tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

learn more… | top users | synonyms

31
votes
8answers
112k views

How can I read pcap files in a friendly format?

a simple cat on the pcap file looks terrible: $cat tcp_dump.pcap ?ò????YVJ? JJ ?@@.?E<??@@ ?CA??qe?U????иh? .Ceh?YVJ?? JJ ?@@.?E<??@@ ...
28
votes
6answers
58k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
12
votes
3answers
18k views

how to split a pcap file into a set of smaller ones

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? ...
9
votes
6answers
15k views

How to capture ack or syn packets by Tcpdump?

I want to know the filter rule , thanks!
8
votes
3answers
4k views

Why won't tcpdump write a pcap file?

In the process of debugging a python irc bot that can't seem to connect, I thought "I know, I'll just tcpdump it and see what it's doing." So I ran tcpdump like I usually do and it says it's captured ...
8
votes
5answers
3k views

How do I make tcpdump not print the tcp headers?

I tried this: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)' I need only the ascii part of it. How do I remove the rest?
7
votes
5answers
4k views

How to Break Up Large tcpdump Files

Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data? Like -C but after the fact.
7
votes
2answers
1k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
6
votes
4answers
3k views

Monitor number of bytes transferred to/from IP address on port

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port. The equivalent tcpdump command would be: tcpdump ...
5
votes
2answers
3k views

Lots of dropped packages when tcpdumping on busy interface

My challenge I need to do tcpdumping of a lot of data - actually from 2 interfaces left in promiscuous mode that are able to see a lot of traffic. To sum it up Log all traffic in promiscuous mode ...
5
votes
2answers
4k views

Clarification about Linux TCP window size and delays

I have delays when sending data through a TCP channel I am not able to understand. The link is a 1Gb link with a end to end latency of roughly 40ms. In my current setup, latency (the time from one ...
5
votes
1answer
195 views

How can I filter MongoDB Replica Set Heartbeats with tcpdump?

Occasionally, when troubleshooting the health of a replica set, I'd like to filter out the heartbeat packets specifically, track them going out, and the subsequent reply (or lack thereof) without all ...
5
votes
1answer
3k views

tcpdump: capture one of several vlans

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says: The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
5
votes
2answers
295 views

Ubuntu 12 crashed and took down network

We recently set up a new Ubuntu 12.04LTS server on our network. It's not fully configured so it's not doing much beyond sshd and a default apache2 install. But this evening it appears to have ...
5
votes
4answers
4k views

Packet loss rate with iperf and tcpdump

I tested a line for its link quality with iperf. The measured speed (UDP port 9005) was 96Mbps, which is fine, because both servers are connected with 100Mbps to the internet. On the other hand the ...
4
votes
1answer
6k views

Too many incorrect checksum errors in TCPDUMP

I find too many incorrect checksum errors from a TCPDUMP done on a GNU Linux 64bit server. There are close to 50% incorrect chekcsums in the export? cksum 0xe61f (incorrect (-> 0x8c37) How can we ...
4
votes
1answer
452 views

how to view hostnames in traffic entering my webserver (Apache)?

Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver? For example, say the webserver is set up to process incoming traffic for an IP address, ...
4
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
4
votes
2answers
5k views

Pings from VPN network to VPN client work; pings into from VPN client to VPN network fail - why?

We are in the process of setting up an OpenVPN server for some servers running in a cloud. We are stumped with a connectivity problem whereby the hosts on the VPN server's LAN can ping te VPN client, ...
4
votes
1answer
204 views

Can tcpdump tell accessed port numbers?

I have a server with two NICs, and I would like to only have those ports open on eth1 that are being used. Question How do I get tcpdump to tell me the port numbers that is being accessed on eth1?
4
votes
2answers
2k views

tcpdump filter that excludes private ip traffic

For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net ...
4
votes
1answer
653 views

How to reproduce http traffic of a real site in another environment (e.g. VM)

There is a bug in my web application which I cannot reproduce. All the logs look ok or at least I cannot see anything unusual. But it happens. So I thought I could record all the traffic to/from my ...
4
votes
3answers
2k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
4
votes
4answers
4k views

How to display interface in tcpdump output flow?

