Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
0
votes
1answer
19 views
Is this a valid TLS handshake
I am trying to validate a TLS version by establishing a connection with the server, below is the packet capture.
All I need to know is whether this means a connection was established or refused, and ...
0
votes
0answers
14 views
How to analyse external networking performance?
I face a issue with external network performance that is external bandwidth is full.
So my question is, is there a way to know whether the external network bandwidth is full or not with tcpdump.
...
0
votes
0answers
42 views
Why TCP Out-Of-Order packet is seen after SYN?
I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior.
...
0
votes
1answer
92 views
Can a TCP packet don't reach the 7th OSI layer
I'm facing a situation where a client establish a TCP connection via telnet (or netcat) in order to connect to a linux server. The server must then send back a banner containing some text info...
In ...
0
votes
1answer
63 views
What is localhost.webcache in tcpdump
I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
0
votes
0answers
21 views
GCP Internal Load Balancer not responding
I am trying to reach GCP Internal Load Balancer from external network connected via 3rd party Pritunl-OpenVPN tunnel (tunnel endpoint is on VM).
[external network] <------- Pritunl VPN ----> [GCP ...
google-cloud-platform
-1
votes
1answer
87 views
Running tcpdump starts ssh flood
I have runtime Linux running in a PLC. My development machine is running Ubuntu 14.04. The PLC and the development machine are connected through a five port switch. I ssh to PLC from my development ...
2
votes
1answer
83 views
netstat says connection in SYN_SENT but tcpdump captures no data
I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
2
votes
0answers
61 views
Is it possible to capture traffic on host when using KVM passthrough?
I have a KVM guest which uses PCI passthrough for its network interfaces:
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x05' slot='...
1
vote
0answers
40 views
Server does not respond to SYN [duplicate]
When I launch an FTP transfer from a client machine, it fails because it cannot connect to the server.
With tcpdump I can see that the client sends a SYN to the server, and I can also see that the ...
0
votes
2answers
111 views
Weird traffic on all interfaces simultaneously. (Linux)
Every now and then, I check my munin graphs on my production server to see if there's anything out of the ordinary going on. Today I noticed a strange thing. Identical traffic spikes on all (8) ...
0
votes
0answers
10 views
Netty application gets reset flag from client
I have a Netty application, that is running inside a private network. When I access the netty application from inside the network, it works fine.
Now we have to access it from outside the network.
We ...
0
votes
2answers
130 views
redirect tcpdump generated pcap file to another server while packets are being captured
I was looking for some command like this, it achieves:
redirect the tcpdump generated pcap file to another server
during the process of 1., using a python script or some tool to analyze each packet.
...
0
votes
1answer
25 views
Analyze Packet Loss Bursts
I need to analyze packet loss bursts in TCP streams. Given a number X a packet lost burst is when more then X consecutive packets got lost. So I have a pcap file and need to count how many bursts ...
0
votes
0answers
14 views
ICMP packet size over 372 are dropped on bond0
i have a target server running on rhel7.4 with kernel 3.10.0-693.11.6.el7
with bond0 and subinterface vlan2001 with MTU 9000
when i ping from a different server which is in a different network with ...
1
vote
1answer
131 views
Email server with no smtp connection
Ubuntu 18.04 on Google Compute
Dovecot + postfix
I figure I should be able to connect to a port other than 465/587, and since I can relay all email through google there should be no issue with this ...
0
votes
0answers
127 views
How to check for firewall drops in WireShark
We have an application setup across two servers. The application is failing because a firewall is blocking communication between the two servers. I need a way to figure out every single port that is ...
0
votes
0answers
629 views
Why is tcpdump not capturing TLS packets on port 443?
I am using the following command:
sudo tcpdump -vvv -A -XX -i any -w dump.pcap
I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
0answers
51 views
Tcpdump receives packets but they are not delivered to firewall
I am working with Proxmox, OpenVPN and Mikrotik Router. When I try to connect from OpenVPN client (192.168.10.13) to VM (192.168.1.19) hosted on Proxmox I don't get any response. Proxmox host (192....
