Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

0
votes
1answer
19 views

Is this a valid TLS handshake

I am trying to validate a TLS version by establishing a connection with the server, below is the packet capture. All I need to know is whether this means a connection was established or refused, and ...
0
votes
0answers
14 views

How to analyse external networking performance?

I face a issue with external network performance that is external bandwidth is full. So my question is, is there a way to know whether the external network bandwidth is full or not with tcpdump. ...
0
votes
0answers
42 views

Why TCP Out-Of-Order packet is seen after SYN?

I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior. ...
0
votes
1answer
92 views

Can a TCP packet don't reach the 7th OSI layer

I'm facing a situation where a client establish a TCP connection via telnet (or netcat) in order to connect to a linux server. The server must then send back a banner containing some text info... In ...
0
votes
1answer
63 views

What is localhost.webcache in tcpdump

I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
0
votes
0answers
21 views

GCP Internal Load Balancer not responding

I am trying to reach GCP Internal Load Balancer from external network connected via 3rd party Pritunl-OpenVPN tunnel (tunnel endpoint is on VM). [external network] <------- Pritunl VPN ----> [GCP ...
-1
votes
1answer
87 views

Running tcpdump starts ssh flood

I have runtime Linux running in a PLC. My development machine is running Ubuntu 14.04. The PLC and the development machine are connected through a five port switch. I ssh to PLC from my development ...
2
votes
1answer
83 views

netstat says connection in SYN_SENT but tcpdump captures no data

I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
2
votes
0answers
61 views

Is it possible to capture traffic on host when using KVM passthrough?

I have a KVM guest which uses PCI passthrough for its network interfaces: <hostdev mode='subsystem' type='pci' managed='yes'> <source> <address domain='0x0000' bus='0x05' slot='...
1
vote
0answers
40 views

Server does not respond to SYN [duplicate]

When I launch an FTP transfer from a client machine, it fails because it cannot connect to the server. With tcpdump I can see that the client sends a SYN to the server, and I can also see that the ...
0
votes
2answers
111 views

Weird traffic on all interfaces simultaneously. (Linux)

Every now and then, I check my munin graphs on my production server to see if there's anything out of the ordinary going on. Today I noticed a strange thing. Identical traffic spikes on all (8) ...
0
votes
0answers
10 views

Netty application gets reset flag from client

I have a Netty application, that is running inside a private network. When I access the netty application from inside the network, it works fine. Now we have to access it from outside the network. We ...
0
votes
2answers
130 views

redirect tcpdump generated pcap file to another server while packets are being captured

I was looking for some command like this, it achieves: redirect the tcpdump generated pcap file to another server during the process of 1., using a python script or some tool to analyze each packet. ...
0
votes
1answer
25 views

Analyze Packet Loss Bursts

I need to analyze packet loss bursts in TCP streams. Given a number X a packet lost burst is when more then X consecutive packets got lost. So I have a pcap file and need to count how many bursts ...
0
votes
0answers
14 views

ICMP packet size over 372 are dropped on bond0

i have a target server running on rhel7.4 with kernel 3.10.0-693.11.6.el7 with bond0 and subinterface vlan2001 with MTU 9000 when i ping from a different server which is in a different network with ...
1
vote
1answer
131 views

Email server with no smtp connection

Ubuntu 18.04 on Google Compute Dovecot + postfix I figure I should be able to connect to a port other than 465/587, and since I can relay all email through google there should be no issue with this ...
0
votes
0answers
127 views

How to check for firewall drops in WireShark

We have an application setup across two servers. The application is failing because a firewall is blocking communication between the two servers. I need a way to figure out every single port that is ...
0
votes
0answers
629 views

Why is tcpdump not capturing TLS packets on port 443?

