tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

10
votes
1answer
439 views

SynProxy can not return syn ack packets with asymmetric dual bridge topology

I have a asymmetric dual bridge topology as shown below when i connect from 172.16.11.5 and 172.16.10.6 with ssh but i can not connect because of SynProxy. ------- ...
4
votes
1answer
198 views

Finding google unusual traffic

We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
2
votes
1answer
160 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ "...
2
votes
1answer
896 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
2
votes
1answer
43 views

Network interface reading traffic from 2 different hosts

Situation: Server A is receiving network traffic sent from server B to server C. Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this ...
1
vote
1answer
100 views

Use tcpdump to capture an ICMP destination unreachable message

I am new in this area. I am asked to use tcpdump to capture an ICMP destination unreachable message in my network course. So I am trying to capture one message that is an ICMP destination unreachable ...
1
vote
1answer
306 views

How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)

tcpdump don't know how to strip TCP headers from packed data. tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible. Did I overlooked some ...
1
vote
1answer
288 views

Why does OS X spend one more packet to establish and close a TCP connection?

Linux spends 3 packets to establish a TCP connection and 3 packets to close it, as shown by the tcpdump capture # establishing TCP connection 22:37:09.150456 IP 127.0.0.1.49327 > 127.0.0.1.8000: ...
1
vote
1answer
194 views

TCP stops sending weirdly

In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
1
vote
1answer
200 views

tcpdump not giving details

Why does tcpdump not give my more details? Each time it only comes as - 16:22:26.128541 [|ether] # ./tcpdump -vv not port 22 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size ...
0
votes
1answer
28 views

tcpdump - filter applies after some time?

I have a strange problem with tcpdump - it's like the filter I want to be applied to captured packets doesn't work instantly. Maybe it's perfectly normal but to be honest I've never seen this before. ...
0
votes
1answer
177 views

Server send TCP ACK with wrong number after receiving SYN

I have a client establish new TCP connection then sends request to a server per second. Both client and server are on the same linux box (via loopback interface). The client periodically reports ...
0
votes
1answer
369 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
3
votes
0answers
84 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
2
votes
0answers
159 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
2
votes
0answers
1k views

How to know the source of certain TCP traffic on AIX

We have two AIX boxes, one for production system and another for testing. both systems are running ATM machine switches, where the ATM device is connected via TCP socket. we had an issue on ...
1
vote
0answers
38 views

Duplicate SYN package forwarded by Docker?

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
1
vote
0answers
124 views

tcpdump on bridge interface (virbr) does not receive any packets destined for one of its addresses

Here's the configuration for the interface: # ifconfig virbr0 virbr0: flags=4355 mtu 1500 inet 192.168.11.1 netmask 255.255.255.255 broadcast 255.255.255.255 ether 52:54:00:99:e3:...
1
vote
0answers
48 views

Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic

We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
1
vote
0answers
48 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
1
vote
0answers
90 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
1
vote
0answers
165 views

how to use tcpdump on interface with link down

A set of daemon applications communicating over UDP broadcasts on the same machine give me trouble capturing their traffic. The network interface is eth0, it's configured to a static IP and there's no ...
1
vote
0answers
59 views

Unusual Behavior with NIC Interrupt Moderation Disabled

OS: Centos7 I disabled interrupt moderation, ethtool -C eno2 rx-usecs 0, and then started capturing on that interface using tcpdump. The dump file was growing as expected. Maybe an hour later the ...
1
vote
0answers
574 views

Nginx TCP Fast Open Issue

I have configured Nginx and Apache on one of my servers. The nginx server listens on port 80 and Apache on port 81. Nginx works as a reverse proxy. In nginx I configured TCP Fast Open: server { ...
1
vote
0answers
3k views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
1
vote
0answers
61 views

An already acknowledged data sequence number is coming back as null byte repeatedly

There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null (...
1
vote
0answers
351 views

Use tcpdump to find interface errors

I looking for what's causing dropped packets on an interface: RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0 TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0 I ...
1
vote
0answers
403 views

Massively large number of packets dropped by interface

I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g. 4 packets captured 402 packets ...
1
vote
0answers
109 views

tcpdump expression to show zero-byte ACKs?

