tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

1
vote
2answers
166 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
2
votes
1answer
34 views

tcpdump - prevent interpreting/decoding protocols

Is there a way to stop tcpdump from (mis)interpreting protocols in captured packets? It assumes that traffic coming from port 4500/udp is always IPSec traffic, 53/udp is DNS query, etc and tries to ...
-1
votes
0answers
5 views

Can't connect local server by public domain name [migrated]

I have my server (Debian Wheezy) in my local home network. On that server I have my own DNS server (dnsmasq) for other local servers (so I can type name instead of local IP) and reverse proxy (nginx). ...
0
votes
0answers
49 views

“No route to host” when i do a telnet in azure

I have two VM's in azure with different public IP's and whose private IP's are : 10.10.1.9 10.10.1.6 When i do a telnet with following command from the server 10.10.1.6, i get the a error: telnet ...
0
votes
0answers
24 views

Large payload - connection get's Hung with CLOSE_WAIT or LAST_ACK state

We have a webservice client which posts data to a 3rd party Webservice. We are having an issue when the payload is a bit large (Around 600KB) xml. Once we pay the process hangs forever. The Netstat -...
0
votes
2answers
37 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
0
votes
1answer
42 views

Linux server failing to send SYN/ACK after receiving SYN remotely, works locally

Problem: A server process can be accessed by a device on the LAN or by the server itself, but it cannot be accessed outside the LAN (port forwarding is configured correctly as the server does receive ...
-1
votes
2answers
76 views

How does TCP offload NIC cause the TCP checksum to be invalid?

A tcpdump pcap exported and being investigated on another machine with wireshark is showing a lot of invalid TCP checksum messages. This is a known and documented phenomenon when using TCP offload ...
0
votes
2answers
32 views

Count number of incoming connection on a port - Linux

We have a server which listens on port X. The server has a large number of clients, from time to time the process gets hung, I am seeing SYN flooding messages in the log. I have been trying to tune ...
16
votes
5answers
13k views

How do I make tcpdump not print the tcp headers?

I tried this: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)' I need only the ascii part of it. How do I remove the rest?
-1
votes
2answers
895 views

Log network traffic with process ID on Mac OS X?

I want to log all network traffic on a Mac OS X server (like tcpdump does), but including the ID of the process that is responsible. Using lsof only gives me the current connections, not the past ones....
1
vote
2answers
44 views

How do I see absolute time stamps in Wireshark?

There is an example of pcap file opened in wireshark The second column is time. Is it possible to see absolute timestamps here instead of relative?
7
votes
2answers
8k views

tcpdump: capture one of several vlans

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says: The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
0
votes
1answer
24 views

Is it possible to specify tcpdump that I want it to interpret packet differently before printing it to STDOUT?

I am using iperf to pinpoint packet reordering issue. Unfortunately, tcpdump does not know how to parse iperf's UDP payload that I could use to pinpoint the issue. I know that iperf stores packet ...
0
votes
1answer
43 views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
1
vote
2answers
25 views

tcpdump http containing non expected payload bytes

I am monitoring an openvpn link with tcpdump a la tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n There is http/xml traffic going over that link which is basically caputered just fine. However, ...
4
votes
5answers
2k views

Determine originating process for outbound traffic

I can see that my server is sending out a lot of traffic. If I go to netstat -apln | grep httpd I can see that all the traffic is going to one IP. Is there a way I can see what script / file is ...
0
votes
1answer
36 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
1
vote
1answer
92 views

Use tcpdump to capture an ICMP destination unreachable message

I am new in this area. I am asked to use tcpdump to capture an ICMP destination unreachable message in my network course. So I am trying to capture one message that is an ICMP destination unreachable ...
1
vote
1answer
95 views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
45 views

NATted host cannot talk to itself unless virbr0 is in promiscuous mode

We have the following situation: A hypervisor using KVM-Qemu/libvirt with a single VM. The VM has the internal IP 192.168.122.151 on the default network pool using virbr0 on the hypervisor. We've ...
0
votes
1answer
27 views

tcpdump - filter applies after some time?

I have a strange problem with tcpdump - it's like the filter I want to be applied to captured packets doesn't work instantly. Maybe it's perfectly normal but to be honest I've never seen this before. ...
0
votes
0answers
46 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
2answers
851 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
0answers
38 views

Duplicate SYN package forwarded by Docker?

