Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
109 views

Tcpdump is not capturing traffic in whole network

Isn't this command is supposed to capture whole network traffic **tcpdump -i any net "192.168.1.0/24 "** nothing is being shown on terminal.
rahul singh's user avatar
4 votes
1 answer
604 views

tcpdump -vvv is not verbose enough

For tcpdump, I use this command to see the packet details: tcpdump -vvv -i interface and to save the packets into a pcap file: tcpdump -i interface -w output The details from the first command are ...
shadow's user avatar
  • 41
0 votes
0 answers
22 views

NIPS appliance 100 MB limit pcap find vlan id tag

Background I have a Network IPS Appliance at work. The configuration is not well documented and I want to work out what traffic has been configured to flow through which interfaces. The network is ...
user3223819's user avatar
0 votes
1 answer
90 views

tcpdump expression to collect vlan tag id only

Is there a tcpdump expression that collects the vlan tag id only? I have an interface that has multiple vlan tagged traffic flowing through it. I can write expressions looking for IP pairs, or ...
user3223819's user avatar
0 votes
1 answer
310 views

How do I only capture WriteRequest from OPC UA data with only TCPDUMP

I have a PLC where I capture data through TCPDUMP command. Now The issue that I have is that when I read the hex valua of the saved data it shows it though this format: 0x0000: 0009 0f09 0021 a874 ...
BrenDs's user avatar
  • 1
0 votes
1 answer
49 views

Established TCP Communication terminates without any clue

I'm not able to understand what might be the reason for a lost TCP Communication over RPC between a CentOS 7 and Windows 2019 Server. From the Wireshark I could see that the TCP Communication is ...
user2264738's user avatar
0 votes
1 answer
153 views

Why does iperf3 or TCP stack merge TCP packets?

Using this simple command: iperf3 -c localhost --time 1 -l 100 --bitrate 100M Then watching the output with: sudo tcpdump -i lo -B 10000000 tcp port 5201 I would expect to see lots of 100 byte ...
Ken Y-N's user avatar
  • 115
0 votes
0 answers
203 views

NGINX TCP reverse proxy resolves queries differently

The Setup I currently have a server and a mongodb database running in the cloud (Oracle Cloud Infrastructure). The Problem My connection to the database is bound by a select number of static IP's. ...
Samuel Cobb's user avatar
7 votes
1 answer
3k views

Filtering for HTTP methods in IPv6 packets using tcpdump

I am using "tcpdump" to capture traffic, and I want to filter by HTTP methods. When I have IPv4 packets, I am using: tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' ...
Sagi313's user avatar
  • 71
0 votes
0 answers
394 views

Proxying Traffic from Android with iptables

I have a Android device, and I'm trying to redirect HTTPS traffic to another host on my local network. I've tried defining the proxy in the device network configuration, which works for everything ...
Hysii's user avatar
  • 101
0 votes
0 answers
338 views

Can't see udp packets with nc command, works with tcpdump

I'm trying to capture UDP data using the nc (netcat) command but it doesn't output anything. What options/parameters do I need to pass to the nc command to get the output? tcpdump does show the UDP ...
Martijn de Munnik's user avatar
1 vote
1 answer
1k views

Why do UDP packets generated by Linux running in a virtual machine have defective UDP checksums?

I've set up some interconnected qemu VMs to test out port forwarding rules. For now, my current blocker is much simpler and has nothing to do with port forwarding. When I send a UDP packet from a go ...
maurice77's user avatar
0 votes
1 answer
26 views

Find out what's causing the sudden rise in traffic?

