I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form:

timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength

but this is just:

timestamp IP srcaddress > dstaddress: udp

note the missing port numbers, the lowercase udp and the missing packet length.

Does somebody know what's this?

  • Just udp, not [|udp]? What does tcpdump -h print?
    – user137177
    Apr 30 '15 at 19:43
  • @GuyHarris: as you can see this was a long time ago.. not even sure how to reproduce it in a different environment.. May 1 '15 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.