Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
379
questions
0
votes
0answers
32 views
How to view encrypted traffic (https) generated by a Python script in ssldump? [closed]
I am trying to debug my Python script that communicates with a web page. Specifically, the script brute-forces a web form to solve a ctf competition task.
For debug purposes, I want to view outgoing ...
1
vote
1answer
71 views
Tracing Active FTP Session (data channel)
To debug an issue with active FTP, we are tracing active FTP session traffic with tcpdump running in a toolbox container on a GKE node. The active FTP session is failing on the data channel.
I am ...
0
votes
0answers
16 views
Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
1answer
47 views
Connections shows up in tcpdump but cannot not in auditd or ss
I ran tcpdump on a node which I can see many outbound TCP connections to a specific host (inside my network) on a specific port (8086). I'd like to know which process is making those connections.
I ...
2
votes
2answers
122 views
Meaning of tcpdump P direction
The situation is a VM running under kvm/libvirt/qemu (10.202.7.128) pinging another hardware-based system (10.202.7.4) via the hypervisor's bridge. Everything works OK but 'tcpdump -neli any icmp and ...
0
votes
1answer
13 views
host mirroring on multiple VM (unique VNETid/uuid)
We want to mirror all traffic going in/out port vnet0, and we want to send it to bridge port vnet2 (where we have a traffic monitoring application) and make sure traffic from vnet2 is excluded on ...
0
votes
2answers
51 views
tcpdump filter by/print last hop
If I have a network that looks like this:
56.56.56.56 192.168.0.1/24
___________
---| Modem 1 |-----
| ___________ | ...
1
vote
1answer
27 views
Wireshark capture filter from list file
Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
1
vote
3answers
60 views
How can i see packets while capturing with tcpdump
How can I see traffic while I am capturing it with tcpdump.
When I use -w, it doesn't show the packets during the capture.
sudo tcpdump -i enp2s0 -w test.pcap
tcpdump: listening on enp2s0, link-type ...
14
votes
1answer
347 views
CoreOS: tcpdump mysteriously solves network issue (excessive number of sockets used)
I've got a mystery for you today. We run a small, three node Elasticsearch cluster based on CoreOS (2023.5.0 / Linux 4.19.25-coreos) on Azure. Elasticsearch is run inside a docker container in host ...
1
vote
1answer
103 views
Analyzing traffic by tcpdump between HAProxy server and mariadb
I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results:
23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
0
votes
1answer
67 views
What does “AF” mean in tcpdump?
This seems to show up only with -e and for me only on my VPN interface, e.g.:
> sudo tcpdump -enn -i utun1
...
11:35:22.440690 AF IPv4 (2), length 32: 1.2.3.4.1234 > 1.2.3.5.1234: [|domain]
...
1
vote
1answer
246 views
Netstat and ss doesn't see connection
I'm trying to find which application running on Kubernetes cluster is using a specific port to communicate with RabbitMQ cluster. On RabbitMQ I see that connection is coming from 192.168.1.10:34226. ...
1
vote
0answers
139 views
PowerDNS AXFR - ;; communications error to x.x.x.x#53: end of file
Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server.
This /24 is part of a larger RIPE block, /22, and is not ...
1
vote
1answer
31 views
Is this a valid TLS handshake
I am trying to validate a TLS version by establishing a connection with the server, below is the packet capture.
All I need to know is whether this means a connection was established or refused, and ...
0
votes
0answers
19 views
How to analyse external networking performance?
I face a issue with external network performance that is external bandwidth is full.
So my question is, is there a way to know whether the external network bandwidth is full or not with tcpdump.
...
0
votes
0answers
644 views
Why TCP Out-Of-Order packet is seen after SYN?
I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior.
...
0
votes
1answer
107 views
Can a TCP packet don't reach the 7th OSI layer
I'm facing a situation where a client establish a TCP connection via telnet (or netcat) in order to connect to a linux server. The server must then send back a banner containing some text info...
In ...
