2

Running /usr/sbin/tcpdump -n dst ${some_ip} and dst port 80 on two different but similar (distro, version) servers gives me different capture sizes (65535 bytes for one, 262144 bytes for another).

What might cause this difference in tcpdump capture size? What discrepencies might it cause in resulting data output?

EDIT: ldd $(which tcpdump) has the same output on both servers:

    linux-vdso.so.1 =>  (0xdeadbeef)
    libcrypto.so.1.0.0 => /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 (0xdeadbeef)
    libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 (0xdeadbeef)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0xdeadbeef)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0xdeadbeef)
    /lib64/ld-linux-x86-64.so.2 (0xdeadbeef)

Ah, but kernel versions differ, must be something to do with that...

capture size 65535:
    Ubuntu 14.04.4, Linux 3.13.0-85-generic
capture size 262144:
    Ubuntu 14.04.5, Linux 3.13.0-116-generic
1
  • Are the two network interfaces of the two servers exactly the same ? Same layer 2 ? Same card ? Same driver ? Jun 13, 2017 at 20:03

1 Answer 1

2

Snapshot Length

Look at tcpdump.org and search for snapshot-length. The default is based on your version of libpcap or any custom capture driver you are using.

7
  • libpcap same versions on both servers, though there are two so's on both, 1.5.3 and 0.8. What other capture drivers might there be?
    – mVChr
    Jun 12, 2017 at 17:31
  • Verify that tcpdump in the path is the same on both boxes, which tcpdump, then use ldd tcpdump to verify what libraries it is using.
    – Aaron
    Jun 12, 2017 at 17:35
  • ldd $(which tcpdump) has exactly the same filename output on both servers.
    – mVChr
    Jun 12, 2017 at 17:38
  • AFAIK, that is hard coded in libpcap, so if they are the same version on both servers, the default snapshot length should be identical. If this is an RPM based distro, then you could verify the integrity of the files in libpcap and tcpdump to verify someone didn't recompile and overwrite them.
    – Aaron
    Jun 12, 2017 at 17:45
  • Ah, I unintentionally lied about the servers being the same, the distro and kernel versions slightly differ (see edit). If no one provides extra info I'll accept your answer. Thanks.
    – mVChr
    Jun 12, 2017 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.