Tag Info

Hot answers tagged

41

Wireshark is probably the best, but if you want/need to look at the payload without loading up a GUI you can use the -X or -A options tcpdump -qns 0 -X -r serverfault_request.pcap 14:28:33.800865 IP 10.2.4.243.41997 > 69.59.196.212.80: tcp 1097 0x0000: 4500 047d b9c4 4000 4006 63b2 0a02 04f3 E..}..@.@.c..... 0x0010: 453b c4d4 a40d ...


30

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers. you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead? tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' it takes the same arguments as tcpdump ...


27

You can use tcpdump itself with the -C, -r and -w options tcpdump -r old_file -w new_files -C 10 The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.


22

The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter. With tcpdump I would use a filter like this. tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0" Check out the tcpdump man page, and pay close attention to the tcpflags. Be sure to also check out the sections in the Wireshark Wiki about capture and ...


20

Wireshark. You may never look back :) Incidentally you should make sure the snaplen of your original capture matches or exceeds the MTU of the traffic that you're capturing. Otherwise the contents will appear truncated.


14

You can use wireshark which is a gui app or you can use tshark which is it's cli counterpart. Besides, you can visualize the pcap using several visualization tools: tnv - The Network Visualizer or Time-based Network Visualizer afterglow - A collection of scripts which facilitate the process of generating graphs INAV - Interactive Network Active-traffic ...


13

take a look at ngrep - it mighe be of some use for you. as reference for others httpry [ server seems to be down now but i hope it's temporary ] and tshark are also useful for passive protocol analysis - first one just for http, second - for much more.


12

It's right there in the man pages, tcpdump has -G, If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name specified by -w which should include a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous. So, tcpdump -i eth0 -s 65535 ...


9

After doing a little more digging into my traffic, I was able to see that my data was nothing but a sequence of small bursts with small idle periods between them. With the useful tool ss, I was able to retrieve the current congestion window size of my connection (see the cwnd value in the output): [user@localhost ~]$ /usr/sbin/ss -i -t -e | grep -A 1 ...


9

You might want to check out the behaviour of tcpdump with strace, to see if it's doing anything odd like chrooting, if it's in gentoo or another distribution that might suid the binaries.


9

tshark can filter retransmission, duplicate ACK, lost segment, ... $ tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ "COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\ "COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\ "COUNT(tcp.analysis.fast_retransmission) ...


9

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.


9

I've used editcap in the past, with great success. editcap -c 1000 large-in.pcap smaller-out That command should generate one or more files named smaller-out-00000, smaller-out-00001 and so on, containing the firs, second, etc thousand packets from the input file.


8

I think it can be done using a filter like: "tcp[14] = 0 && tcp[15] = 0" The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.


8

Ok, I have solved the mystery. Follow along with me as we unravel Funtoo's TCPDump and the Mystery of the Missing pcap File. I used strace to see what's going on and the relevant lines are: chroot("/var/lib/tcpdump") = 0 chdir("/") = 0 --- SNIP --- open("/tmp/lol.wat", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 ENOENT ...


8

If you use wireshark/tshark, there is a pseudo-interface named 'any' which takes all the interfaces. tshark -i any Wireshark is available on all plateforms Edit : The any interface depends of libpcap : tcpdump have it ! tcpdump -i any


8

tcpdump stores incoming data in a ring buffer. If the buffer overflows before tcpdump processes its contents, then you lose packets. The default ring buffer size is probably 2048 (2MiB). To increase the buffer size, add the -B option: tcpdump -B 4096 ... You should also try using faster disk storage.


8

Building on this document, first we need to decide what our identifying trait is, so that the filter is successful and only picks out the heartbeats. Then, we need to get the hex representation of that identifier. Starting with the outbound heartbeat itself (which is essentially just a query/command), it is an admin command and contains the following ...


8

At your amount of traffic, I would claim that libpcap should have no trouble with dropped packets unless you have a particularly inefficient setup. If you are using tcpdump for capturing, it will report the amount of dropped packets in its final output line. If you see dropped packets, you might want to increase tcpdump's buffer size by supplying the -B ...


7

Yes, maybe, not necessarily. A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include: pcap file overhead. Every packet is timestamped, for instance. Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The ...


7

You can configure a custom log format for access logging which will include this information. Adjust your existing logging directives as needed, but you'll want something like this: LogFormat "%{Host}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_access_host CustomLog /var/log/wherever-you-put-it/access_log ...


7

You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers. Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers. Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is ...


7

Use the editcap utility which is distributed with Wireshark.


6

You may have a problem with different interfaces. By default tcpdump only listens on the first ethernet interface it finds. If you add "-i any" it will listen on every interface. As someone has mentioned already, you will end up capturing all the traffic to a particular ip address, regardless of the dns name you want. You can reduce the amount of data you ...


6

You could use iptables. If you're not already using it, you can use an open Accept configuration, but have a rule in place to do the counting. For example, on RHEL your /etc/sysconfig/iptables file could look something like: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A FORWARD -j INPUT -A INPUT -s 10.10.1.1 -p tcp -m tcp ...


6

Try this instead. tcpdump -w net75.out -s 0 net 65.192.0.0/10 man pcap-filter(7) dst net net True if the IPv4/v6 destination address of the packet has a net- work number of net. Net may be either a name from the networks database (/etc/networks, etc.) or a network number. An IPv4 network number can ...


6

Instead of logging all traffic, I would suggest the following: Monitor the number of packets sent to your server. If it exceeds a certain threshold, log a couple of 1000 packets, then wait for a longer time. That packet trace should contain plenty of information which can be used for analysis. Also, it will not impose too much additional load on your server ...


6

i tried on Centos 5, still the same even on tmp or root folder. from the tcpdump man page, privileges are dropped when used with -Z option (enabled by default) before opening first savefile. because you specified "-C 1", the permission denied occur because of the file size already reached 1, and when create new file it will raise an permission denied error. ...


5

There is no reason to disable IPv6 AAAA lookups (at least none you've given us), so my answer to you is please stop trying to outsmart your system and let it work the way it's intended to. By disabling IPv6 lookups now you're just setting yourself up for mysterious problems in the future when you add IPv6 to your environment and suddenly some systems aren't ...


5

No. tcp and port 10000 means "tcp port 10000" port 10000 means "tcp port 10000 or udp port 10000" and is a synonym for (tcp or udp) and port 10000 I would force TCP if I wanted, for example, to see only DNS packets that are being transported over TCP (as opposed to the default UDP). (tcpdump should have been named packetdump or netdump since it can ...



Only top voted, non community-wiki answers of a minimum length are eligible