As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
46 views

Can't connect to MariaDB from internal VM Structure

S1 Virtual Machine 1: Ubuntu app server Virtual Machine 2: MariaDB 1 S2 Virtual Machine 3: Ubuntu app server Virtual Machine 4: MariaDB 2 from vm04 and 03 I can connect to DB1 with connection string ...
gegentierversuche's user avatar
0 votes
1 answer
37 views

tcpdump shows these hostnames - should I be worried

I'm investigatinmg a strnage hang with our NextCLoud instance and think it might be todo with a misconfigured hostname somewhere. I thought of using tcpdump to look at what addresses/names are being ...
TenG's user avatar
  • 143
0 votes
0 answers
50 views

IPv6 port scanners hang after scanning a closed port

I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it. For example with netcat and no firewall: nc -6 fe80::9d08:b3e2:47fa:...
stmas's user avatar
  • 1
0 votes
1 answer
93 views

How to find out if TCP connection to server is being tampered with by third-parties?

I'm under an unreliable ISP/AS, something like the GFW. They actively try to sabotage a TCP+TLS session by attacks such as sending SYN RST to established connections, making the connection timeout, ...
Ragahito's user avatar
0 votes
0 answers
27 views

tcpdump file cannot be created through crontab bash file

I have two scripts: /home/apps/backup.sh // Just invokes tcpdump.sh /home/apps/tcpdump.sh // Generate a tcpdump file backup.sh is scheduled by crontab dialy. backup.sh #!/bin/sh /home/apps/...
user3637971's user avatar
0 votes
1 answer
40 views

Tcpdump output file is not storing the destination IP address and port number

I'm capturing tcpdump packets. Even though, when I want to see the output by tcpdump -r I see destination hostname instead of address IP and service name instead of port number. Example: tcpdump -w /...
user3637971's user avatar
1 vote
0 answers
190 views

What is the key file for ssldump?

I search google for a tool to decode https traffic and get the ssldump with examples like: ssldump -k xxx.pem -i eth0 -d host example.com I wonder what the key file xxx.pem is. On the server hosting ...
peter's user avatar
  • 83
1 vote
1 answer
71 views

Client TCP segments arrive in batches

The scenario is the following: a WebSocket server and clients exchange messages at some pace (like 40-50 times in a second). However, for one client, once in a few minutes I'm observing that there is ...
tonso's user avatar
  • 111
0 votes
0 answers
45 views

Is it possible to use tcpdump directly with a virtual switch created with vde_switch

I am currently running a lab environment with qemu and a virtual switch (vde_switch). Since I am running on a Mac m1 (monterey), it was not possible to use a bridged connection (vde_switch does not ...
E. Jaep's user avatar
  • 283
0 votes
0 answers
41 views

Is there a way to capture packages by using tcpdump with ipset?

I got a big ipset and I want to capture networking packages related/not-related to these IPs. Is there a way to capture packages by using tcpdump with ipset as param?
Catscarlet's user avatar
0 votes
0 answers
76 views

Trace Packets in Kubernetes

I am trying to trace packets using sniffer using (https://github.com/eldadru/ksniff) but I am unable to make out how to trace packets and check if cluster IP is in use for Nodeport SVC. I have the ...
drifter's user avatar
3 votes
0 answers
347 views

TCP retransmission inside of docker network

Just lately our server started experiencing increased CPU usage by the php(Symfony) and mysql processes. For quite some time we been trying to find the cause and we found out that we have big amount ...
Maarduk's user avatar
  • 133
0 votes
0 answers
35 views

using tcpdump how to capture only traffic between my server and elastic search database

I want to use tcpdump to capture traffic between my server and the elastic search database also I would like to capture traffic of one specific url POST https://vpc-my-es-3-abcd.us-east-1.es.amazonaws....
kumar's user avatar
  • 389
0 votes
0 answers
210 views

Strongswan IPSec tunnel between linux and windows : "NO_PROPOSAL_CHOSEN"

I'm trying to set up a VPN tunnel between a win10 host and a ubuntu host. Below the configuration I have: /etc/ipsec.conf config setup charondebug=1 uniqueids=yes ...
user2567674's user avatar
0 votes
0 answers
20 views

Save all unique TCP/IP conversations [duplicate]

I have a tcpdump containing numerous HTTP sessions. I want to save each unique conversation i.e. SYN-to-FIN, in its own file using Wireshark (or any other tool if something else is better suited) ...
Waslap's user avatar
  • 121
1 vote
0 answers
74 views

Why is TCP doing RTO based retransmits (200ms+ wait) vs other fast-retransmission mechanisms?

