Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
410
questions
0
votes
0answers
13 views
communication between 2 servers via NSP
I'm in a situation where one server(tb06) should populate its health status to another server(admin03) via NSP in nsxml format.
When I have taken TCPDUMP(.pcap) on admin03, apart from tb06 HTTP header,...
2
votes
1answer
81 views
How can I capture IPSEC packets on my VPN server?
I am running a strongSwan (U5.3.5/K4.4.0-62-generic) VPN server on Ubuntu 16.04.
Ususally, when I want to examine traffic on a server, I simply run something like the following:
tcpdump -ni eth0 "...
1
vote
2answers
66 views
Display delta timestamp and UDP data payload with tcpdump/tshark
I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head ...
2
votes
2answers
22 views
tcpdump, how to capture actual data only？
For example I have a server listening on port 8001, a client programe open a tcp socket connect to that port, send some binary data, I want to capture the actual data only without any TCP/IP header ...
1
vote
1answer
33 views
Re-routing DNS queries with iptables properly without resolv.conf
I run a custom DNS service on 127.0.0.1:53 and I dont just want all queries to go through it, I also want only that service to respond back. Which is where the problem arises. My NAT iptables setup:
...
0
votes
1answer
35 views
Trying to capture 3-way handshake in linux
I am trying to capture 3-way handshake using the following in linux, it does not seems to work...
sudo tcpdump "tcp[tcpflags] & (tcp-syn) !=0" -w filename.pcap -i eth0
Could you someone suggest ...
0
votes
1answer
21 views
Proxy service only responding on some IP addresses (others suck on SYN_RECV)
I have a server using a proxy service (WAF etc) which forwards packets to my server.
I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV:
tcp 0 ...
0
votes
0answers
24 views
How we have differentiate the packet capture based on the RX & TX
I am working in the security industry. We have taken packet capture on the firewall multiple times.
Can we take Pcap based on RX and & tx and force the tcpdump command to write the output in two ...
3
votes
0answers
55 views
TCP Window Scaling Not Working Between Windows 10 and Linux Server
We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server.
We can't reproduce the error on our end but notice that TCP window scaling is ...
-1
votes
1answer
52 views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
1
vote
0answers
22 views
tcpdump not capturing packets but Apache log shows the request
I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
0
votes
0answers
24 views
How to set Openvpn mtu, given these tcpdump test results?
I have been warned that the maximum tranport unit (mtu) of the cloud server is 1454 bytes.
Indeed, I tried two pings and 1426=1454-28(udp header) is the maximum size one packet of UDP can deliver
...
0
votes
0answers
49 views
Multiple TCP dup ACK with spurious retransmission
I have a cellular IoT-device connected to a MQTT broker with a keep alive of 15 sec. It happens once a day that the device gets disconnected from the server (server log shows: client stopped due to ...
0
votes
0answers
15 views
Does tcpdump guarantee packet integrity?
In normal use of tcpdump without any parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap
In using tcpdump rotating by time with -G parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap -...
0
votes
0answers
36 views
Duplicate ACK and TCP Retransmissions
I'm doing some scp transfers between an AIX and a Linux in two separated LAN (I have a VPN between them).
Sometimes the connection ends well, so I get 50MB/s. In many other cases, instead, the ...
0
votes
1answer
77 views
Why is an interface ignored by -i any with tcpdump/wireshark?
Using tcpdump and wireshark, if I capture with -i enp1s0f0, no problem I can see the packets.
If I capture with -i any, I don't see the enp1s0f0's packets.
Why? Is there a NetworkManager option or ...
0
votes
1answer
37 views
How do I capture packets on a Linux VM in a VMware environment?
I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the ...
0
votes
0answers
24 views
Is it possible to save TCDUMP (pt-query-digest) report at database?
I want to save all the information that I get from a tcpdump command in terminal and save it on database, more easy to search and find what I want.
I run this command first.
tcpdump -i any port ...
0
votes
1answer
84 views
Monitor MySQL Connection and Request
I'm trying to monitor all incoming connections to a mysql database. I've used
tcpdump port 3306 and '(tcp-syn|tcp-ack)!=0'
currently which is showing connections but is there a way to also see what ...
0
votes
0answers
22 views
How to use Wireshark to decode HTTP stream?
I'm using an application that outputs each HTTP stream as two files: connection.out and connection.in. The .out file contains everything the client sends to the server (i.e. requests), and the .in ...
0
votes
1answer
19 views
Why does one of four-way handshake miss with the command nc
I'm using the command nc to simulate the TCP connection with a client and a server.
I execute the command nc -l 1234 and tcpdump -i eth0 port 1234 at the server and I execute the command nc ...
0
votes
1answer
49 views
Tcpdump logfile
the thing is I am trying transfer log file from one server to another dividing by size. I have dump such as:
tcpdump -i any tcp x.x.x.x -s 0 -G 86400 -w /var/log/%F.zip
Questions are:
The output ...
0
votes
0answers
96 views
tcpdump filter for QoS PCP/DEI values in L2 VLAN header
I need tcpdump filter for specific packets which have VLAN ID 10 and some specific PCP/DEI values.
For example I have packet with next VLAN header:
110. .... .... .... = Priority: Voice, < 10ms ...
0
votes
1answer
92 views
Sending tcpdump/pcap files to a remote server
I want to get all traffic on an embedded system, using tcpdump. I will send those files via sftp or ssh to my server.
Can it happen, that tcpdump "sees" the transfer of the pcap files to my server? ...
0
votes
0answers
45 views
how to block specified packet sent to my server linux
someone create a script to hurt my chat application with injection, i was able to capture data sent by this bad guy, i tried to block this packets via iptables but didnt work
here is the data ...