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
0
votes
2answers
29 views

Ubuntu server - packets from different networks not coming through (flushed iptables)

I have set up a brand new Ubuntu server, and I'm encountering a very strange network related issue - the processes running on the server cannot 'see' packets originating from external networks, but ...
0
votes
1answer
171 views

Server send TCP ACK with wrong number after receiving SYN

I have a client establish new TCP connection then sends request to a server per second. Both client and server are on the same linux box (via loopback interface). The client periodically reports ...
4
votes
2answers
7k views

How filter only keep-alive packet with tcpdump

I need to analyze a traffic-dump on my network to check if all the PCs have enabled tcp keep-live features. I'm using tcpdump for that purpose. What I need to know is if there is a possibility to ...
2
votes
2answers
4k views

Filtering GRE enacpsulated packets with tcpdump

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre: 15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > 10.10....
0
votes
2answers
36 views

Monitor networking between two interfaces

I need to monitor TCP networking between two hosts which does not have tcpdump installed, and I cannot install on them. Is it possible to do so with tcpdump using some known rule ?
26
votes
3answers
37k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
3
votes
0answers
81 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
3
votes
2answers
4k views

TCP Messages Merged?

I have an application that sends 100 of 186-byte (excluding headers) TCP messages back to back without gap from host A to host B. I ran tcpdump to capture the packets on host A (where the sender is), ...
1
vote
2answers
54 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
0answers
124 views

tcpdump on bridge interface (virbr) does not receive any packets destined for one of its addresses

Here's the configuration for the interface: # ifconfig virbr0 virbr0: flags=4355 mtu 1500 inet 192.168.11.1 netmask 255.255.255.255 broadcast 255.255.255.255 ether 52:54:00:99:e3:...
1
vote
1answer
65 views

How can tcpdump monitor TCP disconnect and log timedate stamp?

I have two servers each running a Java application that creates two separate TCP connections, one from HostA -> HostB and one from HostB -> HostA on separate ports. I am told the TCP connection is ...
0
votes
0answers
33 views

How does TCP PSH and HTTPS works?

Right now I monitor traffic on my VPN server. I'm using tcpdump for it and it works pretty good. sudo tcpdump -n host SENDER_IP In this example you can see one HTTPS request from SENDER_IP to ...
1
vote
0answers
47 views

Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic

We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
0
votes
0answers
26 views

Not getting TCP Update Window packet after TCP Zero Window begins

Once I get TCP Zero Window during data transmission, I can't send data anymore in that desktop sharing session. Even I stopped the data sending to check if it can resume but no benefit! In my test ...
4
votes
4answers
286 views

Monitor and collect statistics on TCP connection to src or dst host

I would like to collect stats on TCP/UDP packets sent between two hosts (A and B). I am looking for a tool to install on A and B to get the following information: kb/seconds packets/seconds (...
1
vote
1answer
223 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I don'...
2
votes
2answers
67 views

wget only works when tcpdump is listening

I am running two Virtual Machines over the XEN hypervisor both with Ubuntu trusty (Linaro-Developer version) with the following simple bridge networking setup: Backend domain (dom0): br0 ...
0
votes
0answers
71 views

“Filtered” port when accessing server

I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines. I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
1
vote
0answers
256 views

Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”

I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets. The CPU is a freaking i7, and i have yet to see CPU usage go above ...
0
votes
1answer
106 views

On-the-fly decoding HTTP bodies on Linux?

My wish is to monitor HTTP exchanges between my server and a browser. At present time, I use the localhost because I'm developping the app. I installed and used tcpflow and found it quite useful but ...
-1
votes
1answer
25 views

What does “-tnn” mean in “tcpdump -i eth0 -tnn dst port 80 -c 1000”

What does -tnn mean in tcpdump -i eth0 -tnn dst port 80 -c 1000. I didn't find -tnn on the man page, and I didn't find it on the Internet. Can anyone explain it to me?
4
votes
1answer
196 views

Finding google unusual traffic

We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
7
votes
1answer
1k views

Will tcpdump see packets that are being dropped by iptables?

I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp ...