tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

0
votes
3answers
72 views

how to use tcpdump to log only certain data in real time

I'd like to monitor network interfaces but only log things likes errors, collisions and dropped packets. The send that to stdout. – Can tcpdump be configured to do this?
2
votes
1answer
76 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ ...
2
votes
1answer
303 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
2
votes
1answer
38 views

Network interface reading traffic from 2 different hosts

Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this ...
1
vote
1answer
43 views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
1
vote
1answer
260 views

Why does OS X spend one more packet to establish and close a TCP connection?

Linux spends 3 packets to establish a TCP connection and 3 packets to close it, as shown by the tcpdump capture # establishing TCP connection 22:37:09.150456 IP 127.0.0.1.49327 > 127.0.0.1.8000: ...
1
vote
1answer
174 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
1
vote
1answer
183 views

tcpdump not giving details

Why does tcpdump not give my more details? Each time it only comes as - 16:22:26.128541 [|ether] # ./tcpdump -vv not port 22 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size ...
0
votes
1answer
62 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
0
votes
1answer
221 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
0
votes
1answer
113 views

What can possibly prevent tcpdump from showing request packets?

I am trying to debug a little SOAP issue. I am using a java web app to consume an API over a VPN. ping and telnet on the webservice server are fine.The Environment is aws ec2 for my app. I have no ...
0
votes
1answer
122 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
0
votes
1answer
344 views

How can I dump nginx requests for a specific location while nginx is secured?

I want to dump all request that nginx is getting for a specific location so I can debug a strange problem that I have. Usually tcpdump would be the solution but remember that nginx is accessed using ...
0
votes
1answer
53 views

Check if traffic is gzipped

I have an application server running on port 80. How can I check if the incoming and outgoing traffic is gzipped? Also, the application communicates with another server (also HTTP requests). I'd like ...
0
votes
1answer
495 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
0
votes
1answer
208 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1answer
626 views

TCP Sessions Hanging with Debian and iptables

Up until now I have been using a CentOS 5.x PC with 2x NICs running iptables as a router for my network. It worked great but recently I decided to get a DreamPlug which runs Debian 5.0.3/kernel ...
0
votes
1answer
775 views

dhcp-server + iptables: Can't share ppp internet connection

I had this configuration before, and it used to work well, but now I got a new server and I can't setup it to share the internet connection from ppp0. I'm on Debian testing. The client connects ...
2
votes
0answers
128 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
2
votes
0answers
1k views

How to know the source of certain TCP traffic on AIX

We have two AIX boxes, one for production system and another for testing. both systems are running ATM machine switches, where the ATM device is connected via TCP socket. we had an issue on ...
1
vote
0answers
693 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
1
vote
0answers
34 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null ...
1
vote
0answers
198 views

Massively large number of packets dropped by interface

I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g. 4 packets captured 402 packets ...
1
vote
0answers
71 views

tcpdump expression to show zero-byte ACKs?

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding ...
1
vote
0answers
179 views

Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”

I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets. The CPU is a freaking i7, and i have yet to see CPU usage go above ...
1
vote
0answers
86 views

tcpdump strange udp line

I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form: timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength but this is just: ...
0
votes
0answers
50 views

Nginx TCP Fast Open Issue

I have configured Nginx and Apache on one of my servers. The nginx server listens on port 80 and Apache on port 81. Nginx works as a reverse proxy. In nginx I configured TCP Fast Open: server { ...
0
votes
0answers
46 views

Filtering GRE enacpsulated packets with tcpdump

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre: 15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > ...
0
votes
0answers
37 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...
0
votes
0answers
58 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
0answers
62 views

Analyzing TCPDUMP results for failed request

I'm making http POST calls to a database every 30 seconds, both the server and database are on the same host. Every 5 minutes or so, I get an error back from the endpoint indicating that the request ...
0
votes
0answers
69 views

multicast packets: when are they received with the receivers ip and when with a multicast ip

I am trying to connect 2 computers running jack for audio re-routing. Jack communicates through multicast packets on address 225.3.19.154 (port 19000) by default. I have successfully connected linux ...
0
votes
0answers
78 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
0
votes
0answers
90 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
0
votes
0answers
209 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...
0
votes
0answers
76 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
0
votes
0answers
275 views

Tcpdump stops capturing wifi data while running in the background

I have a problem capturing wifi data using tcpdump while running in the background. OK, lets get some facts: my wifi-device is named wlan0 wlan0 is in monitor mode (that's what I want) I'm using ...
0
votes
0answers
223 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
0
votes
0answers
53 views

why tcpdump drop package for long running request?

I turn on tcpdump to capture requests going to my webserver. However, some of the requests are not captured by tcpdump but they showed up in apache access log. Those requests are usually long running ...
0
votes
0answers
881 views

PPTP refusing to connect when client is windows

I have a PPTP server running and I can connect to it from linux. When I try from windows 7 (2 instances tested) it fails. Here's the syslog for such a conn: pptpd[540]: CTRL: Client 109.xxx.158.201 ...
0
votes
0answers
640 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...