tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

2
votes
3answers
2k views

tcpdump filter according to http header content

using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache. that means that i need to filter according to the ...
0
votes
1answer
338 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
31
votes
8answers
112k views

How can I read pcap files in a friendly format?

a simple cat on the pcap file looks terrible: $cat tcp_dump.pcap ?ò????YVJ? JJ ?@@.?E<??@@ ?CA??qe?U????иh? .Ceh?YVJ?? JJ ?@@.?E<??@@ ...
3
votes
2answers
839 views

Cheap way to detect client round trip times for http

I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this? There are far to many connections, and pinging each ip is ...
3
votes
1answer
875 views

tcpdump udp data capture latency

I am using tcpdump to capture UDP packets and analyze network latency between a UDP broadcaster and my server. To calculate latency I compare the source host timestamps reported in UDP application ...
1
vote
2answers
1k views

Why Packet Loss AFTER tcpdump has logged the packet?

We encounter some strange packet loss and want to know the reason for this. We have an imageserver and a server for stressing the imageserver. Both are located in the same datacenter First we run a ...
1
vote
2answers
2k views

How can I capture traffic with tcpdump and a sliding window or sort of “logrotate”?

I want to capture some traffic with tcpdump for troubleshooting. The problem is, the error is not reproducible. To not fill up the hole disks with captures, I would like to capture the traffic with ...
4
votes
2answers
5k views

Pings from VPN network to VPN client work; pings into from VPN client to VPN network fail - why?

We are in the process of setting up an OpenVPN server for some servers running in a cloud. We are stumped with a connectivity problem whereby the hosts on the VPN server's LAN can ping te VPN client, ...
1
vote
2answers
353 views

Tap0 not receiving traffic

I have created a tap device tap0 address 10.2.1.4 and added it to a host bridge br1 with address 10.2.1.1 I have "nc 10.2.1.4 -l 1234" running on the host and from another machine I do a "nc ...
1
vote
2answers
4k views

How to get http requests details in a tcpdump?

I am trying to get a tcpdump trace of some http requests. Here is what I got so far (I replaced the real IP addresses with REMOTE and LOCAL): C:\>Windump -na -i 3 ip host REMOTE and ip src LOCAL ...