Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
463
questions
0
votes
0
answers
46
views
Can't connect to MariaDB from internal VM Structure
S1
Virtual Machine 1: Ubuntu app server
Virtual Machine 2: MariaDB 1
S2
Virtual Machine 3: Ubuntu app server
Virtual Machine 4: MariaDB 2
from vm04 and 03 I can connect to DB1 with connection string ...
0
votes
1
answer
37
views
tcpdump shows these hostnames - should I be worried
I'm investigatinmg a strnage hang with our NextCLoud instance and think it might be todo with a misconfigured hostname somewhere.
I thought of using tcpdump to look at what addresses/names are being ...
- 143
0
votes
0
answers
50
views
IPv6 port scanners hang after scanning a closed port
I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it.
For example with netcat and no firewall:
nc -6 fe80::9d08:b3e2:47fa:...
- 1
0
votes
1
answer
93
views
How to find out if TCP connection to server is being tampered with by third-parties?
I'm under an unreliable ISP/AS, something like the GFW. They actively try to sabotage a TCP+TLS session by attacks such as sending SYN RST to established connections, making the connection timeout, ...
- 1
0
votes
0
answers
27
views
tcpdump file cannot be created through crontab bash file
I have two scripts:
/home/apps/backup.sh // Just invokes tcpdump.sh
/home/apps/tcpdump.sh // Generate a tcpdump file
backup.sh is scheduled by crontab dialy.
backup.sh
#!/bin/sh
/home/apps/...
- 155
0
votes
1
answer
40
views
Tcpdump output file is not storing the destination IP address and port number
I'm capturing tcpdump packets. Even though, when I want to see the output by tcpdump -r I see destination hostname instead of address IP and service name instead of port number.
Example:
tcpdump -w /...
- 155
1
vote
0
answers
190
views
What is the key file for ssldump?
I search google for a tool to decode https traffic and get the ssldump with examples like:
ssldump -k xxx.pem -i eth0 -d host example.com
I wonder what the key file xxx.pem is. On the server hosting ...
- 83
1
vote
1
answer
71
views
Client TCP segments arrive in batches
The scenario is the following: a WebSocket server and clients exchange messages at some pace (like 40-50 times in a second). However, for one client, once in a few minutes I'm observing that there is ...
- 111
0
votes
0
answers
45
views
Is it possible to use tcpdump directly with a virtual switch created with vde_switch
I am currently running a lab environment with qemu and a virtual switch (vde_switch).
Since I am running on a Mac m1 (monterey), it was not possible to use a bridged connection (vde_switch does not ...
- 283
0
votes
0
answers
41
views
Is there a way to capture packages by using tcpdump with ipset?
I got a big ipset and I want to capture networking packages related/not-related to these IPs.
Is there a way to capture packages by using tcpdump with ipset as param?
- 101
0
votes
0
answers
76
views
Trace Packets in Kubernetes
I am trying to trace packets using sniffer using (https://github.com/eldadru/ksniff) but I am unable to make out how to trace packets and check if cluster IP is in use for Nodeport SVC.
I have the ...
- 1
3
votes
0
answers
347
views
TCP retransmission inside of docker network
Just lately our server started experiencing increased CPU usage by the php(Symfony) and mysql processes. For quite some time we been trying to find the cause and we found out that we have big amount ...
- 133
0
votes
0
answers
35
views
using tcpdump how to capture only traffic between my server and elastic search database
I want to use tcpdump to capture traffic between my server and the elastic search database also I would like to capture traffic of one specific url POST https://vpc-my-es-3-abcd.us-east-1.es.amazonaws....
- 389
0
votes
0
answers
210
views
Strongswan IPSec tunnel between linux and windows : "NO_PROPOSAL_CHOSEN"
I'm trying to set up a VPN tunnel between a win10 host and a ubuntu host. Below the configuration I have:
/etc/ipsec.conf
config setup
charondebug=1
uniqueids=yes
...
0
votes
0
answers
20
views
Save all unique TCP/IP conversations [duplicate]
I have a tcpdump containing numerous HTTP sessions. I want to save each unique conversation i.e. SYN-to-FIN, in its own file using Wireshark (or any other tool if something else is better suited) ...
