Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

communication between 2 servers via NSP

I'm in a situation where one server(tb06) should populate its health status to another server(admin03) via NSP in nsxml format. When I have taken TCPDUMP(.pcap) on admin03, apart from tb06 HTTP header,...
2
votes
1answer
81 views

How can I capture IPSEC packets on my VPN server?

I am running a strongSwan (U5.3.5/K4.4.0-62-generic) VPN server on Ubuntu 16.04. Ususally, when I want to examine traffic on a server, I simply run something like the following: tcpdump -ni eth0 "...
1
vote
2answers
66 views

Display delta timestamp and UDP data payload with tcpdump/tshark

I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format. An example of the desired output would be as follows: % head ...
2
votes
2answers
22 views

tcpdump, how to capture actual data only?

For example I have a server listening on port 8001, a client programe open a tcp socket connect to that port, send some binary data, I want to capture the actual data only without any TCP/IP header ...
1
vote
1answer
33 views

Re-routing DNS queries with iptables properly without resolv.conf

I run a custom DNS service on 127.0.0.1:53 and I dont just want all queries to go through it, I also want only that service to respond back. Which is where the problem arises. My NAT iptables setup: ...
0
votes
1answer
35 views

Trying to capture 3-way handshake in linux

I am trying to capture 3-way handshake using the following in linux, it does not seems to work... sudo tcpdump "tcp[tcpflags] & (tcp-syn) !=0" -w filename.pcap -i eth0 Could you someone suggest ...
0
votes
1answer
21 views

Proxy service only responding on some IP addresses (others suck on SYN_RECV)

I have a server using a proxy service (WAF etc) which forwards packets to my server. I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV: tcp 0 ...
0
votes
0answers
24 views

How we have differentiate the packet capture based on the RX & TX

I am working in the security industry. We have taken packet capture on the firewall multiple times. Can we take Pcap based on RX and & tx and force the tcpdump command to write the output in two ...
3
votes
0answers
55 views

TCP Window Scaling Not Working Between Windows 10 and Linux Server

We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server. We can't reproduce the error on our end but notice that TCP window scaling is ...
-1
votes
1answer
52 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
1
vote
0answers
22 views

tcpdump not capturing packets but Apache log shows the request

I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
0
votes
0answers
24 views

How to set Openvpn mtu, given these tcpdump test results?

I have been warned that the maximum tranport unit (mtu) of the cloud server is 1454 bytes. Indeed, I tried two pings and 1426=1454-28(udp header) is the maximum size one packet of UDP can deliver ...
0
votes
0answers
49 views

Multiple TCP dup ACK with spurious retransmission

I have a cellular IoT-device connected to a MQTT broker with a keep alive of 15 sec. It happens once a day that the device gets disconnected from the server (server log shows: client stopped due to ...
0
votes
0answers
15 views

Does tcpdump guarantee packet integrity?

In normal use of tcpdump without any parameter, does it guarantee? tcpdump -i eth0 -w file.pcap In using tcpdump rotating by time with -G parameter, does it guarantee? tcpdump -i eth0 -w file.pcap -...
0
votes
0answers
36 views

Duplicate ACK and TCP Retransmissions

I'm doing some scp transfers between an AIX and a Linux in two separated LAN (I have a VPN between them). Sometimes the connection ends well, so I get 50MB/s. In many other cases, instead, the ...
0
votes
1answer
77 views

Why is an interface ignored by -i any with tcpdump/wireshark?

Using tcpdump and wireshark, if I capture with -i enp1s0f0, no problem I can see the packets. If I capture with -i any, I don't see the enp1s0f0's packets. Why? Is there a NetworkManager option or ...
0
votes
1answer
37 views

How do I capture packets on a Linux VM in a VMware environment?

I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the ...
0
votes
0answers
24 views

Is it possible to save TCDUMP (pt-query-digest) report at database?