-1
votes
1answer
125 views
Traffic on port 80 although Http-Server is not running
Good'day
Just out of curiosity I did a tcpdump port 80 on one of my remote virtual machines. I see a huge amount of requests to this http-port, 95% going to some AWS EC2 instance. Strange thing: The ...
0
votes
0answers
31 views
Strange (mail related) traffic on my server
I'm noticing strange traffic on my webserver which is around 50kbps constantly. Doing a (few seconds worth of) tcpdump on the specific ip address, I get this (pardon the huge list):
09:33:02.385238 ...
1
vote
1answer
51 views
Odd Output From tcpdump On Linux
I am using the following tcpdump command on CentOS 7:
sudo tcpdump -A -l -i any -s 0 -n host <IP Address> and port 5060 or port 5061
And I am seeing (on each packet) the following sorts of ...
0
votes
0answers
19 views
Extracting useful httpd data from tcpflow
I use the following command
tcpflow -p -c port 80 | grep -B10 "Host: "
to monitor httpd traffic in my server. It's very useful, and it returns
something like this
193.169.254.005.50104-05.01.021....
3
votes
1answer
259 views
Why does the TCP server wait for an ACK when sufficient window is available at client side [duplicate]
I'm observing the below behavor in a TCP connection between a server application and a client which run on two different Red Hat machines.
Example 1
Client acks everything until now (ACK with WND = ...
1
vote
1answer
103 views
Long TCPDUMP capture taking slowly but surely all available memory in RAM
When I tcpdump the network traffic on my ubuntu server, I see the free memory decreasing with time.
It seems that the captures are stored in memory.
At first, I noticed the problem because i was ...
0
votes
1answer
110 views
TCPDUMP, tcp Flag not changing from Flags [S] to other flag values
I need support understanding these lines.
when i tried to connect to server in a particular port it shows connecting and gives me timeout error.
But in the tcp-dump command the packet flag not ...
1
vote
0answers
26 views
Network packets don't reach local host when connected with to Openstack VPS with Openvpn server
So here is an issue.
I've installed OpenVPN server on Openstack VPS (hostigger, if this is important). I've used guide https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-...
0
votes
1answer
35 views
TCPDump, can't understand these parts
I need help to understand the bold part of this line :
01:04:28.539138 IP 90.2.255.58.37727 > 71.197.145.153.46872: . 9801:11201(1400) ack 0 win 2003
9801:11201(1400)
9801 seems to be the data ...
-1
votes
1answer
870 views
Why tcpdump has 262144 as default capture size?
I was wondering for the reason that why tcpdump has magic number 262144 as default snapshot length?
--snapshot-length=snaplen
Snarf snaplen bytes of data from each packet rather than the ...
0
votes
1answer
51 views
Understanding failed connection reason
Edit: The issue came about because our machines did not have external IP address and so outgoing traffic was going through Cloud NAT, which was misconfigured (min connections per vm)
I am having ...
google-compute-engine
1
vote
1answer
358 views
Tracing Active FTP Session (data channel)
To debug an issue with active FTP, we are tracing active FTP session traffic with tcpdump running in a toolbox container on a GKE node. The active FTP session is failing on the data channel.
I am ...
0
votes
0answers
18 views
Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
1answer
97 views
Connections shows up in tcpdump but cannot not in auditd or ss
I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I ...
2
votes
2answers
169 views
Meaning of tcpdump P direction
The situation is a VM running under kvm/libvirt/qemu (10.202.7.128) pinging another hardware-based system (10.202.7.4) via the hypervisor's bridge. Everything works OK but 'tcpdump -neli any icmp and ...
0
votes
1answer
16 views
host mirroring on multiple VM (unique VNETid/uuid)
We want to mirror all traffic going in/out port vnet0, and we want to send it to bridge port vnet2 (where we have a traffic monitoring application) and make sure traffic from vnet2 is excluded on ...
0
votes
2answers
286 views
tcpdump filter by/print last hop
If I have a network that looks like this:
56.56.56.56 192.168.0.1/24
___________
---| Modem 1 |-----
| ___________ | ...
1
vote
1answer
57 views
Wireshark capture filter from list file
Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
1
vote
3answers
487 views
How can i see packets while capturing with tcpdump
How can I see traffic while I am capturing it with tcpdump.
When I use -w, it doesn't show the packets during the capture.
sudo tcpdump -i enp2s0 -w test.pcap
tcpdump: listening on enp2s0, link-type ...
14
votes
2answers
606 views
CoreOS: tcpdump mysteriously solves network issue (excessive number of sockets used)
I've got a mystery for you today. We run a small, three node Elasticsearch cluster based on CoreOS (2023.5.0 / Linux 4.19.25-coreos) on Azure. Elasticsearch is run inside a docker container in host ...
1
vote
1answer
366 views
Analyzing traffic by tcpdump between HAProxy server and mariadb
I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results:
23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
0
votes
1answer
97 views
What does “AF” mean in tcpdump?
This seems to show up only with -e and for me only on my VPN interface, e.g.:
> sudo tcpdump -enn -i utun1
...
11:35:22.440690 AF IPv4 (2), length 32: 1.2.3.4.1234 > 1.2.3.5.1234: [|domain]
...
2
votes
1answer
854 views
Netstat and ss doesn't see connection
I'm trying to find which application running on Kubernetes cluster is using a specific port to communicate with RabbitMQ cluster. On RabbitMQ I see that connection is coming from 192.168.1.10:34226. ...
1
vote
0answers
566 views
PowerDNS AXFR - ;; communications error to x.x.x.x#53: end of file
Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server.
This /24 is part of a larger RIPE block, /22, and is not ...
1
vote
1answer
52 views
Is this a valid TLS handshake
I am trying to validate a TLS version by establishing a connection with the server, below is the packet capture.
All I need to know is whether this means a connection was established or refused, and ...
