Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

How to view encrypted traffic (https) generated by a Python script in ssldump? [closed]

I am trying to debug my Python script that communicates with a web page. Specifically, the script brute-forces a web form to solve a ctf competition task. For debug purposes, I want to view outgoing ...
1
vote
1answer
71 views

Tracing Active FTP Session (data channel)

To debug an issue with active FTP, we are tracing active FTP session traffic with tcpdump running in a toolbox container on a GKE node. The active FTP session is failing on the data channel. I am ...
0
votes
0answers
16 views

Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
1answer
47 views

Connections shows up in tcpdump but cannot not in auditd or ss

I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections. I ...
2
votes
2answers
122 views

Meaning of tcpdump P direction

The situation is a VM running under kvm/libvirt/qemu (10.202.7.128) pinging another hardware-based system (10.202.7.4) via the hypervisor's bridge. Everything works OK but 'tcpdump -neli any icmp and ...
0
votes
1answer
13 views

host mirroring on multiple VM (unique VNETid/uuid)

We want to mirror all traffic going in/out port vnet0, and we want to send it to bridge port vnet2 (where we have a traffic monitoring application) and make sure traffic from vnet2 is excluded on ...
0
votes
2answers
51 views

tcpdump filter by/print last hop

If I have a network that looks like this: 56.56.56.56 192.168.0.1/24 ___________ ---| Modem 1 |----- | ___________ | ...
1
vote
1answer
27 views

Wireshark capture filter from list file

Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
1
vote
3answers
60 views

How can i see packets while capturing with tcpdump

How can I see traffic while I am capturing it with tcpdump. When I use -w, it doesn't show the packets during the capture. sudo tcpdump -i enp2s0 -w test.pcap tcpdump: listening on enp2s0, link-type ...
14
votes
1answer
347 views

CoreOS: tcpdump mysteriously solves network issue (excessive number of sockets used)

I've got a mystery for you today. We run a small, three node Elasticsearch cluster based on CoreOS (2023.5.0 / Linux 4.19.25-coreos) on Azure. Elasticsearch is run inside a docker container in host ...
1
vote
1answer
103 views

Analyzing traffic by tcpdump between HAProxy server and mariadb

I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results: 23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
0
votes
1answer
67 views

What does “AF” mean in tcpdump?

This seems to show up only with -e and for me only on my VPN interface, e.g.: > sudo tcpdump -enn -i utun1 ... 11:35:22.440690 AF IPv4 (2), length 32: 1.2.3.4.1234 > 1.2.3.5.1234: [|domain] ...
1
vote
1answer
246 views

Netstat and ss doesn't see connection

I'm trying to find which application running on Kubernetes cluster is using a specific port to communicate with RabbitMQ cluster. On RabbitMQ I see that connection is coming from 192.168.1.10:34226. ...
1
vote
0answers
139 views

PowerDNS AXFR - ;; communications error to x.x.x.x#53: end of file

Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server. This /24 is part of a larger RIPE block, /22, and is not ...
1
vote
1answer
31 views

Is this a valid TLS handshake

I am trying to validate a TLS version by establishing a connection with the server, below is the packet capture. All I need to know is whether this means a connection was established or refused, and ...
0
votes
0answers
19 views

How to analyse external networking performance?

I face a issue with external network performance that is external bandwidth is full. So my question is, is there a way to know whether the external network bandwidth is full or not with tcpdump. ...
0
votes
0answers
644 views

Why TCP Out-Of-Order packet is seen after SYN?

I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior. ...
0
votes
1answer
107 views

Can a TCP packet don't reach the 7th OSI layer

I'm facing a situation where a client establish a TCP connection via telnet (or netcat) in order to connect to a linux server. The server must then send back a banner containing some text info... In ...
0
votes
1answer
263 views

What is localhost.webcache in tcpdump

I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
0
votes
0answers
53 views

GCP Internal Load Balancer not responding

I am trying to reach GCP Internal Load Balancer from external network connected via 3rd party Pritunl-OpenVPN tunnel (tunnel endpoint is on VM). [external network] <------- Pritunl VPN ----> [GCP ...
-1
votes
1answer
268 views

Running tcpdump starts ssh flood

I have runtime Linux running in a PLC. My development machine is running Ubuntu 14.04. The PLC and the development machine are connected through a five port switch. I ssh to PLC from my development ...
2
votes
1answer
271 views

netstat says connection in SYN_SENT but tcpdump captures no data

I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
2
votes
0answers
117 views

Is it possible to capture traffic on host when using KVM passthrough?

I have a KVM guest which uses PCI passthrough for its network interfaces: <hostdev mode='subsystem' type='pci' managed='yes'> <source> <address domain='0x0000' bus='0x05' slot='...
1
vote
0answers
47 views

Server does not respond to SYN [duplicate]

When I launch an FTP transfer from a client machine, it fails because it cannot connect to the server. With tcpdump I can see that the client sends a SYN to the server, and I can also see that the ...
0
votes
2answers
171 views

Weird traffic on all interfaces simultaneously. (Linux)

Every now and then, I check my munin graphs on my production server to see if there's anything out of the ordinary going on. Today I noticed a strange thing. Identical traffic spikes on all (8) ...
0
votes
0answers
21 views

Netty application gets reset flag from client

I have a Netty application, that is running inside a private network. When I access the netty application from inside the network, it works fine. Now we have to access it from outside the network. We ...
0
votes
2answers
430 views

redirect tcpdump generated pcap file to another server while packets are being captured

I was looking for some command like this, it achieves: redirect the tcpdump generated pcap file to another server during the process of 1., using a python script or some tool to analyze each packet. ...
0
votes
1answer
35 views

