Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
432
questions
0
votes
0answers
21 views
Site-to-Site VPN from AWS to DO: Unreachable from One Side
I have a new AWS Site-to-Site VPN tunnel. The tunnel is currently "UP". It uses a Customer Gateway that points to an Ubuntu server running strongSwan VPN in DigitalOcean.
I'm attempting to ...
-1
votes
0answers
53 views
Why is tcpdump not seeing certain traffic
I'm trying to see traffic from a server interface that is receiving port mirrored traffic with tcpdump.
Using tcpdump -i ens224 -s65535 -w /tmp/file.pcap I can see that all port mirrored traffic is ...
0
votes
1answer
75 views
Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?
I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
0
votes
0answers
46 views
Kernel TCP stack not forwarding packets immediately to remote server
I'm trying to figure out why a single HTTP POST request over a re-used TLS connection is still taking roughly twice the roundtrip time (RTT). The client is running on Debian 10.8 within a container on ...
0
votes
1answer
36 views
Can (and do) I use iptables to expose a host directly online (not using NAT)?
I'm using a DSL-5300 VDSL modem/router which is set up with NAT for my house, and works great. Its web interface hasn't been written to support a mix of NAT and no-NAT traffic.
I've been assigned 8 ...
0
votes
0answers
34 views
TCP: Why would I get a PUSH+ACK after sending RST
I'm rolling out my own web server and I rely on TCPDUMP to see whats happening behind the scenes. The server address is 192.168.7.2 and the client is 192.168.7.1.
I used curl (and also tried wget) to ...
0
votes
0answers
19 views
need help to understand tcpdump
Background: I have a web server hosted on 10.20.30.177:7000 and it should be accessible from 10.20.30.1 (m1) and 172.17.2.88 (m2). I am able to access from m1 and not from m2. I understand there can ...
1
vote
0answers
38 views
tcpdump: invalid cksum from client to localhost interface even after disabling offloading
I'm having a strange issue.
In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
0
votes
1answer
34 views
Two clients can connect to OpenVPN server but another cannot
I have an external OpenVPN server running Ubuntu 20.04 and 3 clients:
Client1 (Android 11)
Client2 (Windows 10 and Virtualbo host)
Client3 (Ubuntu 20.04 Virtualbox guest)
All 3 clients are able to ...
0
votes
1answer
96 views
openvpn server not showing traffic using tcpdump
I have an OpenVPN server and two clients,
I can ping clients from each other, but when I do so, I don't see any packets on the server using tcpdump
Server
is running on 192.168.0.1
and I try to ...
0
votes
1answer
58 views
Capturing IEEE802.11.x auth and capabilities data with tcpdump?
I'm troubleshooting some issues with my wireless network (OpenWrt 19.x and mobile device) and I came across this:
https://dot11.exposed/2017/09/20/violation-of-802-11-standard-intel-wireless-cards-...
0
votes
0answers
10 views
experimenting with vlan setup in terms of inspecting
I initialized vlan test interface over default enp7s0, using ip link add link enp7s0 name test type vlan id 2. As I have very limited experience with the configs of networking, I left things like ...
0
votes
0answers
25 views
connection is paused for long
a redis server is running in a different network namespace. I'm trying to connect a client to the redis server, it keeps waiting but is not getting response, its been hours.
Client side code:
int main(...
0
votes
0answers
37 views
How to filter out the network timeout cause out of the output of tcpdump, wireshark and such tools?
third party Linux server sending around 15 GB of the data each day via FTP port 21 to my Linux (CentOS) server (headless). Problem is that recent days some of the transferred files timeout:
...
-1
votes
1answer
87 views
How can I see the response of the DNS requests that tcpdump is showing me?
I'm using tcpdump (for the first time) to try to debug a DNS issue:
tcpdump -n udp port 53
It gives me this output:
10:38:30.431467 IP a.b.c.d.56973 > 8.8.8.8.domain: 49179+ A? ocsp.sectigo.com. (...