This seems to be quite a trivial problem, but after some searching I can't stil figure out the answer. One can run tcpdump using "any" as the interface description, ie: # tcpdump -i any -n host ...
4
votes
2answers
734 views

Anyone can tell their experience with 10g Ethernet adapters on Linux

I wonder if any of you have an experience with 10g NICs (Intel, Myricom, SMC tiget, napatech, or by any other brand). Questions are: Was it easy to install, or a hassle, How does this adapter ...
4
votes
1answer
541 views

tcpdump and congestion window

Sniffing http traffic to my (linux) server it seems like it always responds advertising a window size of 14. It isn't affected if I change the default initcwnd size (with ip route), and it doesn't ...
4
votes
1answer
124 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
4
votes
2answers
3k views

What do “Unknown SSAP” and “Unknown DSAP” mean in tcpdump?

While trying to fix a problem with intermittently losing internet connection on a machine with a wireless connection to a router, I ran tcpdump and noticed packets with "Unknown SSAP" and "Unknown ...
3
votes
6answers
2k views

Log tcpdump Output

What I basically want is to to write all tcpdump captured packets to a file every 3 days. So basically tcpdump should run for 24 hours on day 1 and write the output to Day1.log and similar for Day2 ...
3
votes
6answers
2k views

Dumping rawdata for a host on a proxy using tcpdump

Im trying to save the rawdata that is beeing sent throu our proxy to a specific url. A friend of mine gave me the tip to use tcpdump, so I started reading about it on their page. But for some reason I ...
3
votes
3answers
117 views

Recording network traffic on one linux box, transferring it to another in real time

I have a situation where I want to capture all of the network traffic on one Linux box (currently using tcpdump) but have that data transferred in real time to another Linux on a separate (but ...
3
votes
2answers
288 views

tcpdump file size == traffic size?

I created a tcpdump file: tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp duration was about 3 hours. This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
3
votes
2answers
614 views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
3
votes
1answer
6k views

tcpdump filter on network and subnet mask

I'm using the following tcpdump command: tcpdump -w net75.out -s 0 host 65.207.95.222 I want to change the filter on the single host to be all addresses in the following subnet: 65.192.0.0/10 I ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and ...
3
votes
3answers
1k views

TCP segments of an HTTP Request in wrong order

My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...
3
votes
1answer
617 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
3
votes
1answer
198 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
3
votes
1answer
92 views

How do I get the network usage of a server per-IP?

I'd like to know a tool to programmatically measure, in KB/s, the load that each IP applies to a server. So far, tcpdump does a good job at telling me the amount of packets sent per second, but I ...
3
votes
2answers
830 views

Cheap way to detect client round trip times for http

I am trying to figure out a way to detect round trip times for each IP that connects to port 80 on my server. What is a good way to do this? There are far to many connections, and pinging each ip is ...
3
votes
2answers
1k views

tcpdump dns output codes

Captured on the nameserver: 21:54:35.391126 IP resolver.7538 > server.domain: 57385% [1au] A? www.domain.de. (42) What das the percent sign in 57385% mean? As far as I can see 57385 is the ...
3
votes
1answer
874 views

tcpdump udp data capture latency

I am using tcpdump to capture UDP packets and analyze network latency between a UDP broadcaster and my server. To calculate latency I compare the source host timestamps reported in UDP application ...
3
votes
1answer
331 views

Incoming packets to server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
3
votes
1answer
531 views

tcpdump shows traffic until I use a filter

I have a server that is receiving traffic from a mirror port on a switch. The interface that is connected to this mirror port is in promisc mode. When I use just a plain catch all tcpdump on the ...
3
votes
1answer
952 views

Daemon can't be started from fabric script or on boot - only interactively

I have a daemon script in /etc/init.d that performs some background packet logging using the tcpdump command. The script starts up fine using an interactive shell using sudo /etc/init.d/packetlog ...
3
votes
1answer
126 views

Why isn't 'ether proto \ip host host' a legal tcpdump expression?

In its description of valid tcpdump expressions, the pcap-filter man pages state: The filter expression consists of one or more primitives. Primitives usually consist of an id (name or number) ...
3
votes
1answer
408 views

How to debug why WAN TCP/IP throughput is lower than expected?

I'm trying to figure out why tcp/ip throughput between two hosts I control is much lower than expected. Host A: internet connectivity provided by Comcast (Residential) in Boston Metro -- can ...
3
votes
1answer
1k views

Kill FINished sockets (using libpcap - tcpdump/tcpkill)

I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1): tcpdump "tcp[tcpflags] & tcp-fin != 0" ...
2
votes
2answers
3k views

how to calculate packet loss from a binary TCPDUMP file

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not) It must be some kind of packet loss, because from ...
2
votes
5answers
1k views

tcpdump: out.pcap: Permission denied

[root@localhost ~]# cat /etc/issue Fedora release 17 (Beefy Miracle) Kernel \r on an \m (\l) [root@localhost ~]# uname -a Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC ...