Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
441
questions
0
votes
1
answer
46
views
Linux: bridge vs. vlan vs. tcpdump
I have a Proxmox host with kernel 5.15.19-2-pve.
It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic.
I created a vmbr666 bridge that shows looks like this:
# /etc/...
- 641
0
votes
1
answer
31
views
docker containaer promiscuous mode partially working
I have strange virtual (docker bridges) networking condition
I have two dockers connected to the same bridge via docker-compose. One docker is "probe" and one is "injector". ...
- 173
0
votes
0
answers
34
views
How to figure out what is bad about a 400 bad request, on an Apache-server
The overarching question
How do I see what is 'bad' about a 400 - bad request?
Info about the error
When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
- 111
0
votes
0
answers
28
views
How to set tcpdump sample rate
I would like to be able to use tcpdump (or a similar tool) to log traffic on a busy host, but instead of logging every packet that passes my ip/host/port/etc filters, only log with some specified ...
- 1
3
votes
1
answer
197
views
Tcpdump showing different redirection port after adding REDIRECT rule in iptables
I am attempting to direct client traffic to a kubernetes cluster NodePort listening on 192.168.1.100.30000.
Client's needs to make a request to 192.168.1.100.8000 so I added the following REDIRECT ...
- 133
1
vote
1
answer
148
views
Extracting TCP application data from pcap file
Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
- 183
0
votes
0
answers
290
views
dnsmasq DHCP not working, not replying to DHCP requests
I have setup dnsmasq as DHCP server on a CentOS VM, however it is not replying to DHCP requests. What could be the issue? Following is the configuration and tcpdump logs.
interface=ens224
listen-...
- 101
0
votes
1
answer
37
views
TCPDUMP Order of Operations: exclude and include
Trying to look at multicast traffic so I created a filter to monitor the range, then began to slowly add statements to exclude things not relevant but didnt get expected results. Do you do the ...
- 1
0
votes
0
answers
50
views
Log TCP Client port on apache mod_proxy
Using an Apache 2.4 Reverse Proxy (with mod_proxy) that connects to a backend HTTP service we have the following(simplified) series of TCP connections:
client ClientIP:random_port1 ---> <IP1:443 ...
- 478
0
votes
2
answers
90
views
TCDump Missing packets
We use TCPDump on an RPI to capture WiFi signals from nearby devices as a means to get an estimate of number of people.
We have notice the on "normal" days the numbers are reasonably ...
- 11
2
votes
2
answers
392
views
tcpdump filtering out specific ips and specific ports with that ip
I want to filter out several specific ips and ports with tcpdump.
example 192.168.1.100 port 1111
192.168.1.101 port 3333
I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 ...
- 21
1
vote
1
answer
117
views
tcpdump output has a different hostname
Sorry in advance for the simple question, but I'm trying to educate myself on tcpdump and networks.
I'm tracing all traffic going to a certain host with
tcpdump -SX -i any dst host host.site.com
...
- 13
0
votes
1
answer
32
views
daemonized alternative to tcpdump to save mirrored traffic
I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
- 226
1
vote
1
answer
70
views
How to find the linux user that sent the packet [duplicate]
Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this :
our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
- 113
1
vote
0
answers
281
views
tcpdump: filtering out localhost, packets show up anyway?
I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web.
I've came this far as of yet:
lan_hosts="(hosts || to || exclude)"
local_hosts="(127.0.0....
- 36
0
votes
1
answer
139
views
QEMU VM with tap interface sees all packages coming from hypervisor instead of real source IP
I have set up a very simple Hypervisor using Alpine Linux and my VM sees all traffic coming from the IP of the hypervisor.
Which also means if fail2ban tries to block attacks, it always blocks the ...
- 333
1
vote
1
answer
28
views
Different length between ping and tcpdump
I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the ...
- 13
0
votes
0
answers
93
views
Please explain the ASA capture to identify re-transmissions
I have recently started troubleshooting an issue and client is suspecting re-transmissions based on the below capture, I am not sure why the data packets are repeating over and over for multiple times ...
- 1
0
votes
1
answer
230
views
Piping SSH to wireshark on windows
In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
- 360
0
votes
1
answer
322
views
Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?
I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
0
votes
1
answer
386
views
Can (and do) I use iptables to expose a host directly online (not using NAT)?
I'm using a DSL-5300 VDSL modem/router which is set up with NAT for my house, and works great. Its web interface hasn't been written to support a mix of NAT and no-NAT traffic.
I've been assigned 8 ...
- 59
0
votes
0
answers
23
views
need help to understand tcpdump
Background: I have a web server hosted on 10.20.30.177:7000 and it should be accessible from 10.20.30.1 (m1) and 172.17.2.88 (m2). I am able to access from m1 and not from m2. I understand there can ...
- 101
1
vote
0
answers
404
views
tcpdump: invalid cksum from client to localhost interface even after disabling offloading
I'm having a strange issue.
In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
- 11
0
votes
1
answer
109
views
Two clients can connect to OpenVPN server but another cannot
I have an external OpenVPN server running Ubuntu 20.04 and 3 clients:
Client1 (Android 11)
Client2 (Windows 10 and Virtualbo host)
Client3 (Ubuntu 20.04 Virtualbox guest)
All 3 clients are able to ...
0
votes
1
answer
847
views
openvpn server not showing traffic using tcpdump
I have an OpenVPN server and two clients,
I can ping clients from each other, but when I do so, I don't see any packets on the server using tcpdump
Server
is running on 192.168.0.1
and I try to ...