9
votes
2answers
1k views
Why echo request doesn't show in tcpdump?
I have two network segments connected using a IPSEC-VPN tunnel :
NET#1: a.b.0.0/16 with LAN gateway a.b.0.1
NET#2: x.y.0.0/16 with LAN gateway x.y.130.1
I initiate a ping from a.b.0.1 to x.y.130.100 ...
0
votes
1answer
23 views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
0
votes
1answer
385 views
Where does tcpdump get the source IP from for a TCP packet?
I've been trying to come up with a solution for a routing problem (multiple interfaces connected to a single Docker container, ensuring response packets go out the right interface), and have come ...
0
votes
0answers
19 views
Intermittent connection failure (TCPDUMP RST)
From a ubuntu 20.04 server, if we curl https://google.com -v a handful of times, it'll get really slow (5seconds - timing out) while establishing the SSL handshake. This is true for any host, not just ...
0
votes
0answers
23 views
Identify Source / Trigger of / for Network Traffic locahost
I want to identify the application trat triggers network traffic like the one below.
I have dissabled ethernet and wireless cards, and denied incoming traffic in firewall.
$ sudo tcpdump -vv -e -A -i ...
1
vote
3answers
184 views
Nginx post-ssl-termination debug mirror
How can I tell nginx to output all incoming traffic for a given server{} to a specific/additional/redundant location after decrypting it (like port mirroring on routers) so that it can be analyzed for ...
1
vote
1answer
43 views
How to split pcap per IRC channels
I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
0
votes
2answers
411 views
Packets dropped somewhere between network interface and iptables when forwarded from router
I have a server configured with multiple interfaces and multiple VLANs. It works perfectly fine for all the local networks, it drops packets forwarded through my router for some reason though. And it'...
0
votes
1answer
123 views
Pcap (tcpdump) filter to match against local port
I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port.
That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
0
votes
1answer
55 views
How to specify both IP address and port in tcpdump?
I want to specify a source IP address, destination IP address and source port in my tcpdump filter. However, I keep getting syntax errors. How do I do that?
0
votes
0answers
99 views
Wireshark TLS conversation for ldaps
I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark.
Here is what I get from client side on a conversation with delays:
I see the following problems:
I ...
1
vote
1answer
203 views
Forwarded Packets are received by namespace's veth0 but not received by application
I use libtins (It uses Pcap) to capture link layer packets and forward to a network namespace where the actual application runs on.
Client(Browser) -> Server -> Pcap -> Pcap Send -> br0 (...
1
vote
1answer
493 views
tcpdump can't open file: permission denied (linux)
I set all filters for Tcpdump in a config file, but when I run this command:
sudo tcpdump -i any -w "./mypcap.pcap" -F "myfilters.txt"
I get permission denied although my file ...
0
votes
0answers
15 views
How to find out which http/s request is blocked due to hosts file?
I saw many packets on loopback (lo0) interface on wireshark and tcpdump like this
171 1118.753013 127.0.0.1 127.0.0.1 443 TCP 68 54857 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=16344 WS=32 TSval=...
0
votes
0answers
15 views
communication between 2 servers via NSP
I'm in a situation where one server(tb06) should populate its health status to another server(admin03) via NSP in nsxml format.
When I have taken TCPDUMP(.pcap) on admin03, apart from tb06 HTTP header,...
2
votes
1answer
3k views
How can I capture IPSEC packets on my VPN server?
I am running a strongSwan (U5.3.5/K4.4.0-62-generic) VPN server on Ubuntu 16.04.
Ususally, when I want to examine traffic on a server, I simply run something like the following:
tcpdump -ni eth0 "...
1
vote
2answers
400 views
Display delta timestamp and UDP data payload with tcpdump/tshark
I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head ...
2
votes
2answers
661 views
tcpdump, how to capture actual data only？
For example I have a server listening on port 8001, a client programe open a tcp socket connect to that port, send some binary data, I want to capture the actual data only without any TCP/IP header ...