0
votes
1answer
263 views
What is localhost.webcache in tcpdump
I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
0
votes
0answers
53 views
GCP Internal Load Balancer not responding
I am trying to reach GCP Internal Load Balancer from external network connected via 3rd party Pritunl-OpenVPN tunnel (tunnel endpoint is on VM).
[external network] <------- Pritunl VPN ----> [GCP ...
google-cloud-platform
-1
votes
1answer
268 views
Running tcpdump starts ssh flood
I have runtime Linux running in a PLC. My development machine is running Ubuntu 14.04. The PLC and the development machine are connected through a five port switch. I ssh to PLC from my development ...
2
votes
1answer
271 views
netstat says connection in SYN_SENT but tcpdump captures no data
I'm debugging a ldap problem after ldap client machine upgraded to ubuntu 18.04. Trying to figure out where the problem is, and I noticed the outbound connection is in SYN_SENT, but when I use tcpdump ...
2
votes
0answers
117 views
Is it possible to capture traffic on host when using KVM passthrough?
I have a KVM guest which uses PCI passthrough for its network interfaces:
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x05' slot='...
1
vote
0answers
47 views
Server does not respond to SYN [duplicate]
When I launch an FTP transfer from a client machine, it fails because it cannot connect to the server.
With tcpdump I can see that the client sends a SYN to the server, and I can also see that the ...
0
votes
2answers
171 views
Weird traffic on all interfaces simultaneously. (Linux)
Every now and then, I check my munin graphs on my production server to see if there's anything out of the ordinary going on. Today I noticed a strange thing. Identical traffic spikes on all (8) ...
0
votes
0answers
21 views
Netty application gets reset flag from client
I have a Netty application, that is running inside a private network. When I access the netty application from inside the network, it works fine.
Now we have to access it from outside the network.
We ...
0
votes
2answers
430 views
redirect tcpdump generated pcap file to another server while packets are being captured
I was looking for some command like this, it achieves:
redirect the tcpdump generated pcap file to another server
during the process of 1., using a python script or some tool to analyze each packet.
...
0
votes
1answer
35 views
Analyze Packet Loss Bursts
I need to analyze packet loss bursts in TCP streams. Given a number X a packet lost burst is when more then X consecutive packets got lost. So I have a pcap file and need to count how many bursts ...
0
votes
0answers
25 views
ICMP packet size over 372 are dropped on bond0
i have a target server running on rhel7.4 with kernel 3.10.0-693.11.6.el7
with bond0 and subinterface vlan2001 with MTU 9000
when i ping from a different server which is in a different network with ...
1
vote
1answer
281 views
Email server with no smtp connection
Ubuntu 18.04 on Google Compute
Dovecot + postfix
I figure I should be able to connect to a port other than 465/587, and since I can relay all email through google there should be no issue with this ...
0
votes
0answers
302 views
How to check for firewall drops in WireShark
We have an application setup across two servers. The application is failing because a firewall is blocking communication between the two servers. I need a way to figure out every single port that is ...
0
votes
0answers
1k views
Why is tcpdump not capturing TLS packets on port 443?
I am using the following command:
sudo tcpdump -vvv -A -XX -i any -w dump.pcap
I can see several TCP packets coming or and going to the expected IP addresses on port 443. Nevertheless, I am not able ...
0
votes
1answer
1k views
tcpdump: Traffic between localhost:[src-port:dst-port]
I'd like to get http traffic between localhost:8081 and localhost:8080.
I need http headers and body.
I've tried some commands but everything is complicated and I don't quite figure out what I'm ...
2
votes
1answer
588 views
tcpdump TCP Header offset 13
I am trying to understand how tcpdump works and trying to read TCP header control flags SYN,ACK etc.
After researching online I came to know that the control flags are available at offset 13 and I ...
0
votes
1answer
57 views
tcpdump get requesting IP
We are tracking http usage(mainly for our intranet) and I've been able to track it using the the following on our OPENWRT router:
tcpdump -i wlan1 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] =...