(Trying this forum after the question was deemed off-topic for Stack Overflow & Network Engineering) I am investigating an issue where we see occasional 200ms+ spikes in a simple tcp client/server ...
RandomQuestion's user avatar
2 votes
0 answers
111 views

Long latency to reply a TCP ACK

k8s environment(4 nodes, rke 1.21.5) We noticed there is randomly significant latency in socket data transferring between different k8s pods. Latency could be as long as 15 seconds in some cases. By ...
skyfire's user avatar
  • 21
0 votes
1 answer
581 views

Filter tcpdump by hostname using wildcard/regex with verbose output

Is it possible to create expression in tcpdump that would filter incoming packets with wildcard? Something like this: tcpdump -v -i bond0 -c 200 -Z root udp port 514 and src server-*.com It doesn't ...
Miroslav Cibulka's user avatar
1 vote
1 answer
539 views

Duplicate tcpdump output in cooked capture mode from bridge interfaces

I'm working with a system that has multiple bridge interfaces. I would like to monitor traffic on multiple interfaces, but tcpdump is capturing from both the master interface and its identical bridge, ...
forest's user avatar
  • 462
1 vote
0 answers
399 views

dhcp-relay cannot recieve DHCPOFFER packet from DHCP server in shared network

I'm using the dnsmasq service as a DHCP server. I have a bridged interface per node named br0 that has two ip addresses assigned to it. One is the public IP address and the other one is considered the ...
Mohammadreza Nasrabadi's user avatar
0 votes
1 answer
70 views

TCP packets being lost

I have some TCP packets being lost. I have monitored the interface with tcpdump pcap file - https://www.dropbox.com/s/7m3hr1b7065tenx/tcp.pcap?dl=0 I noticed that when I lose packets I only get 5 ...
Ruby dev's user avatar
0 votes
0 answers
136 views

Traffic capture at boot

I'm trying to figure out what packets a linux host sends at boot in order to debug it. Is there a way to start packet capture during boot time to not miss any packets? What is your way of going about ...
lolz's user avatar
  • 11
0 votes
1 answer
1k views

Trouble filtering DNS responses with tcpdump

I'm having troubles with tcpdump. I want to only capture DNS packets that are responses containing authoritative responses with a single RR that is 0.0.0.0. For example I want to only capture packets ...
owrtbro's user avatar
  • 11
0 votes
1 answer
170 views

Dump client ssh key from server side

To investigate on some issue, I need to dump the full ssh key offered by the ssh client to the ssh server. Up to this point, I tried to put the parent of all sshd server (belongs to root) LogLevel to ...
kalou.net's user avatar
  • 103
0 votes
1 answer
125 views

tcpdump and lenght with VLAN

I run ping: ping -c 15 -s 120 -D 192.5.15.22 The same time I watch tcpdump: tcpdump -n -e -vv -ttt -i iavf0 vlan tcpdump: listening on iavf0, link-type EN10MB (Ethernet), capture size 262144 bytes 00:...
sqr's user avatar
  • 15
0 votes
1 answer
1k views

Linux: bridge vs. vlan vs. tcpdump

I have a Proxmox host with kernel 5.15.19-2-pve. It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic. I created a vmbr666 bridge that shows looks like this: # /etc/...
András Korn's user avatar
0 votes
1 answer
755 views

docker containaer promiscuous mode partially working

I have strange virtual (docker bridges) networking condition I have two dockers connected to the same bridge via docker-compose. One docker is "probe" and one is "injector". ...
Boris's user avatar
  • 173
1 vote
0 answers
2k views

How to figure out what is bad about a 400 bad request, on an Apache-server

The overarching question How do I see what is 'bad' about a 400 - bad request? Info about the error When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
Zeth's user avatar
  • 121
3 votes
1 answer
914 views

Tcpdump showing different redirection port after adding REDIRECT rule in iptables

I am attempting to direct client traffic to a kubernetes cluster NodePort listening on 192.168.1.100.30000. Client's needs to make a request to 192.168.1.100.8000 so I added the following REDIRECT ...
tiger_groove's user avatar
2 votes
1 answer
1k views

Extracting TCP application data from pcap file

Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
Johannes Weiss's user avatar
0 votes
0 answers
1k views

dnsmasq DHCP not working, not replying to DHCP requests

I have setup dnsmasq as DHCP server on a CentOS VM, however it is not replying to DHCP requests. What could be the issue? Following is the configuration and tcpdump logs. interface=ens224 listen-...
asm_nerd1's user avatar
  • 101
1 vote
1 answer
369 views