I am using the following command: sudo tcpdump -vvv -A -XX -i any -w dump.pcap I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
0answers
51 views

Tcpdump receives packets but they are not delivered to firewall

I am working with Proxmox, OpenVPN and Mikrotik Router. When I try to connect from OpenVPN client (192.168.10.13) to VM (192.168.1.19) hosted on Proxmox I don't get any response. Proxmox host (192....
0
votes
0answers
6 views

trc-netpoll service on tcpdump

I was doing a tcpdump on my wifi adapter. I found a lot of trc-netpoll continuously flowing through it (more than 10 per millisecond) I just have ssh enabled on server and accessing it via a putty ...
0
votes
1answer
207 views

tcpdump: Traffic between localhost:[src-port:dst-port]

I'd like to get http traffic between localhost:8081 and localhost:8080. I need http headers and body. I've tried some commands but everything is complicated and I don't quite figure out what I'm ...
1
vote
1answer
181 views

tcpdump TCP Header offset 13

I am trying to understand how tcpdump works and trying to read TCP header control flags SYN,ACK etc. After researching online I came to know that the control flags are available at offset 13 and I ...
0
votes
1answer
39 views

tcpdump get requesting IP

We are tracking http usage(mainly for our intranet) and I've been able to track it using the the following on our OPENWRT router: tcpdump -i wlan1 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] =...
1
vote
0answers
22 views

Getting different local-port value in tcpdump when using --local-port option in curl

I'm using curl command to send the traffic to the Server. In curl command, I'm using --local-port option. Below is the command: curl -v --interface 10.1.1.3 -b --local-port 10000 http://30.1.1.101/...
1
vote
1answer
363 views

Can I use tcpdump to analyze binary data - gRPC, http2, MessagePack, etc?

Life is simple with text-encoded formats like JSON. I can see enough text in the dump to figure out where something can be wrong. But with the growing popularity of binary interchange formats, I think ...
1
vote
1answer
193 views

iptables blacklist empty User-Agent sip tcpdump

I scan using tcpdump for user-agents that hit my phone server. I get interesting results. i add them to a list that protects alot of my servers out there. This works good. The problem is I get ...
0
votes
1answer
377 views

How to send tcpdump-captured traffic directly to an interface?

I can do it using an intermediate pcap file: tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345' ^C tcpreplay -i eth1 out.pcap Is it possible to skip the pcap and forward all the traffic immediately?...
0
votes
0answers
12 views

Monitor outgoing connections to destination port - get program / script names

I want to log programs that establish connections to destination port 25 / outgoing email ports. I need to know the program / process and where it is located in the filesystem. Is this possible with ...
1
vote
0answers
18 views

No packet crossing default gateway

I have two Ubuntu 17.04 nodes, A (10.0.9.2) and B (10.0.9.1). I have set B as default gateway of A, using the command: route add default gw 10.0.9.1 interface vi4. Yet, when I traceroute 8.8.8.8 ...
-1
votes
1answer
50 views

How can I add iptables rule on particular event (HTTP/1.1 302 Found)

My Tomato based router has two interfaces Eth0 - direct connection Tun1 - vpn Sometimes some websites return "HTTP/1.1 302 Found" and when that happens, I want to add iptables rule to use Tun1 ...
0
votes
0answers
46 views

iptables + TEE : too many duplicates

I'm trying port mirroring with : iptables -t mangle -A PREROUTING -i eth0 -j TEE --gateway 192.168.1.x It's working, however, I receive 10* the amount of packet initialy sent. Why? P.S : It's on ...
0
votes
1answer
22 views

Linux: get all connect calls for a local port

I have a ssh tunnel through which a client is connecting to a server. Using, wireshark, I could see a periodic connection of SSH besides the keepalive, but I am unable to obtain the process (pid) that'...
0
votes
0answers
14 views

Tracking down malware network activity [duplicate]

OS: Debian 8 I have over 30 websites running on my webserver. Since yesterday there has been some suspicious outgoing internet activity related to the address "192.42.116.41". After a quick google ...
4
votes
1answer
225 views

Random timestamp on first syn-ack on loopback

Preface We are testing some host based IPS. In this test case, our application is listening on the loopback and the application is receiving traffic in clear text. We are using either nginx or ...
0
votes
1answer
212 views

How do I filter tcpdump results based on a missing header?