- 121
1
vote
0
answers
74
views
Why is TCP doing RTO based retransmits (200ms+ wait) vs other fast-retransmission mechanisms?
(Trying this forum after the question was deemed off-topic for Stack Overflow & Network Engineering)
I am investigating an issue where we see occasional 200ms+ spikes in a simple tcp client/server ...
- 111
2
votes
0
answers
111
views
Long latency to reply a TCP ACK
k8s environment(4 nodes, rke 1.21.5)
We noticed there is randomly significant latency in socket data transferring between different k8s pods. Latency could be as long as 15 seconds in some cases.
By ...
- 21
0
votes
1
answer
581
views
Filter tcpdump by hostname using wildcard/regex with verbose output
Is it possible to create expression in tcpdump that would filter incoming packets with wildcard?
Something like this:
tcpdump -v -i bond0 -c 200 -Z root udp port 514 and src server-*.com
It doesn't ...
1
vote
1
answer
539
views
Duplicate tcpdump output in cooked capture mode from bridge interfaces
I'm working with a system that has multiple bridge interfaces. I would like to monitor traffic on multiple interfaces, but tcpdump is capturing from both the master interface and its identical bridge, ...
- 462
1
vote
0
answers
399
views
dhcp-relay cannot recieve DHCPOFFER packet from DHCP server in shared network
I'm using the dnsmasq service as a DHCP server. I have a bridged interface per node named br0 that has two ip addresses assigned to it. One is the public IP address and the other one is considered the ...
0
votes
1
answer
70
views
TCP packets being lost
I have some TCP packets being lost. I have monitored the interface with tcpdump pcap file - https://www.dropbox.com/s/7m3hr1b7065tenx/tcp.pcap?dl=0
I noticed that when I lose packets I only get 5 ...
- 1
0
votes
0
answers
136
views
Traffic capture at boot
I'm trying to figure out what packets a linux host sends at boot in order to debug it.
Is there a way to start packet capture during boot time to not miss any packets?
What is your way of going about ...
- 11
0
votes
1
answer
1k
views
Trouble filtering DNS responses with tcpdump
I'm having troubles with tcpdump. I want to only capture DNS packets that are responses containing authoritative responses with a single RR that is 0.0.0.0. For example I want to only capture packets ...
- 11
0
votes
1
answer
170
views
Dump client ssh key from server side
To investigate on some issue, I need to dump the full ssh key offered by the ssh client to the ssh server.
Up to this point, I tried to
put the parent of all sshd server (belongs to root) LogLevel to ...
- 103
0
votes
1
answer
125
views
tcpdump and lenght with VLAN
I run ping:
ping -c 15 -s 120 -D 192.5.15.22
The same time I watch tcpdump:
tcpdump -n -e -vv -ttt -i iavf0 vlan
tcpdump: listening on iavf0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:...
- 15
0
votes
1
answer
1k
views
Linux: bridge vs. vlan vs. tcpdump
I have a Proxmox host with kernel 5.15.19-2-pve.
It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic.
I created a vmbr666 bridge that shows looks like this:
# /etc/...
- 651
0
votes
1
answer
755
views
docker containaer promiscuous mode partially working
I have strange virtual (docker bridges) networking condition
I have two dockers connected to the same bridge via docker-compose. One docker is "probe" and one is "injector". ...
- 173
1
vote
0
answers
2k
views
How to figure out what is bad about a 400 bad request, on an Apache-server
The overarching question
How do I see what is 'bad' about a 400 - bad request?
Info about the error
When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
- 121
3
votes
1
answer
914
views
Tcpdump showing different redirection port after adding REDIRECT rule in iptables
I am attempting to direct client traffic to a kubernetes cluster NodePort listening on 192.168.1.100.30000.
Client's needs to make a request to 192.168.1.100.8000 so I added the following REDIRECT ...
- 153
2
votes
1
answer
1k
views
Extracting TCP application data from pcap file
Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
- 193
0
votes
0
answers
1k
views
dnsmasq DHCP not working, not replying to DHCP requests
I have setup dnsmasq as DHCP server on a CentOS VM, however it is not replying to DHCP requests. What could be the issue? Following is the configuration and tcpdump logs.
interface=ens224
listen-...