Analyze Packet Loss Bursts

I need to analyze packet loss bursts in TCP streams. Given a number X a packet lost burst is when more then X consecutive packets got lost. So I have a pcap file and need to count how many bursts ...
0
votes
0answers
25 views

ICMP packet size over 372 are dropped on bond0

i have a target server running on rhel7.4 with kernel 3.10.0-693.11.6.el7 with bond0 and subinterface vlan2001 with MTU 9000 when i ping from a different server which is in a different network with ...
1
vote
1answer
281 views

Email server with no smtp connection

Ubuntu 18.04 on Google Compute Dovecot + postfix I figure I should be able to connect to a port other than 465/587, and since I can relay all email through google there should be no issue with this ...
0
votes
0answers
302 views

How to check for firewall drops in WireShark

We have an application setup across two servers. The application is failing because a firewall is blocking communication between the two servers. I need a way to figure out every single port that is ...
0
votes
0answers
1k views

Why is tcpdump not capturing TLS packets on port 443?

I am using the following command: sudo tcpdump -vvv -A -XX -i any -w dump.pcap I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
1answer
1k views

tcpdump: Traffic between localhost:[src-port:dst-port]

I'd like to get http traffic between localhost:8081 and localhost:8080. I need http headers and body. I've tried some commands but everything is complicated and I don't quite figure out what I'm ...
2
votes
1answer
588 views

tcpdump TCP Header offset 13

I am trying to understand how tcpdump works and trying to read TCP header control flags SYN,ACK etc. After researching online I came to know that the control flags are available at offset 13 and I ...
0
votes
1answer
57 views

tcpdump get requesting IP

We are tracking http usage(mainly for our intranet) and I've been able to track it using the the following on our OPENWRT router: tcpdump -i wlan1 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] =...
1
vote
0answers
26 views

Getting different local-port value in tcpdump when using --local-port option in curl

I'm using curl command to send the traffic to the Server. In curl command, I'm using --local-port option. Below is the command: curl -v --interface 10.1.1.3 -b --local-port 10000 http://30.1.1.101/...
1
vote
1answer
799 views

Can I use tcpdump to analyze binary data - gRPC, http2, MessagePack, etc?

Life is simple with text-encoded formats like JSON. I can see enough text in the dump to figure out where something can be wrong. But with the growing popularity of binary interchange formats, I think ...
1
vote
1answer
339 views

iptables blacklist empty User-Agent sip tcpdump

I scan using tcpdump for user-agents that hit my phone server. I get interesting results. i add them to a list that protects alot of my servers out there. This works good. The problem is I get ...
0
votes
1answer
1k views

How to send tcpdump-captured traffic directly to an interface?

I can do it using an intermediate pcap file: tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345' ^C tcpreplay -i eth1 out.pcap Is it possible to skip the pcap and forward all the traffic immediately?...
1
vote
0answers
19 views

No packet crossing default gateway

I have two Ubuntu 17.04 nodes, A (10.0.9.2) and B (10.0.9.1). I have set B as default gateway of A, using the command: route add default gw 10.0.9.1 interface vi4. Yet, when I traceroute 8.8.8.8 ...
-1
votes
1answer
53 views

How can I add iptables rule on particular event (HTTP/1.1 302 Found)

My Tomato based router has two interfaces Eth0 - direct connection Tun1 - vpn Sometimes some websites return "HTTP/1.1 302 Found" and when that happens, I want to add iptables rule to use Tun1 ...
0
votes
1answer
26 views

Linux: get all connect calls for a local port

I have a ssh tunnel through which a client is connecting to a server. Using, wireshark, I could see a periodic connection of SSH besides the keepalive, but I am unable to obtain the process (pid) that'...
4
votes
1answer
315 views

Random timestamp on first syn-ack on loopback

Preface We are testing some host based IPS. In this test case, our application is listening on the loopback and the application is receiving traffic in clear text. We are using either nginx or ...
0
votes
1answer
269 views

How do I filter tcpdump results based on a missing header?

My HAProxy adds 'X-Proto: SSL' as a header to requests that are over HTTPS. I'd like to use tcpdump to see the 'Host:' header of all requests that do not have that 'X-Proto: SSL' header. Here's what ...
0
votes
1answer
1k views

When using tcpdump's `-i any` argument, how to get also interface name inline? [duplicate]

I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server. I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any ...
-1
votes
1answer
32 views

Weird behavior of VPS host

Hi I noticed strange behavior on my VPS host I launch nmap on my laptop and scan VPS host nmap screenshot Listed netstat on VPS server netstat screenshot Tried to connect to some port connection ...
1
vote
0answers
65 views

Wifi interface drops all packets

I have a remote system connected via WiFi to the network. The wifi connection is established correctly and I can ping the gateway. The maintainer of the gateway (3rd party, not accessible for me) ...
1
vote
2answers
393 views

TCPdump write permission error when using -w option

I faced a very weird error, I'm running tcpdump by the root and want to log the output, when I do tcpdump -i eth0 -w logs/local.dump it works fine, but when I set the output path like bellow, I get ...
0
votes
1answer
506 views

How to collect HTTP data in Wireshark from a remote Linux host?

I am trying to collect HTTP requests and responses from a remote host using Wireshark using SSH tunnel. So I have Windows host with Wireshark on it, and Linux host with tcpdump on it and a web server ...
0
votes
1answer
449 views

tcpdump host unreachables for specific host

I'm trying to rule out some issues and needing to capture all ICMP messages except echo/echo reply. However the issue I'm struggling to find a way around is I only want these involving a particular ...