I want to save all the information that I get from a tcpdump command in terminal and save it on database, more easy to search and find what I want. I run this command first. tcpdump -i any port ...
0
votes
1answer
84 views

Monitor MySQL Connection and Request

I'm trying to monitor all incoming connections to a mysql database. I've used tcpdump port 3306 and '(tcp-syn|tcp-ack)!=0' currently which is showing connections but is there a way to also see what ...
0
votes
0answers
22 views

How to use Wireshark to decode HTTP stream?

I'm using an application that outputs each HTTP stream as two files: connection.out and connection.in. The .out file contains everything the client sends to the server (i.e. requests), and the .in ...
0
votes
1answer
19 views

Why does one of four-way handshake miss with the command nc

I'm using the command nc to simulate the TCP connection with a client and a server. I execute the command nc -l 1234 and tcpdump -i eth0 port 1234 at the server and I execute the command nc ...
0
votes
1answer
49 views

Tcpdump logfile

the thing is I am trying transfer log file from one server to another dividing by size. I have dump such as: tcpdump -i any tcp x.x.x.x -s 0 -G 86400 -w /var/log/%F.zip Questions are: The output ...
0
votes
0answers
96 views

tcpdump filter for QoS PCP/DEI values in L2 VLAN header

I need tcpdump filter for specific packets which have VLAN ID 10 and some specific PCP/DEI values. For example I have packet with next VLAN header: 110. .... .... .... = Priority: Voice, < 10ms ...
0
votes
1answer
92 views

Sending tcpdump/pcap files to a remote server

I want to get all traffic on an embedded system, using tcpdump. I will send those files via sftp or ssh to my server. Can it happen, that tcpdump "sees" the transfer of the pcap files to my server? ...
0
votes
0answers
45 views

how to block specified packet sent to my server linux

someone create a script to hurt my chat application with injection, i was able to capture data sent by this bad guy, i tried to block this packets via iptables but didnt work here is the data ...
-1
votes
1answer
125 views

Traffic on port 80 although Http-Server is not running

Good'day Just out of curiosity I did a tcpdump port 80 on one of my remote virtual machines. I see a huge amount of requests to this http-port, 95% going to some AWS EC2 instance. Strange thing: The ...
0
votes
0answers
31 views

Strange (mail related) traffic on my server

I'm noticing strange traffic on my webserver which is around 50kbps constantly. Doing a (few seconds worth of) tcpdump on the specific ip address, I get this (pardon the huge list): 09:33:02.385238 ...
1
vote
1answer
51 views

Odd Output From tcpdump On Linux

I am using the following tcpdump command on CentOS 7: sudo tcpdump -A -l -i any -s 0 -n host <IP Address> and port 5060 or port 5061 And I am seeing (on each packet) the following sorts of ...
0
votes
0answers
19 views

Extracting useful httpd data from tcpflow

I use the following command tcpflow -p -c port 80 | grep -B10 "Host: " to monitor httpd traffic in my server. It's very useful, and it returns something like this 193.169.254.005.50104-05.01.021....
3
votes
1answer
259 views

Why does the TCP server wait for an ACK when sufficient window is available at client side [duplicate]

I'm observing the below behavor in a TCP connection between a server application and a client which run on two different Red Hat machines. Example 1 Client acks everything until now (ACK with WND = ...
1
vote
1answer
103 views

Long TCPDUMP capture taking slowly but surely all available memory in RAM

When I tcpdump the network traffic on my ubuntu server, I see the free memory decreasing with time. It seems that the captures are stored in memory. At first, I noticed the problem because i was ...
0
votes
1answer
110 views

TCPDUMP, tcp Flag not changing from Flags [S] to other flag values

I need support understanding these lines. when i tried to connect to server in a particular port it shows connecting and gives me timeout error. But in the tcp-dump command the packet flag not ...
1
vote
0answers
26 views

Network packets don't reach local host when connected with to Openstack VPS with Openvpn server

So here is an issue. I've installed OpenVPN server on Openstack VPS (hostigger, if this is important). I've used guide https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-...
0
votes
1answer
35 views

TCPDump, can't understand these parts

I need help to understand the bold part of this line : 01:04:28.539138 IP 90.2.255.58.37727 > 71.197.145.153.46872: . 9801:11201(1400) ack 0 win 2003 9801:11201(1400) 9801 seems to be the data ...
-1
votes
1answer
870 views

Why tcpdump has 262144 as default capture size?