My HAProxy adds 'X-Proto: SSL' as a header to requests that are over HTTPS. I'd like to use tcpdump to see the 'Host:' header of all requests that do not have that 'X-Proto: SSL' header. Here's what ...
0
votes
0answers
31 views

Subdomain delegation traffic capture explaination

I have host Windows system with IP 192.168.1.33 and two guest Linux systems (one with IP 192.168.1.120 and second with IP 192.168.1.140) which has bind installed on them. Server .120 delegates reverse ...
0
votes
1answer
588 views

When using tcpdump's `-i any` argument, how to get also interface name inline? [duplicate]

I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server. I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any ...
0
votes
0answers
134 views

Data transfer failing

We have a situation where a transfer from a linux server to a windows 2016 server starts off well, the gets to a point in the transfer where the throughput declines from ~30MB/s to zero within 3-5 ...
-1
votes
1answer
29 views

Weird behavior of VPS host

Hi I noticed strange behavior on my VPS host I launch nmap on my laptop and scan VPS host nmap screenshot Listed netstat on VPS server netstat screenshot Tried to connect to some port connection ...
1
vote
0answers
60 views

Wifi interface drops all packets

I have a remote system connected via WiFi to the network. The wifi connection is established correctly and I can ping the gateway. The maintainer of the gateway (3rd party, not accessible for me) ...
1
vote
2answers
263 views

TCPdump write permission error when using -w option

I faced a very weird error, I'm running tcpdump by the root and want to log the output, when I do tcpdump -i eth0 -w logs/local.dump it works fine, but when I set the output path like bellow, I get ...
0
votes
1answer
363 views

How to collect HTTP data in Wireshark from a remote Linux host?

I am trying to collect HTTP requests and responses from a remote host using Wireshark using SSH tunnel. So I have Windows host with Wireshark on it, and Linux host with tcpdump on it and a web server ...
0
votes
1answer
301 views

tcpdump host unreachables for specific host

I'm trying to rule out some issues and needing to capture all ICMP messages except echo/echo reply. However the issue I'm struggling to find a way around is I only want these involving a particular ...
0
votes
1answer
600 views

Why does TCP request packet contain ACK flag? [closed]

I am very new at low level of TCP and I am tryingtcpdump with simple socket server and client program. The server and client follow the two steps. Server and client make a connection. Client sends ...
5
votes
2answers
2k views

Linux: tracking the source of netstat -s “failed connection attempts”

I have several servers, where the failed connection attempts metric returned by netstat -s (from /proc/net/snmp) grows by roughly one per second, and I'd like to diagnose the source of these. By ...
0
votes
1answer
64 views

What data is not available for tcpdump unlike interface statistics tools?

I'm analizing the logs on specific interface and wondering why this command during small load-test: tcpdump -i enp21s0f0 -s0 -w /tmp/dump2.cap` catched only 75 MB, when ethtool -S enp21s0f0 / ...
0
votes
1answer
209 views

tcpdump not intercepting DHCP ACK

I have a router running lede with tcpdump installed tcpdump --version # tcpdump version 4.9.0 # libpcap version 1.8.1 When I run it like so: tcpdump -vnes0 -i eth0 port 67 or port 68 I can see ...
1
vote
1answer
175 views

tcpdump - how to track the source of requests made with ephemeral/dynamic ports

I'm trying to identify the network traffic between multiple backend microservices running on the same server. (they make some rest http calls to each other) Unfortunately, when i use tcpdump, the ...
0
votes
0answers
107 views

Webserver cannot ping external

I want our webserver to be accessible from the outside world. We have a static IP - 176.35.XXX.XXX which is accessible when on the same network as the webserver, however times out externally. When ...
0
votes
1answer
25 views

Accessing webserver remotely (contains tcpdump)

Total noob here so apologies in advance for missing out any key details. We have a web server which is accessible locally on 192.168.2.1. It is also accessible locally on 176.XXX.XXX.XXX which is ...