TCPDUMP Order of Operations: exclude and include

Trying to look at multicast traffic so I created a filter to monitor the range, then began to slowly add statements to exclude things not relevant but didnt get expected results. Do you do the ...
Gr4cchus's user avatar
0 votes
2 answers
132 views

TCDump Missing packets

We use TCPDump on an RPI to capture WiFi signals from nearby devices as a means to get an estimate of number of people. We have notice the on "normal" days the numbers are reasonably ...
Pigsfoot's user avatar
3 votes
2 answers
4k views

tcpdump filtering out specific ips and specific ports with that ip

I want to filter out several specific ips and ports with tcpdump. example 192.168.1.100 port 1111 192.168.1.101 port 3333 I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 ...
user923097's user avatar
1 vote
1 answer
488 views

tcpdump output has a different hostname

Sorry in advance for the simple question, but I'm trying to educate myself on tcpdump and networks. I'm tracing all traffic going to a certain host with tcpdump -SX -i any dst host host.site.com ...
Denver123's user avatar
0 votes
1 answer
45 views

daemonized alternative to tcpdump to save mirrored traffic

I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
George Shuklin's user avatar
1 vote
1 answer
105 views

How to find the linux user that sent the packet [duplicate]

Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this : our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
SmootQ's user avatar
  • 113
1 vote
0 answers
784 views

tcpdump: filtering out localhost, packets show up anyway?

I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web. I've came this far as of yet: lan_hosts="(hosts || to || exclude)" local_hosts="(127.0.0....
xogoxec344's user avatar
0 votes
1 answer
658 views

QEMU VM with tap interface sees all packages coming from hypervisor instead of real source IP

I have set up a very simple Hypervisor using Alpine Linux and my VM sees all traffic coming from the IP of the hypervisor. Which also means if fail2ban tries to block attacks, it always blocks the ...
Christian's user avatar
  • 333
1 vote
1 answer
166 views

Different length between ping and tcpdump

I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the ...
sqr's user avatar
  • 15
1 vote
1 answer
615 views

Piping SSH to wireshark on windows

In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
BANJOSA's user avatar
  • 350
0 votes
1 answer
868 views

Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?

I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
kansas_bulldog382's user avatar
0 votes
1 answer
1k views

Can (and do) I use iptables to expose a host directly online (not using NAT)?

I'm using a DSL-5300 VDSL modem/router which is set up with NAT for my house, and works great. Its web interface hasn't been written to support a mix of NAT and no-NAT traffic. I've been assigned 8 ...
cnd's user avatar
  • 169
0 votes
0 answers
34 views

need help to understand tcpdump

Background: I have a web server hosted on 10.20.30.177:7000 and it should be accessible from 10.20.30.1 (m1) and 172.17.2.88 (m2). I am able to access from m1 and not from m2. I understand there can ...
PKV's user avatar
  • 101
2 votes
0 answers
1k views

tcpdump: invalid cksum from client to localhost interface even after disabling offloading

I'm having a strange issue. In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
Mike's user avatar
  • 21
0 votes
1 answer
201 views

Two clients can connect to OpenVPN server but another cannot

I have an external OpenVPN server running Ubuntu 20.04 and 3 clients: Client1 (Android 11) Client2 (Windows 10 and Virtualbo host) Client3 (Ubuntu 20.04 Virtualbox guest) All 3 clients are able to ...
Christian Toffolo's user avatar
0 votes
1 answer
2k views

openvpn server not showing traffic using tcpdump

I have an OpenVPN server and two clients, I can ping clients from each other, but when I do so, I don't see any packets on the server using tcpdump Server is running on 192.168.0.1 and I try to ...
emte's user avatar
  • 103
0 votes
1 answer
501 views

Capturing IEEE802.11.x auth and capabilities data with tcpdump?

I'm troubleshooting some issues with my wireless network (OpenWrt 19.x and mobile device) and I came across this: https://dot11.exposed/2017/09/20/violation-of-802-11-standard-intel-wireless-cards-...
KreonZZ's user avatar
  • 13
0 votes
0 answers
41 views

connection is paused for long

a redis server is running in a different network namespace. I'm trying to connect a client to the redis server, it keeps waiting but is not getting response, its been hours. Client side code: int main(...
user14610638's user avatar
-1 votes
1 answer
3k views

How can I see the response of the DNS requests that tcpdump is showing me?

I'm using tcpdump (for the first time) to try to debug a DNS issue: tcpdump -n udp port 53 It gives me this output: 10:38:30.431467 IP a.b.c.d.56973 > 8.8.8.8.domain: 49179+ A? ocsp.sectigo.com. (...
Codemonkey's user avatar
  • 1,056

1
2 3 4 5
10