could use to pinpoint the issue. I know that iperf stores packet ...
0
votes
1answer
46 views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
1
vote
2answers
27 views

tcpdump http containing non expected payload bytes

I am monitoring an openvpn link with tcpdump a la tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n There is http/xml traffic going over that link which is basically caputered just fine. However, ...
4
votes
5answers
2k views

Determine originating process for outbound traffic

I can see that my server is sending out a lot of traffic. If I go to netstat -apln | grep httpd I can see that all the traffic is going to one IP. Is there a way I can see what script / file is ...
0
votes
1answer
37 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
1
vote
1answer
119 views

Use tcpdump to capture an ICMP destination unreachable message

I am new in this area. I am asked to use tcpdump to capture an ICMP destination unreachable message in my network course. So I am trying to capture one message that is an ICMP destination unreachable ...
1
vote
1answer
98 views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
49 views

NATted host cannot talk to itself unless virbr0 is in promiscuous mode

We have the following situation: A hypervisor using KVM-Qemu/libvirt with a single VM. The VM has the internal IP 192.168.122.151 on the default network pool using virbr0 on the hypervisor. We've ...
0
votes
1answer
28 views

tcpdump - filter applies after some time?

I have a strange problem with tcpdump - it's like the filter I want to be applied to captured packets doesn't work instantly. Maybe it's perfectly normal but to be honest I've never seen this before. ...
0
votes
0answers
52 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
2answers
894 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
0answers
41 views

Duplicate SYN package forwarded by Docker?

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
0
votes
2answers
29 views

Ubuntu server - packets from different networks not coming through (flushed iptables)

I have set up a brand new Ubuntu server, and I'm encountering a very strange network related issue - the processes running on the server cannot 'see' packets originating from external networks, but ...
0
votes
1answer
194 views

Server send TCP ACK with wrong number after receiving SYN

I have a client establish new TCP connection then sends request to a server per second. Both client and server are on the same linux box (via loopback interface). The client periodically reports ...
4
votes
2answers
7k views

How filter only keep-alive packet with tcpdump

I need to analyze a traffic-dump on my network to check if all the PCs have enabled tcp keep-live features. I'm using tcpdump for that purpose. What I need to know is if there is a possibility to ...
2
votes
2answers
4k views

Filtering GRE enacpsulated packets with tcpdump

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre: 15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > 10.10....
0
votes
2answers
36 views

Monitor networking between two interfaces

I need to monitor TCP networking between two hosts which does not have tcpdump installed, and I cannot install on them. Is it possible to do so with tcpdump using some known rule ?
28
votes
3answers
39k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
3
votes
0answers
94 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
3
votes
2answers
5k views

TCP Messages Merged?

I have an application that sends 100 of 186-byte (excluding headers) TCP messages back to back without gap from host A to host B. I ran tcpdump to capture the packets on host A (where the sender is), ...
1
vote
2answers
56 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
77 views

How can tcpdump monitor TCP disconnect and log timedate stamp?

I have two servers each running a Java application that creates two separate TCP connections, one from HostA -> HostB and one from HostB -> HostA on separate ports. I am told the TCP connection is ...
0
votes
0answers
34 views

How does TCP PSH and HTTPS works?

Right now I monitor traffic on my VPN server. I'm using tcpdump for it and it works pretty good. sudo tcpdump -n host SENDER_IP In this example you can see one HTTPS request from SENDER_IP to ...
1
vote
0answers
49 views

Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic

We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
0
votes
0answers
26 views

Not getting TCP Update Window packet after TCP Zero Window begins

Once I get TCP Zero Window during data transmission, I can't send data anymore in that desktop sharing session. Even I stopped the data sending to check if it can resume but no benefit! In my test ...
4
votes
4answers
301 views

Monitor and collect statistics on TCP connection to src or dst host

I would like to collect stats on TCP/UDP packets sent between two hosts (A and B). I am looking for a tool to install on A and B to get the following information: kb/seconds packets/seconds (...