Tag Info

Hot answers tagged

47

Wireshark is probably the best, but if you want/need to look at the payload without loading up a GUI you can use the -X or -A options tcpdump -qns 0 -X -r serverfault_request.pcap 14:28:33.800865 IP 10.2.4.243.41997 > 69.59.196.212.80: tcp 1097 0x0000: 4500 047d b9c4 4000 4006 63b2 0a02 04f3 E..}..@.@.c..... 0x0010: 453b c4d4 a40d ...


34

The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter. With tcpdump I would use a filter like this. tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0" Check out the tcpdump man page, and pay close attention to the tcpflags. Be sure to also check out the sections in the Wireshark Wiki about capture and ...


32

You can use tcpdump itself with the -C, -r and -w options tcpdump -r old_file -w new_files -C 10 The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.


30

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers. you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead? tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' it takes the same arguments as tcpdump ...


21

Wireshark. You may never look back :) Incidentally you should make sure the snaplen of your original capture matches or exceeds the MTU of the traffic that you're capturing. Otherwise the contents will appear truncated.


16

Seems like client 192.168.246.128 tried to connect to web server 192.168.246.13 but client's window size of 92 bytes was refused by a slow-read attack prevention mechanism.


15

You can use wireshark which is a gui app or you can use tshark which is it's cli counterpart. Besides, you can visualize the pcap using several visualization tools: tnv - The Network Visualizer or Time-based Network Visualizer afterglow - A collection of scripts which facilitate the process of generating graphs INAV - Interactive Network Active-traffic ...


13

take a look at ngrep - it mighe be of some use for you. as reference for others httpry [ server seems to be down now but i hope it's temporary ] and tshark are also useful for passive protocol analysis - first one just for http, second - for much more.


13

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.


13

It's right there in the man pages, tcpdump has -G, If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name specified by -w which should include a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous. So, tcpdump -i eth0 -s 65535 ...


10

After doing a little more digging into my traffic, I was able to see that my data was nothing but a sequence of small bursts with small idle periods between them. With the useful tool ss, I was able to retrieve the current congestion window size of my connection (see the cwnd value in the output): [user@localhost ~]$ /usr/sbin/ss -i -t -e | grep -A 1 ...


10

tshark can filter retransmission, duplicate ACK, lost segment, ... $ tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ "COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\ "COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\ "COUNT(tcp.analysis.fast_retransmission) ...


10

Use the editcap utility which is distributed with Wireshark.


9

I've used editcap in the past, with great success. editcap -c 1000 large-in.pcap smaller-out That command should generate one or more files named smaller-out-00000, smaller-out-00001 and so on, containing the firs, second, etc thousand packets from the input file.


9

You could use iptables. If you're not already using it, you can use an open Accept configuration, but have a rule in place to do the counting. For example, on RHEL your /etc/sysconfig/iptables file could look something like: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A FORWARD -j INPUT -A INPUT -s 10.10.1.1 -p tcp -m tcp ...


9

Try this instead. tcpdump -w net75.out -s 0 net 65.192.0.0/10 man pcap-filter(7) dst net net True if the IPv4/v6 destination address of the packet has a net- work number of net. Net may be either a name from the networks database (/etc/networks, etc.) or a network number. An IPv4 network number can ...


9

You might want to check out the behaviour of tcpdump with strace, to see if it's doing anything odd like chrooting, if it's in gentoo or another distribution that might suid the binaries.


9

When tcpdump is running, it will be fairly prompt at reading in the incoming frames. My hypothesis is that the NIC's packet ring buffer settings may be a bit on the small size; when tcpdump is running it is getting emptied in a more timely manner. If you're a Red Hat subscriber, then this support article is very useful Overview of Packet Reception. It has ...


9

Building on this document, first we need to decide what our identifying trait is, so that the filter is successful and only picks out the heartbeats. Then, we need to get the hex representation of that identifier. Starting with the outbound heartbeat itself (which is essentially just a query/command), it is an admin command and contains the following ...


9

If you use wireshark/tshark, there is a pseudo-interface named 'any' which takes all the interfaces. tshark -i any Wireshark is available on all plateforms Edit : The any interface depends of libpcap : tcpdump have it ! tcpdump -i any


9

tcpdump stores incoming data in a ring buffer. If the buffer overflows before tcpdump processes its contents, then you lose packets. The default ring buffer size is probably 2048 (2MiB). To increase the buffer size, add the -B option: tcpdump -B 4096 ... You should also try using faster disk storage.


9

i tried on Centos 5, still the same even on tmp or root folder. from the tcpdump man page, privileges are dropped when used with -Z option (enabled by default) before opening first savefile. because you specified "-C 1", the permission denied occur because of the file size already reached 1, and when create new file it will raise an permission denied error. ...


8

Here's a one-liner I came up with for displaying request and response HTTP headers using tcpdump (which should work for your case too): sudo tcpdump -A -s 10240 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r ...


8

EDIT after reading comment by @GuntramBlohm on answer by @XavierLucas I did a quick check how do certain nmap scans look like on the wire and it seems pattern in OP is match for nmap -sT known as TCP connect scan e.g. case with port 80 open # nmap -sT localhost -p80 11:06:20.734518 IP 127.0.0.1.58802 > 127.0.0.1.80: Flags [S], seq 2064268743, win 32792, ...


8

At your amount of traffic, I would claim that libpcap should have no trouble with dropped packets unless you have a particularly inefficient setup. If you are using tcpdump for capturing, it will report the amount of dropped packets in its final output line. If you see dropped packets, you might want to increase tcpdump's buffer size by supplying the -B ...


8

Ok, I have solved the mystery. Follow along with me as we unravel Funtoo's TCPDump and the Mystery of the Missing pcap File. I used strace to see what's going on and the relevant lines are: chroot("/var/lib/tcpdump") = 0 chdir("/") = 0 --- SNIP --- open("/tmp/lol.wat", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 ENOENT ...


8

You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers. Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers. Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is ...


7

You can configure a custom log format for access logging which will include this information. Adjust your existing logging directives as needed, but you'll want something like this: LogFormat "%{Host}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_access_host CustomLog /var/log/wherever-you-put-it/access_log ...


7

I made a script to see the top "synners". For that, I consider only the initial syn packet (the first packet of the three packets handshake). That is, syn = 1, ack = 0 while :; do date; tcpdump -i eth1 -n -c 100 \ 'tcp[tcpflags] & (tcp-syn) != 0' and 'tcp[tcpflags] & (tcp-ack) == 0' 2> /dev/null \ | awk '{ print $3}' \ | sort | uniq ...


7

I think it can be done using a filter like: "tcp[14] = 0 && tcp[15] = 0" The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.



Only top voted, non community-wiki answers of a minimum length are eligible