1
vote
0answers
26 views
Getting different local-port value in tcpdump when using --local-port option in curl
I'm using curl command to send the traffic to the Server. In curl command, I'm using --local-port option. Below is the command:
curl -v --interface 10.1.1.3 -b --local-port 10000 http://30.1.1.101/...
1
vote
1answer
799 views
Can I use tcpdump to analyze binary data - gRPC, http2, MessagePack, etc?
Life is simple with text-encoded formats like JSON. I can see enough text in the dump to figure out where something can be wrong. But with the growing popularity of binary interchange formats, I think ...
1
vote
1answer
339 views
iptables blacklist empty User-Agent sip tcpdump
I scan using tcpdump for user-agents that hit my phone server.
I get interesting results. i add them to a list that protects alot of my servers out there.
This works good. The problem is I get ...
0
votes
1answer
1k views
How to send tcpdump-captured traffic directly to an interface?
I can do it using an intermediate pcap file:
tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345'
^C
tcpreplay -i eth1 out.pcap
Is it possible to skip the pcap and forward all the traffic immediately?...
1
vote
0answers
19 views
No packet crossing default gateway
I have two Ubuntu 17.04 nodes, A (10.0.9.2) and B (10.0.9.1).
I have set B as default gateway of A, using the command:
route add default gw 10.0.9.1 interface vi4.
Yet, when I traceroute 8.8.8.8 ...
-1
votes
1answer
53 views
How can I add iptables rule on particular event (HTTP/1.1 302 Found)
My Tomato based router has two interfaces
Eth0 - direct connection
Tun1 - vpn
Sometimes some websites return "HTTP/1.1 302 Found" and when that happens, I want to add iptables rule to use Tun1 ...
0
votes
1answer
26 views
Linux: get all connect calls for a local port
I have a ssh tunnel through which a client is connecting to a server. Using, wireshark, I could see a periodic connection of SSH besides the keepalive, but I am unable to obtain the process (pid) that'...
4
votes
1answer
315 views
Random timestamp on first syn-ack on loopback
Preface
We are testing some host based IPS. In this test case, our application is listening on the loopback and the application is receiving traffic in clear text. We are using either nginx or ...
0
votes
1answer
269 views
How do I filter tcpdump results based on a missing header?
My HAProxy adds 'X-Proto: SSL' as a header to requests that are over HTTPS.
I'd like to use tcpdump to see the 'Host:' header of all requests that do not have that 'X-Proto: SSL' header.
Here's what ...
0
votes
1answer
1k views
When using tcpdump's `-i any` argument, how to get also interface name inline? [duplicate]
I'm diagnosing some networking issues with an inordinate amount of network interfaces on a Linux server.
I'm needing to dump all interface traffic as per tcpdump -i any, but I'm not finding any ...
-1
votes
1answer
32 views
Weird behavior of VPS host
Hi I noticed strange behavior on my VPS host
I launch nmap on my laptop and scan VPS host
nmap screenshot
Listed netstat on VPS server
netstat screenshot
Tried to connect to some port
connection ...
1
vote
0answers
65 views
Wifi interface drops all packets
I have a remote system connected via WiFi to the network. The wifi connection is established correctly and I can ping the gateway. The maintainer of the gateway (3rd party, not accessible for me) ...
1
vote
2answers
393 views
TCPdump write permission error when using -w option
I faced a very weird error, I'm running tcpdump by the root and want to log the output, when I do
tcpdump -i eth0 -w logs/local.dump
it works fine, but when I set the output path like bellow, I get ...
0
votes
1answer
506 views
How to collect HTTP data in Wireshark from a remote Linux host?
I am trying to collect HTTP requests and responses from a remote host using Wireshark using SSH tunnel. So I have Windows host with Wireshark on it, and Linux host with tcpdump on it and a web server ...
0
votes
1answer
449 views
tcpdump host unreachables for specific host
I'm trying to rule out some issues and needing to capture all ICMP messages except echo/echo reply. However the issue I'm struggling to find a way around is I only want these involving a particular ...
