Tag Info

Hot answers tagged

44

Wireshark is probably the best, but if you want/need to look at the payload without loading up a GUI you can use the -X or -A options tcpdump -qns 0 -X -r serverfault_request.pcap 14:28:33.800865 IP 10.2.4.243.41997 > 69.59.196.212.80: tcp 1097 0x0000: 4500 047d b9c4 4000 4006 63b2 0a02 04f3 E..}..@.@.c..... 0x0010: 453b c4d4 a40d ...


30

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers. you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead? tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' it takes the same arguments as tcpdump ...


30

You can use tcpdump itself with the -C, -r and -w options tcpdump -r old_file -w new_files -C 10 The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.


27

The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter. With tcpdump I would use a filter like this. tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0" Check out the tcpdump man page, and pay close attention to the tcpflags. Be sure to also check out the sections in the Wireshark Wiki about capture and ...


20

Wireshark. You may never look back :) Incidentally you should make sure the snaplen of your original capture matches or exceeds the MTU of the traffic that you're capturing. Otherwise the contents will appear truncated.


15

You can use wireshark which is a gui app or you can use tshark which is it's cli counterpart. Besides, you can visualize the pcap using several visualization tools: tnv - The Network Visualizer or Time-based Network Visualizer afterglow - A collection of scripts which facilitate the process of generating graphs INAV - Interactive Network Active-traffic ...


14

Seems like client 192.168.246.128 tried to connect to web server 192.168.246.13 but client's window size of 92 bytes was refused by a slow-read attack prevention mechanism.


13

take a look at ngrep - it mighe be of some use for you. as reference for others httpry [ server seems to be down now but i hope it's temporary ] and tshark are also useful for passive protocol analysis - first one just for http, second - for much more.


12

It's right there in the man pages, tcpdump has -G, If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name specified by -w which should include a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous. So, tcpdump -i eth0 -s 65535 ...


10

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.


10

tshark can filter retransmission, duplicate ACK, lost segment, ... $ tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ "COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\ "COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\ "COUNT(tcp.analysis.fast_retransmission) ...


9

I've used editcap in the past, with great success. editcap -c 1000 large-in.pcap smaller-out That command should generate one or more files named smaller-out-00000, smaller-out-00001 and so on, containing the firs, second, etc thousand packets from the input file.


9

You might want to check out the behaviour of tcpdump with strace, to see if it's doing anything odd like chrooting, if it's in gentoo or another distribution that might suid the binaries.


9

After doing a little more digging into my traffic, I was able to see that my data was nothing but a sequence of small bursts with small idle periods between them. With the useful tool ss, I was able to retrieve the current congestion window size of my connection (see the cwnd value in the output): [user@localhost ~]$ /usr/sbin/ss -i -t -e | grep -A 1 ...


9

If you use wireshark/tshark, there is a pseudo-interface named 'any' which takes all the interfaces. tshark -i any Wireshark is available on all plateforms Edit : The any interface depends of libpcap : tcpdump have it ! tcpdump -i any


8

Use the editcap utility which is distributed with Wireshark.


8

You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers. Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers. Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is ...


8

Ok, I have solved the mystery. Follow along with me as we unravel Funtoo's TCPDump and the Mystery of the Missing pcap File. I used strace to see what's going on and the relevant lines are: chroot("/var/lib/tcpdump") = 0 chdir("/") = 0 --- SNIP --- open("/tmp/lol.wat", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 ENOENT ...


8

tcpdump stores incoming data in a ring buffer. If the buffer overflows before tcpdump processes its contents, then you lose packets. The default ring buffer size is probably 2048 (2MiB). To increase the buffer size, add the -B option: tcpdump -B 4096 ... You should also try using faster disk storage.


8

Building on this document, first we need to decide what our identifying trait is, so that the filter is successful and only picks out the heartbeats. Then, we need to get the hex representation of that identifier. Starting with the outbound heartbeat itself (which is essentially just a query/command), it is an admin command and contains the following ...


8

At your amount of traffic, I would claim that libpcap should have no trouble with dropped packets unless you have a particularly inefficient setup. If you are using tcpdump for capturing, it will report the amount of dropped packets in its final output line. If you see dropped packets, you might want to increase tcpdump's buffer size by supplying the -B ...


7

You could use iptables. If you're not already using it, you can use an open Accept configuration, but have a rule in place to do the counting. For example, on RHEL your /etc/sysconfig/iptables file could look something like: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A FORWARD -j INPUT -A INPUT -s 10.10.1.1 -p tcp -m tcp ...


7

I think it can be done using a filter like: "tcp[14] = 0 && tcp[15] = 0" The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.


7

You can configure a custom log format for access logging which will include this information. Adjust your existing logging directives as needed, but you'll want something like this: LogFormat "%{Host}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_access_host CustomLog /var/log/wherever-you-put-it/access_log ...


7

Yes, maybe, not necessarily. A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include: pcap file overhead. Every packet is timestamped, for instance. Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The ...


7

i tried on Centos 5, still the same even on tmp or root folder. from the tcpdump man page, privileges are dropped when used with -Z option (enabled by default) before opening first savefile. because you specified "-C 1", the permission denied occur because of the file size already reached 1, and when create new file it will raise an permission denied error. ...


7

EDIT after reading comment by @GuntramBlohm on answer by @XavierLucas I did a quick check how do certain nmap scans look like on the wire and it seems pattern in OP is match for nmap -sT known as TCP connect scan e.g. case with port 80 open # nmap -sT localhost -p80 11:06:20.734518 IP 127.0.0.1.58802 > 127.0.0.1.80: Flags [S], seq 2064268743, win 32792, ...


7

If an IP packet is bigger than the MTU of the network link on which the packet is being sent, IP will fragment it into IP packets that can fit on the network; that's done by the IP layer, not the UDP layer. The MTU of an Ethernet is normally 1500 bytes (the maximum Ethernet packet size is 1518, which includes 14 bytes of header, 1500 bytes of payload, and 4 ...


6

tshark -r file.pcap -V is very useful if you're stuck without wireshark/gui.


6

You may have a problem with different interfaces. By default tcpdump only listens on the first ethernet interface it finds. If you add "-i any" it will listen on every interface. As someone has mentioned already, you will end up capturing all the traffic to a particular ip address, regardless of the dns name you want. You can reduce the amount of data you ...



Only top voted, non community-wiki answers of a minimum length are eligible