I was wondering for the reason that why tcpdump has magic number 262144 as default snapshot length? --snapshot-length=snaplen Snarf snaplen bytes of data from each packet rather than the ...
0
votes
1answer
51 views

Understanding failed connection reason

Edit: The issue came about because our machines did not have external IP address and so outgoing traffic was going through Cloud NAT, which was misconfigured (min connections per vm) I am having ...
1
vote
1answer
358 views

Tracing Active FTP Session (data channel)

To debug an issue with active FTP, we are tracing active FTP session traffic with tcpdump running in a toolbox container on a GKE node. The active FTP session is failing on the data channel. I am ...
0
votes
0answers
18 views

Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
1answer
97 views

Connections shows up in tcpdump but cannot not in auditd or ss

I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections. I ...
2
votes
2answers
169 views

Meaning of tcpdump P direction

The situation is a VM running under kvm/libvirt/qemu (10.202.7.128) pinging another hardware-based system (10.202.7.4) via the hypervisor's bridge. Everything works OK but 'tcpdump -neli any icmp and ...
0
votes
1answer
16 views

host mirroring on multiple VM (unique VNETid/uuid)

We want to mirror all traffic going in/out port vnet0, and we want to send it to bridge port vnet2 (where we have a traffic monitoring application) and make sure traffic from vnet2 is excluded on ...
0
votes
2answers
286 views

tcpdump filter by/print last hop

If I have a network that looks like this: 56.56.56.56 192.168.0.1/24 ___________ ---| Modem 1 |----- | ___________ | ...
1
vote
1answer
57 views

Wireshark capture filter from list file

Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
1
vote
3answers
487 views

How can i see packets while capturing with tcpdump

How can I see traffic while I am capturing it with tcpdump. When I use -w, it doesn't show the packets during the capture. sudo tcpdump -i enp2s0 -w test.pcap tcpdump: listening on enp2s0, link-type ...
14
votes
2answers
606 views

CoreOS: tcpdump mysteriously solves network issue (excessive number of sockets used)

I've got a mystery for you today. We run a small, three node Elasticsearch cluster based on CoreOS (2023.5.0 / Linux 4.19.25-coreos) on Azure. Elasticsearch is run inside a docker container in host ...
1
vote
1answer
366 views

Analyzing traffic by tcpdump between HAProxy server and mariadb

I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results: 23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
0
votes
1answer
97 views

What does “AF” mean in tcpdump?

This seems to show up only with -e and for me only on my VPN interface, e.g.: > sudo tcpdump -enn -i utun1 ... 11:35:22.440690 AF IPv4 (2), length 32: 1.2.3.4.1234 > 1.2.3.5.1234: [|domain] ...
2
votes
1answer
854 views

Netstat and ss doesn't see connection

I'm trying to find which application running on Kubernetes cluster is using a specific port to communicate with RabbitMQ cluster. On RabbitMQ I see that connection is coming from 192.168.1.10:34226. ...
1
vote
0answers
566 views

PowerDNS AXFR - ;; communications error to x.x.x.x#53: end of file

Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server. This /24 is part of a larger RIPE block, /22, and is not ...
1
vote
1answer
52 views

Is this a valid TLS handshake

I am trying to validate a TLS version by establishing a connection with the server, below is the packet capture. All I need to know is whether this means a connection was established or refused, and ...

1
2 3 4 5
9