My webserver (Debian Bullseye, Apache2) is serving about 50 (small) websites spread over 16 ip addresses. I just noticed that on one of the ip addresses, since the beginning of this month traffic has ...
Zippy1970's user avatar
  • 269
0 votes
0 answers
126 views

Can't connect to MariaDB from internal VM Structure

S1 Virtual Machine 1: Ubuntu app server Virtual Machine 2: MariaDB 1 S2 Virtual Machine 3: Ubuntu app server Virtual Machine 4: MariaDB 2 from vm04 and 03 I can connect to DB1 with connection string ...
gegentierversuche's user avatar
0 votes
1 answer
89 views

tcpdump shows these hostnames - should I be worried

I'm investigatinmg a strnage hang with our NextCLoud instance and think it might be todo with a misconfigured hostname somewhere. I thought of using tcpdump to look at what addresses/names are being ...
TenG's user avatar
  • 153
1 vote
1 answer
169 views

IPv6 port scanners hang after scanning a closed port

I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it. For example with netcat and no firewall: nc -6 fe80::9d08:b3e2:47fa:...
stmas's user avatar
  • 11
0 votes
1 answer
208 views

How to find out if TCP connection to server is being tampered with by third-parties?

I'm under an unreliable ISP/AS, something like the GFW. They actively try to sabotage a TCP+TLS session by attacks such as sending SYN RST to established connections, making the connection timeout, ...
Ragahito's user avatar
1 vote
1 answer
239 views

Tcpdump output file is not storing the destination IP address and port number

I'm capturing tcpdump packets. Even though, when I want to see the output by tcpdump -r I see destination hostname instead of address IP and service name instead of port number. Example: tcpdump -w /...
user3637971's user avatar
1 vote
0 answers
315 views

What is the key file for ssldump?

I search google for a tool to decode https traffic and get the ssldump with examples like: ssldump -k xxx.pem -i eth0 -d host example.com I wonder what the key file xxx.pem is. On the server hosting ...
peter's user avatar
  • 123
1 vote
1 answer
112 views

Client TCP segments arrive in batches

The scenario is the following: a WebSocket server and clients exchange messages at some pace (like 40-50 times in a second). However, for one client, once in a few minutes I'm observing that there is ...
tonso's user avatar
  • 111
0 votes
0 answers
106 views

Is there a way to capture packages by using tcpdump with ipset?

I got a big ipset and I want to capture networking packages related/not-related to these IPs. Is there a way to capture packages by using tcpdump with ipset as param?
Catscarlet's user avatar
3 votes
0 answers
649 views

TCP retransmission inside of docker network

Just lately our server started experiencing increased CPU usage by the php(Symfony) and mysql processes. For quite some time we been trying to find the cause and we found out that we have big amount ...
Maarduk's user avatar
  • 133
0 votes
0 answers
108 views

using tcpdump how to capture only traffic between my server and elastic search database

I want to use tcpdump to capture traffic between my server and the elastic search database also I would like to capture traffic of one specific url POST https://vpc-my-es-3-abcd.us-east-1.es.amazonaws....
kumar's user avatar
  • 349
1 vote
0 answers
191 views

Why is TCP doing RTO based retransmits (200ms+ wait) vs other fast-retransmission mechanisms?

(Trying this forum after the question was deemed off-topic for Stack Overflow & Network Engineering) I am investigating an issue where we see occasional 200ms+ spikes in a simple tcp client/server ...
RandomQuestion's user avatar
2 votes
0 answers
156 views

Long latency to reply a TCP ACK

k8s environment(4 nodes, rke 1.21.5) We noticed there is randomly significant latency in socket data transferring between different k8s pods. Latency could be as long as 15 seconds in some cases. By ...
skyfire's user avatar
  • 21
0 votes
1 answer
3k views

Filter tcpdump by hostname using wildcard/regex with verbose output

Is it possible to create expression in tcpdump that would filter incoming packets with wildcard? Something like this: tcpdump -v -i bond0 -c 200 -Z root udp port 514 and src server-*.com It doesn't ...
Miroslav Cibulka's user avatar
1 vote
1 answer
1k views

Duplicate tcpdump output in cooked capture mode from bridge interfaces

I'm working with a system that has multiple bridge interfaces. I would like to monitor traffic on multiple interfaces, but tcpdump is capturing from both the master interface and its identical bridge, ...
forest's user avatar
  • 462
1 vote
0 answers
592 views

dhcp-relay cannot recieve DHCPOFFER packet from DHCP server in shared network

I'm using the dnsmasq service as a DHCP server. I have a bridged interface per node named br0 that has two ip addresses assigned to it. One is the public IP address and the other one is considered the ...
Mohammadreza Nasrabadi's user avatar
0 votes
1 answer
155 views

