2022 Developer Survey is open! Take survey.

Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

Filter by
Sorted by
Tagged with
0 votes
1 answer
46 views

Linux: bridge vs. vlan vs. tcpdump

I have a Proxmox host with kernel 5.15.19-2-pve. It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic. I created a vmbr666 bridge that shows looks like this: # /etc/...
user avatar
0 votes
1 answer
31 views

docker containaer promiscuous mode partially working

I have strange virtual (docker bridges) networking condition I have two dockers connected to the same bridge via docker-compose. One docker is "probe" and one is "injector". ...
user avatar
  • 173
0 votes
0 answers
34 views

How to figure out what is bad about a 400 bad request, on an Apache-server

The overarching question How do I see what is 'bad' about a 400 - bad request? Info about the error When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
user avatar
  • 111
0 votes
0 answers
28 views

How to set tcpdump sample rate

I would like to be able to use tcpdump (or a similar tool) to log traffic on a busy host, but instead of logging every packet that passes my ip/host/port/etc filters, only log with some specified ...
user avatar
  • 1
3 votes
1 answer
197 views

Tcpdump showing different redirection port after adding REDIRECT rule in iptables

I am attempting to direct client traffic to a kubernetes cluster NodePort listening on 192.168.1.100.30000. Client's needs to make a request to 192.168.1.100.8000 so I added the following REDIRECT ...
user avatar
1 vote
1 answer
148 views

Extracting TCP application data from pcap file

Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
user avatar
0 votes
0 answers
290 views

dnsmasq DHCP not working, not replying to DHCP requests

I have setup dnsmasq as DHCP server on a CentOS VM, however it is not replying to DHCP requests. What could be the issue? Following is the configuration and tcpdump logs. interface=ens224 listen-...
user avatar
  • 101
0 votes
1 answer
37 views

TCPDUMP Order of Operations: exclude and include

Trying to look at multicast traffic so I created a filter to monitor the range, then began to slowly add statements to exclude things not relevant but didnt get expected results. Do you do the ...
user avatar
0 votes
0 answers
50 views

Log TCP Client port on apache mod_proxy

Using an Apache 2.4 Reverse Proxy (with mod_proxy) that connects to a backend HTTP service we have the following(simplified) series of TCP connections: client ClientIP:random_port1 ---> <IP1:443 ...
user avatar
  • 478
0 votes
2 answers
90 views

TCDump Missing packets

We use TCPDump on an RPI to capture WiFi signals from nearby devices as a means to get an estimate of number of people. We have notice the on "normal" days the numbers are reasonably ...
user avatar
2 votes
2 answers
392 views

tcpdump filtering out specific ips and specific ports with that ip

I want to filter out several specific ips and ports with tcpdump. example 192.168.1.100 port 1111 192.168.1.101 port 3333 I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 ...
user avatar
1 vote
1 answer
117 views

tcpdump output has a different hostname

Sorry in advance for the simple question, but I'm trying to educate myself on tcpdump and networks. I'm tracing all traffic going to a certain host with tcpdump -SX -i any dst host host.site.com ...
user avatar
0 votes
1 answer
32 views

daemonized alternative to tcpdump to save mirrored traffic

I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
user avatar
1 vote
1 answer
70 views

How to find the linux user that sent the packet [duplicate]

Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this : our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
user avatar
  • 113
1 vote
0 answers
281 views

tcpdump: filtering out localhost, packets show up anyway?

I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web. I've came this far as of yet: lan_hosts="(hosts || to || exclude)" local_hosts="(127.0.0....
user avatar
0 votes
1 answer
139 views

QEMU VM with tap interface sees all packages coming from hypervisor instead of real source IP

I have set up a very simple Hypervisor using Alpine Linux and my VM sees all traffic coming from the IP of the hypervisor. Which also means if fail2ban tries to block attacks, it always blocks the ...
user avatar
  • 333
1 vote
1 answer
28 views

Different length between ping and tcpdump

I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the ...
user avatar
  • 13
0 votes
0 answers
93 views

Please explain the ASA capture to identify re-transmissions

I have recently started troubleshooting an issue and client is suspecting re-transmissions based on the below capture, I am not sure why the data packets are repeating over and over for multiple times ...
user avatar
  • 1
0 votes
1 answer
230 views

Piping SSH to wireshark on windows

In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
user avatar
  • 360
0 votes
1 answer
322 views

Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?