- 101
1
vote
1
answer
369
views
TCPDUMP Order of Operations: exclude and include
Trying to look at multicast traffic so I created a filter to monitor the range, then began to slowly add statements to exclude things not relevant but didnt get expected results. Do you do the ...
- 11
0
votes
2
answers
132
views
TCDump Missing packets
We use TCPDump on an RPI to capture WiFi signals from nearby devices as a means to get an estimate of number of people.
We have notice the on "normal" days the numbers are reasonably ...
- 11
3
votes
2
answers
4k
views
tcpdump filtering out specific ips and specific ports with that ip
I want to filter out several specific ips and ports with tcpdump.
example 192.168.1.100 port 1111
192.168.1.101 port 3333
I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 ...
- 31
1
vote
1
answer
488
views
tcpdump output has a different hostname
Sorry in advance for the simple question, but I'm trying to educate myself on tcpdump and networks.
I'm tracing all traffic going to a certain host with
tcpdump -SX -i any dst host host.site.com
...
- 13
0
votes
1
answer
45
views
daemonized alternative to tcpdump to save mirrored traffic
I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
- 256
1
vote
1
answer
105
views
How to find the linux user that sent the packet [duplicate]
Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this :
our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
- 113
1
vote
0
answers
784
views
tcpdump: filtering out localhost, packets show up anyway?
I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web.
I've came this far as of yet:
lan_hosts="(hosts || to || exclude)"
local_hosts="(127.0.0....
- 36
0
votes
1
answer
658
views
QEMU VM with tap interface sees all packages coming from hypervisor instead of real source IP
I have set up a very simple Hypervisor using Alpine Linux and my VM sees all traffic coming from the IP of the hypervisor.
Which also means if fail2ban tries to block attacks, it always blocks the ...
- 333
1
vote
1
answer
166
views
Different length between ping and tcpdump
I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the ...
- 15
1
vote
1
answer
615
views
Piping SSH to wireshark on windows
In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
- 350
0
votes
1
answer
868
views
Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?
I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
0
votes
1
answer
1k
views
Can (and do) I use iptables to expose a host directly online (not using NAT)?
I'm using a DSL-5300 VDSL modem/router which is set up with NAT for my house, and works great. Its web interface hasn't been written to support a mix of NAT and no-NAT traffic.
I've been assigned 8 ...
- 169
0
votes
0
answers
34
views
need help to understand tcpdump
Background: I have a web server hosted on 10.20.30.177:7000 and it should be accessible from 10.20.30.1 (m1) and 172.17.2.88 (m2). I am able to access from m1 and not from m2. I understand there can ...
- 101
2
votes
0
answers
1k
views
tcpdump: invalid cksum from client to localhost interface even after disabling offloading
I'm having a strange issue.
In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
- 21
0
votes
1
answer
201
views
Two clients can connect to OpenVPN server but another cannot
I have an external OpenVPN server running Ubuntu 20.04 and 3 clients:
Client1 (Android 11)
Client2 (Windows 10 and Virtualbo host)
Client3 (Ubuntu 20.04 Virtualbox guest)
All 3 clients are able to ...
0
votes
1
answer
2k
views
openvpn server not showing traffic using tcpdump
I have an OpenVPN server and two clients,
I can ping clients from each other, but when I do so, I don't see any packets on the server using tcpdump
Server
is running on 192.168.0.1
and I try to ...
- 103
0
votes
1
answer
501
views
Capturing IEEE802.11.x auth and capabilities data with tcpdump?
I'm troubleshooting some issues with my wireless network (OpenWrt 19.x and mobile device) and I came across this:
https://dot11.exposed/2017/09/20/violation-of-802-11-standard-intel-wireless-cards-...
- 13
0
votes
0
answers
41
views
connection is paused for long
a redis server is running in a different network namespace. I'm trying to connect a client to the redis server, it keeps waiting but is not getting response, its been hours.
Client side code:
int main(...
- 21
-1
votes
1
answer
3k
views
How can I see the response of the DNS requests that tcpdump is showing me?
I'm using tcpdump (for the first time) to try to debug a DNS issue:
tcpdump -n udp port 53
It gives me this output:
10:38:30.431467 IP a.b.c.d.56973 > 8.8.8.8.domain: 49179+ A? ocsp.sectigo.com. (...
- 1,056