- 103
0
votes
1
answer
189
views
Capturing IEEE802.11.x auth and capabilities data with tcpdump?
I'm troubleshooting some issues with my wireless network (OpenWrt 19.x and mobile device) and I came across this:
https://dot11.exposed/2017/09/20/violation-of-802-11-standard-intel-wireless-cards-...
- 13
0
votes
0
answers
33
views
connection is paused for long
a redis server is running in a different network namespace. I'm trying to connect a client to the redis server, it keeps waiting but is not getting response, its been hours.
Client side code:
int main(...
- 21
-1
votes
1
answer
1k
views
How can I see the response of the DNS requests that tcpdump is showing me?
I'm using tcpdump (for the first time) to try to debug a DNS issue:
tcpdump -n udp port 53
It gives me this output:
10:38:30.431467 IP a.b.c.d.56973 > 8.8.8.8.domain: 49179+ A? ocsp.sectigo.com. (...
- 1,034
9
votes
2
answers
2k
views
Why echo request doesn't show in tcpdump?
I have two network segments connected using a IPSEC-VPN tunnel :
NET#1: a.b.0.0/16 with LAN gateway a.b.0.1
NET#2: x.y.0.0/16 with LAN gateway x.y.130.1
I initiate a ping from a.b.0.1 to x.y.130.100 ...
- 233
0
votes
1
answer
44
views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
- 133
0
votes
1
answer
762
views
Where does tcpdump get the source IP from for a TCP packet?
I've been trying to come up with a solution for a routing problem (multiple interfaces connected to a single Docker container, ensuring response packets go out the right interface), and have come ...
0
votes
0
answers
29
views
Identify Source / Trigger of / for Network Traffic locahost
I want to identify the application trat triggers network traffic like the one below.
I have dissabled ethernet and wireless cards, and denied incoming traffic in firewall.
$ sudo tcpdump -vv -e -A -i ...
2
votes
3
answers
513
views
Nginx post-ssl-termination debug mirror
How can I tell nginx to output all incoming traffic for a given server{} to a specific/additional/redundant location after decrypting it (like port mirroring on routers) so that it can be analyzed for ...
- 455
1
vote
1
answer
74
views
How to split pcap per IRC channels
I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
- 113
0
votes
2
answers
1k
views
Packets dropped somewhere between network interface and iptables when forwarded from router
I have a server configured with multiple interfaces and multiple VLANs. It works perfectly fine for all the local networks, it drops packets forwarded through my router for some reason though. And it'...
- 97
0
votes
1
answer
274
views
Pcap (tcpdump) filter to match against local port
I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port.
That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
- 134
0
votes
1
answer
234
views
How to specify both IP address and port in tcpdump?
I want to specify a source IP address, destination IP address and source port in my tcpdump filter. However, I keep getting syntax errors. How do I do that?
- 141
0
votes
0
answers
425
views
Wireshark TLS conversation for ldaps
I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark.
Here is what I get from client side on a conversation with delays:
I see the following problems:
I ...
- 478
1
vote
1
answer
478
views
Forwarded Packets are received by namespace's veth0 but not received by application
I use libtins (It uses Pcap) to capture link layer packets and forward to a network namespace where the actual application runs on.
Client(Browser) -> Server -> Pcap -> Pcap Send -> br0 (...
- 11
1
vote
2
answers
1k
views
tcpdump can't open file: permission denied (linux)
I set all filters for Tcpdump in a config file, but when I run this command:
sudo tcpdump -i any -w "./mypcap.pcap" -F "myfilters.txt"
I get permission denied although my file ...
- 111
2
votes
2
answers
9k
views
How can I capture IPSEC packets on my VPN server?
I am running a strongSwan (U5.3.5/K4.4.0-62-generic) VPN server on Ubuntu 16.04.
Ususally, when I want to examine traffic on a server, I simply run something like the following:
tcpdump -ni eth0 "...
- 313
1
vote
2
answers
1k
views
Display delta timestamp and UDP data payload with tcpdump/tshark
I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head ...
- 124
2
votes
3
answers
2k
views
tcpdump, how to capture actual data only？
For example I have a server listening on port 8001, a client programe open a tcp socket connect to that port, send some binary data, I want to capture the actual data only without any TCP/IP header ...
- 141
1
vote
1
answer
242
views
Re-routing DNS queries with iptables properly without resolv.conf
I run a custom DNS service on 127.0.0.1:53 and I dont just want all queries to go through it, I also want only that service to respond back. Which is where the problem arises. My NAT iptables setup:
...
- 13
0
votes
1
answer
1k
views
Trying to capture 3-way handshake in linux
I am trying to capture 3-way handshake using the following in linux, it does not seems to work...
sudo tcpdump "tcp[tcpflags] & (tcp-syn) !=0" -w filename.pcap -i eth0
Could you someone suggest ...
- 11
0
votes
1
answer
101
views
Proxy service only responding on some IP addresses (others suck on SYN_RECV)
I have a server using a proxy service (WAF etc) which forwards packets to my server.
I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV:
tcp 0 ...
- 1,120
3
votes
0
answers
542
views
TCP Window Scaling Not Working Between Windows 10 and Linux Server
We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server.
We can't reproduce the error on our end but notice that TCP window scaling is ...
- 191
-1
votes
1
answer
306
views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
- 1
1
vote
0
answers
122
views
tcpdump not capturing packets but Apache log shows the request
I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
- 11
0
votes
0
answers
28
views
Does tcpdump guarantee packet integrity?
In normal use of tcpdump without any parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap
In using tcpdump rotating by time with -G parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap -...