I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
user avatar
0 votes
1 answer
386 views

Can (and do) I use iptables to expose a host directly online (not using NAT)?

I'm using a DSL-5300 VDSL modem/router which is set up with NAT for my house, and works great. Its web interface hasn't been written to support a mix of NAT and no-NAT traffic. I've been assigned 8 ...
user avatar
  • 59
0 votes
0 answers
23 views

need help to understand tcpdump

Background: I have a web server hosted on 10.20.30.177:7000 and it should be accessible from 10.20.30.1 (m1) and 172.17.2.88 (m2). I am able to access from m1 and not from m2. I understand there can ...
user avatar
  • 101
1 vote
0 answers
404 views

tcpdump: invalid cksum from client to localhost interface even after disabling offloading

I'm having a strange issue. In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
user avatar
  • 11
0 votes
1 answer
109 views

Two clients can connect to OpenVPN server but another cannot

I have an external OpenVPN server running Ubuntu 20.04 and 3 clients: Client1 (Android 11) Client2 (Windows 10 and Virtualbo host) Client3 (Ubuntu 20.04 Virtualbox guest) All 3 clients are able to ...
user avatar
0 votes
1 answer
847 views

openvpn server not showing traffic using tcpdump

I have an OpenVPN server and two clients, I can ping clients from each other, but when I do so, I don't see any packets on the server using tcpdump Server is running on 192.168.0.1 and I try to ...
user avatar
  • 103
0 votes
1 answer
189 views

Capturing IEEE802.11.x auth and capabilities data with tcpdump?

I'm troubleshooting some issues with my wireless network (OpenWrt 19.x and mobile device) and I came across this: https://dot11.exposed/2017/09/20/violation-of-802-11-standard-intel-wireless-cards-...
user avatar
  • 13
0 votes
0 answers
33 views

connection is paused for long

a redis server is running in a different network namespace. I'm trying to connect a client to the redis server, it keeps waiting but is not getting response, its been hours. Client side code: int main(...
user avatar
-1 votes
1 answer
1k views

How can I see the response of the DNS requests that tcpdump is showing me?

I'm using tcpdump (for the first time) to try to debug a DNS issue: tcpdump -n udp port 53 It gives me this output: 10:38:30.431467 IP a.b.c.d.56973 > 8.8.8.8.domain: 49179+ A? ocsp.sectigo.com. (...
user avatar
  • 1,034
9 votes
2 answers
2k views

Why echo request doesn't show in tcpdump?

I have two network segments connected using a IPSEC-VPN tunnel : NET#1: a.b.0.0/16 with LAN gateway a.b.0.1 NET#2: x.y.0.0/16 with LAN gateway x.y.130.1 I initiate a ping from a.b.0.1 to x.y.130.100 ...
user avatar
  • 233
0 votes
1 answer
44 views

Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump

Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet? The server was sending messages to the client At time 10,the ...
user avatar
  • 133
0 votes
1 answer
762 views

Where does tcpdump get the source IP from for a TCP packet?