1
vote
1answer
63 views
Re-routing DNS queries with iptables properly without resolv.conf
I run a custom DNS service on 127.0.0.1:53 and I dont just want all queries to go through it, I also want only that service to respond back. Which is where the problem arises. My NAT iptables setup:
...
0
votes
1answer
494 views
Trying to capture 3-way handshake in linux
I am trying to capture 3-way handshake using the following in linux, it does not seems to work...
sudo tcpdump "tcp[tcpflags] & (tcp-syn) !=0" -w filename.pcap -i eth0
Could you someone suggest ...
0
votes
1answer
50 views
Proxy service only responding on some IP addresses (others suck on SYN_RECV)
I have a server using a proxy service (WAF etc) which forwards packets to my server.
I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV:
tcp 0 ...
0
votes
0answers
55 views
How we have differentiate the packet capture based on the RX & TX
I am working in the security industry. We have taken packet capture on the firewall multiple times.
Can we take Pcap based on RX and & tx and force the tcpdump command to write the output in two ...
3
votes
0answers
312 views
TCP Window Scaling Not Working Between Windows 10 and Linux Server
We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server.
We can't reproduce the error on our end but notice that TCP window scaling is ...
-1
votes
1answer
83 views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
1
vote
0answers
44 views
tcpdump not capturing packets but Apache log shows the request
I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
0
votes
0answers
21 views
Does tcpdump guarantee packet integrity?
In normal use of tcpdump without any parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap
In using tcpdump rotating by time with -G parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap -...
0
votes
0answers
64 views
Duplicate ACK and TCP Retransmissions
I'm doing some scp transfers between an AIX and a Linux in two separated LAN (I have a VPN between them).
Sometimes the connection ends well, so I get 50MB/s. In many other cases, instead, the ...
0
votes
1answer
89 views
Why is an interface ignored by -i any with tcpdump/wireshark?
Using tcpdump and wireshark, if I capture with -i enp1s0f0, no problem I can see the packets.
If I capture with -i any, I don't see the enp1s0f0's packets.
Why? Is there a NetworkManager option or ...
0
votes
1answer
144 views
How do I capture packets on a Linux VM in a VMware environment?
I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the ...
1
vote
1answer
138 views
Monitor MySQL Connection and Request
I'm trying to monitor all incoming connections to a mysql database. I've used
tcpdump port 3306 and '(tcp-syn|tcp-ack)!=0'
currently which is showing connections but is there a way to also see what ...
0
votes
1answer
25 views
Why does one of four-way handshake miss with the command nc
I'm using the command nc to simulate the TCP connection with a client and a server.
I execute the command nc -l 1234 and tcpdump -i eth0 port 1234 at the server and I execute the command nc ...
0
votes
1answer
139 views
Tcpdump logfile
the thing is I am trying transfer log file from one server to another dividing by size. I have dump such as:
tcpdump -i any tcp x.x.x.x -s 0 -G 86400 -w /var/log/%F.zip
Questions are:
The output ...
0
votes
1answer
315 views
Sending tcpdump/pcap files to a remote server
I want to get all traffic on an embedded system, using tcpdump. I will send those files via sftp or ssh to my server.
Can it happen, that tcpdump "sees" the transfer of the pcap files to my server? ...
-1
votes
1answer
241 views
Traffic on port 80 although Http-Server is not running
Good'day
Just out of curiosity I did a tcpdump port 80 on one of my remote virtual machines. I see a huge amount of requests to this http-port, 95% going to some AWS EC2 instance. Strange thing: The ...
0
votes
0answers
34 views
Strange (mail related) traffic on my server
I'm noticing strange traffic on my webserver which is around 50kbps constantly. Doing a (few seconds worth of) tcpdump on the specific ip address, I get this (pardon the huge list):
09:33:02.385238 ...