0
votes
0answers
6 views
trc-netpoll service on tcpdump
I was doing a tcpdump on my wifi adapter. I found a lot of trc-netpoll continuously flowing through it (more than 10 per millisecond)
I just have ssh enabled on server and accessing it via a putty ...
0
votes
1answer
207 views
tcpdump: Traffic between localhost:[src-port:dst-port]
I'd like to get http traffic between localhost:8081 and localhost:8080.
I need http headers and body.
I've tried some commands but everything is complicated and I don't quite figure out what I'm ...
1
vote
1answer
181 views
tcpdump TCP Header offset 13
I am trying to understand how tcpdump works and trying to read TCP header control flags SYN,ACK etc.
After researching online I came to know that the control flags are available at offset 13 and I ...
0
votes
1answer
39 views
tcpdump get requesting IP
We are tracking http usage(mainly for our intranet) and I've been able to track it using the the following on our OPENWRT router:
tcpdump -i wlan1 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] =...
1
vote
0answers
22 views
Getting different local-port value in tcpdump when using --local-port option in curl
I'm using curl command to send the traffic to the Server. In curl command, I'm using --local-port option. Below is the command:
curl -v --interface 10.1.1.3 -b --local-port 10000 http://30.1.1.101/...
1
vote
1answer
363 views
Can I use tcpdump to analyze binary data - gRPC, http2, MessagePack, etc?
Life is simple with text-encoded formats like JSON. I can see enough text in the dump to figure out where something can be wrong. But with the growing popularity of binary interchange formats, I think ...
1
vote
1answer
193 views
iptables blacklist empty User-Agent sip tcpdump
I scan using tcpdump for user-agents that hit my phone server.
I get interesting results. i add them to a list that protects alot of my servers out there.
This works good. The problem is I get ...
0
votes
1answer
377 views
How to send tcpdump-captured traffic directly to an interface?
I can do it using an intermediate pcap file:
tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345'
^C
tcpreplay -i eth1 out.pcap
Is it possible to skip the pcap and forward all the traffic immediately?...
0
votes
0answers
12 views
Monitor outgoing connections to destination port - get program / script names
I want to log programs that establish connections to destination port 25 / outgoing email ports. I need to know the program / process and where it is located in the filesystem.
Is this possible with ...
1
vote
0answers
18 views
No packet crossing default gateway
I have two Ubuntu 17.04 nodes, A (10.0.9.2) and B (10.0.9.1).
I have set B as default gateway of A, using the command:
route add default gw 10.0.9.1 interface vi4.
Yet, when I traceroute 8.8.8.8 ...
-1
votes
1answer
50 views
How can I add iptables rule on particular event (HTTP/1.1 302 Found)
My Tomato based router has two interfaces
Eth0 - direct connection
Tun1 - vpn
Sometimes some websites return "HTTP/1.1 302 Found" and when that happens, I want to add iptables rule to use Tun1 ...
0
votes
0answers
46 views
iptables + TEE : too many duplicates
I'm trying port mirroring with :
iptables -t mangle -A PREROUTING -i eth0 -j TEE --gateway 192.168.1.x
It's working, however, I receive 10* the amount of packet initialy sent.
Why?
P.S : It's on ...
0
votes
1answer
22 views
Linux: get all connect calls for a local port
I have a ssh tunnel through which a client is connecting to a server. Using, wireshark, I could see a periodic connection of SSH besides the keepalive, but I am unable to obtain the process (pid) that'...
0
votes
0answers
14 views
Tracking down malware network activity [duplicate]
OS: Debian 8
I have over 30 websites running on my webserver. Since yesterday there has been some suspicious outgoing internet activity related to the address "192.42.116.41".
After a quick google ...
4
votes
1answer
225 views
Random timestamp on first syn-ack on loopback
Preface
We are testing some host based IPS. In this test case, our application is listening on the loopback and the application is receiving traffic in clear text. We are using either nginx or ...
0
votes
1answer
212 views
How do I filter tcpdump results based on a missing header?