I've been trying to come up with a solution for a routing problem (multiple interfaces connected to a single Docker container, ensuring response packets go out the right interface), and have come ...
user avatar
0 votes
0 answers
29 views

Identify Source / Trigger of / for Network Traffic locahost

I want to identify the application trat triggers network traffic like the one below. I have dissabled ethernet and wireless cards, and denied incoming traffic in firewall. $ sudo tcpdump -vv -e -A -i ...
user avatar
2 votes
3 answers
513 views

Nginx post-ssl-termination debug mirror

How can I tell nginx to output all incoming traffic for a given server{} to a specific/additional/redundant location after decrypting it (like port mirroring on routers) so that it can be analyzed for ...
user avatar
1 vote
1 answer
74 views

How to split pcap per IRC channels

I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
user avatar
  • 113
0 votes
2 answers
1k views

Packets dropped somewhere between network interface and iptables when forwarded from router

I have a server configured with multiple interfaces and multiple VLANs. It works perfectly fine for all the local networks, it drops packets forwarded through my router for some reason though. And it'...
user avatar
0 votes
1 answer
274 views

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
user avatar
  • 134
0 votes
1 answer
234 views

How to specify both IP address and port in tcpdump?

I want to specify a source IP address, destination IP address and source port in my tcpdump filter. However, I keep getting syntax errors. How do I do that?
user avatar
0 votes
0 answers
425 views

Wireshark TLS conversation for ldaps

I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark. Here is what I get from client side on a conversation with delays: I see the following problems: I ...
user avatar
  • 478
1 vote
1 answer
478 views

Forwarded Packets are received by namespace's veth0 but not received by application

I use libtins (It uses Pcap) to capture link layer packets and forward to a network namespace where the actual application runs on. Client(Browser) -> Server -> Pcap -> Pcap Send -> br0 (...
user avatar
  • 11
1 vote
2 answers
1k views

tcpdump can't open file: permission denied (linux)

I set all filters for Tcpdump in a config file, but when I run this command: sudo tcpdump -i any -w "./mypcap.pcap" -F "myfilters.txt" I get permission denied although my file ...
user avatar
  • 111
2 votes
2 answers
9k views

How can I capture IPSEC packets on my VPN server?

I am running a strongSwan (U5.3.5/K4.4.0-62-generic) VPN server on Ubuntu 16.04. Ususally, when I want to examine traffic on a server, I simply run something like the following: tcpdump -ni eth0 "...
user avatar
  • 313
1 vote
2 answers
1k views

Display delta timestamp and UDP data payload with tcpdump/tshark

I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format. An example of the desired output would be as follows: % head ...
user avatar
  • 124
2 votes
3 answers
2k views

tcpdump, how to capture actual data only?

For example I have a server listening on port 8001, a client programe open a tcp socket connect to that port, send some binary data, I want to capture the actual data only without any TCP/IP header ...
user avatar
1 vote
1 answer
242 views

Re-routing DNS queries with iptables properly without resolv.conf

I run a custom DNS service on 127.0.0.1:53 and I dont just want all queries to go through it, I also want only that service to respond back. Which is where the problem arises. My NAT iptables setup: ...
user avatar
  • 13
0 votes
1 answer
1k views

Trying to capture 3-way handshake in linux

I am trying to capture 3-way handshake using the following in linux, it does not seems to work... sudo tcpdump "tcp[tcpflags] & (tcp-syn) !=0" -w filename.pcap -i eth0 Could you someone suggest ...
user avatar
  • 11
0 votes
1 answer
101 views

Proxy service only responding on some IP addresses (others suck on SYN_RECV)

I have a server using a proxy service (WAF etc) which forwards packets to my server. I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV: tcp 0 ...
user avatar
  • 1,120
3 votes
0 answers
542 views

TCP Window Scaling Not Working Between Windows 10 and Linux Server

We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server. We can't reproduce the error on our end but notice that TCP window scaling is ...
user avatar
-1 votes
1 answer
306 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
user avatar
  • 1
1 vote
0 answers
122 views

tcpdump not capturing packets but Apache log shows the request

I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
user avatar
0 votes
0 answers
28 views

Does tcpdump guarantee packet integrity?

In normal use of tcpdump without any parameter, does it guarantee? tcpdump -i eth0 -w file.pcap In using tcpdump rotating by time with -G parameter, does it guarantee? tcpdump -i eth0 -w file.pcap -...
user avatar

1
2 3 4 5
9