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding tcpKeepAlive=...
1
vote
0answers
259 views

Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”

I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets. The CPU is a freaking i7, and i have yet to see CPU usage go above ...
1
vote
0answers
90 views

tcpdump strange udp line

I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form: timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength but this is just: ...
0
votes
0answers
19 views

How to figure out why my NAT-box sends TCP RST packets?

TL;DR: I see that an ubuntu (which I have an absolute control of) host sends a packet under certain circumstances. How to find the application/kernel module responsible for that packet? I am ...
0
votes
0answers
53 views

“No route to host” when i do a telnet in azure

I have two VM's in azure with different public IP's and whose private IP's are : 10.10.1.9 10.10.1.6 When i do a telnet with following command from the server 10.10.1.6, i get the a error: telnet ...
0
votes
0answers
24 views

Large payload - connection get's Hung with CLOSE_WAIT or LAST_ACK state

We have a webservice client which posts data to a 3rd party Webservice. We are having an issue when the payload is a bit large (Around 600KB) xml. Once we pay the process hangs forever. The Netstat -...
0
votes
0answers
46 views

NATted host cannot talk to itself unless virbr0 is in promiscuous mode

We have the following situation: A hypervisor using KVM-Qemu/libvirt with a single VM. The VM has the internal IP 192.168.122.151 on the default network pool using virbr0 on the hypervisor. We've ...
0
votes
0answers
49 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
0answers
33 views

How does TCP PSH and HTTPS works?

Right now I monitor traffic on my VPN server. I'm using tcpdump for it and it works pretty good. sudo tcpdump -n host SENDER_IP In this example you can see one HTTPS request from SENDER_IP to ...
0
votes
0answers
26 views

Not getting TCP Update Window packet after TCP Zero Window begins

Once I get TCP Zero Window during data transmission, I can't send data anymore in that desktop sharing session. Even I stopped the data sending to check if it can resume but no benefit! In my test ...
0
votes
0answers
71 views

“Filtered” port when accessing server

I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines. I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
0
votes
0answers
355 views

Sometimes unable to tune Linux TCP stack for improved high-latency performance

I have been unsuccessfully trying to apply the TCP Tuning techniques discussed at http://fasterdata.es.net/host-tuning/ As you'll see when you read through the entire question, sometimes the es.net ...
0
votes
0answers
55 views

pfsend does not send a pcap file at specified rate

I'm replaying traffic using pfsend application that comes from PF_RING. I'm using SMIA pcap file to evaluate Bro and Snort on a multi-core machine. Using pfsend, we can specify at which rate the pcap ...
0
votes
0answers
54 views

OOM Killer when tcpdump is run in system with low memory

I am working on an embedded system with limited memory. Here is the dump from my vmstat: procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu----- r b swpd free buff ...
0
votes
0answers
99 views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
0
votes
0answers
38 views

tcpdump returns no multicast traffic when a DNS entry is being used in resolv.conf

I have noticed on a 6.5 Centos host that when I am using tcpdump to determine if a multicast source is being received/ sent that it does appear to get any results when I have a DNS registered in the /...
0
votes
0answers
130 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
0answers
138 views

amazon ec2 ftp RETR hangs

The problem is with an Amazon ec2 instance "Red Hat Enterprise Linux Server 7.0 (Maipo)" (kernel 3.10.0-123.6.3.el7.x86_64) When attempting to RETR a remote file the FTP client hangs indefinitely. I ...
0
votes
0answers
495 views

tcpdump on any interface does not support VLAN

I have tried the following command: tcpdump -i any vlan , on both Ubuntu 10.04 (kernel 2.6.32-36) and Ubuntu 12.04 (kernel 3.8.0-39) and got the following output: tcpdump: no VLAN support for data ...
0
votes
0answers
129 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
0
votes
0answers
421 views

Tcpdump stops capturing wifi data while running in the background

I have a problem capturing wifi data using tcpdump while running in the background. OK, lets get some facts: my wifi-device is named wlan0 wlan0 is in monitor mode (that's what I want) I'm using ...
0
votes
0answers
1k views

PPTP refusing to connect when client is windows

I have a PPTP server running and I can connect to it from linux. When I try from windows 7 (2 instances tested) it fails. Here's the syslog for such a conn: pptpd[540]: CTRL: Client 109.xxx.158.201 ...