My HAProxy adds 'X-Proto: SSL' as a header to requests that are over HTTPS.
I'd like to use tcpdump to see the 'Host:' header of all requests that do not have that 'X-Proto: SSL' header.
Here's what ...
0
votes
0answers
31 views
Subdomain delegation traffic capture explaination
I have host Windows system with IP 192.168.1.33 and two guest Linux systems (one with IP 192.168.1.120 and second with IP 192.168.1.140) which has bind installed on them. Server .120 delegates reverse ...
0
votes
1answer
588 views
When using tcpdump's `-i any` argument, how to get also interface name inline? [duplicate]
I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server.
I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any ...
0
votes
0answers
134 views
Data transfer failing
We have a situation where a transfer from a linux server to a windows 2016 server starts off well, the gets to a point in the transfer where the throughput declines from ~30MB/s to zero within 3-5 ...
-1
votes
1answer
29 views
Weird behavior of VPS host
Hi I noticed strange behavior on my VPS host
I launch nmap on my laptop and scan VPS host
nmap screenshot
Listed netstat on VPS server
netstat screenshot
Tried to connect to some port
connection ...
1
vote
0answers
60 views
Wifi interface drops all packets
I have a remote system connected via WiFi to the network. The wifi connection is established correctly and I can ping the gateway. The maintainer of the gateway (3rd party, not accessible for me) ...
1
vote
2answers
263 views
TCPdump write permission error when using -w option
I faced a very weird error, I'm running tcpdump by the root and want to log the output, when I do
tcpdump -i eth0 -w logs/local.dump
it works fine, but when I set the output path like bellow, I get ...
0
votes
1answer
363 views
How to collect HTTP data in Wireshark from a remote Linux host?
I am trying to collect HTTP requests and responses from a remote host using Wireshark using SSH tunnel. So I have Windows host with Wireshark on it, and Linux host with tcpdump on it and a web server ...
0
votes
1answer
301 views
tcpdump host unreachables for specific host
I'm trying to rule out some issues and needing to capture all ICMP messages except echo/echo reply. However the issue I'm struggling to find a way around is I only want these involving a particular ...
0
votes
1answer
600 views
Why does TCP request packet contain ACK flag? [closed]
I am very new at low level of TCP and I am tryingtcpdump with simple socket server and client program.
The server and client follow the two steps.
Server and client make a connection.
Client sends ...
5
votes
2answers
2k views
Linux: tracking the source of netstat -s “failed connection attempts”
I have several servers, where the failed connection attempts metric returned by netstat -s (from /proc/net/snmp) grows by roughly one per second, and I'd like to diagnose the source of these.
By ...
0
votes
1answer
64 views
What data is not available for tcpdump unlike interface statistics tools?
I'm analizing the logs on specific interface and wondering why this command during small load-test:
tcpdump -i enp21s0f0 -s0 -w /tmp/dump2.cap`
catched only 75 MB, when
ethtool -S enp21s0f0 / ...
0
votes
1answer
209 views
tcpdump not intercepting DHCP ACK
I have a router running lede with tcpdump installed
tcpdump --version
# tcpdump version 4.9.0
# libpcap version 1.8.1
When I run it like so:
tcpdump -vnes0 -i eth0 port 67 or port 68
I can see
...
1
vote
1answer
175 views
tcpdump - how to track the source of requests made with ephemeral/dynamic ports
I'm trying to identify the network traffic between multiple backend microservices running on the same server. (they make some rest http calls to each other)
Unfortunately, when i use tcpdump, the ...
0
votes
0answers
107 views
Webserver cannot ping external
I want our webserver to be accessible from the outside world. We have a static IP - 176.35.XXX.XXX which is accessible when on the same network as the webserver, however times out externally.
When ...
0
votes
1answer
25 views
Accessing webserver remotely (contains tcpdump)
Total noob here so apologies in advance for missing out any key details.
We have a web server which is accessible locally on 192.168.2.1. It is also accessible locally on 176.XXX.XXX.XXX which is ...