TCP packets being lost

I have some TCP packets being lost. I have monitored the interface with tcpdump pcap file - https://www.dropbox.com/s/7m3hr1b7065tenx/tcp.pcap?dl=0 I noticed that when I lose packets I only get 5 ...
Ruby dev's user avatar
0 votes
0 answers
275 views

Traffic capture at boot

I'm trying to figure out what packets a linux host sends at boot in order to debug it. Is there a way to start packet capture during boot time to not miss any packets? What is your way of going about ...
lolz's user avatar
  • 11
1 vote
1 answer
3k views

Trouble filtering DNS responses with tcpdump

I'm having troubles with tcpdump. I want to only capture DNS packets that are responses containing authoritative responses with a single RR that is 0.0.0.0. For example I want to only capture packets ...
owrtbro's user avatar
  • 31
0 votes
1 answer
253 views

Dump client ssh key from server side

To investigate on some issue, I need to dump the full ssh key offered by the ssh client to the ssh server. Up to this point, I tried to put the parent of all sshd server (belongs to root) LogLevel to ...
kalou.net's user avatar
  • 103
0 votes
1 answer
190 views

tcpdump and lenght with VLAN

I run ping: ping -c 15 -s 120 -D 192.5.15.22 The same time I watch tcpdump: tcpdump -n -e -vv -ttt -i iavf0 vlan tcpdump: listening on iavf0, link-type EN10MB (Ethernet), capture size 262144 bytes 00:...
sqr's user avatar
  • 15
0 votes
1 answer
2k views

Linux: bridge vs. vlan vs. tcpdump

I have a Proxmox host with kernel 5.15.19-2-pve. It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic. I created a vmbr666 bridge that shows looks like this: # /etc/...
András Korn's user avatar
0 votes
1 answer
1k views

docker containaer promiscuous mode partially working

I have strange virtual (docker bridges) networking condition I have two dockers connected to the same bridge via docker-compose. One docker is "probe" and one is "injector". ...
Boris's user avatar
  • 185
2 votes
0 answers
4k views

How to figure out what is bad about a 400 bad request, on an Apache-server

The overarching question How do I see what is 'bad' about a 400 - bad request? Info about the error When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
Zeth's user avatar
  • 131
3 votes
1 answer
1k views

Tcpdump showing different redirection port after adding REDIRECT rule in iptables

I am attempting to direct client traffic to a kubernetes cluster NodePort listening on 192.168.1.100.30000. Client's needs to make a request to 192.168.1.100.8000 so I added the following REDIRECT ...
tiger_groove's user avatar
2 votes
1 answer
2k views

Extracting TCP application data from pcap file

Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
Johannes Weiss's user avatar
0 votes
0 answers
2k views

dnsmasq DHCP not working, not replying to DHCP requests

I have setup dnsmasq as DHCP server on a CentOS VM, however it is not replying to DHCP requests. What could be the issue? Following is the configuration and tcpdump logs. interface=ens224 listen-...
asm_nerd1's user avatar
  • 101
1 vote
1 answer
867 views

TCPDUMP Order of Operations: exclude and include

Trying to look at multicast traffic so I created a filter to monitor the range, then began to slowly add statements to exclude things not relevant but didnt get expected results. Do you do the ...
Gr4cchus's user avatar
0 votes
2 answers
154 views

TCDump Missing packets

We use TCPDump on an RPI to capture WiFi signals from nearby devices as a means to get an estimate of number of people. We have notice the on "normal" days the numbers are reasonably ...
Pigsfoot's user avatar
3 votes
2 answers
13k views

tcpdump filtering out specific ips and specific ports with that ip

I want to filter out several specific ips and ports with tcpdump. example 192.168.1.100 port 1111 192.168.1.101 port 3333 I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 ...
user923097's user avatar
1 vote
1 answer
842 views

tcpdump output has a different hostname

Sorry in advance for the simple question, but I'm trying to educate myself on tcpdump and networks. I'm tracing all traffic going to a certain host with tcpdump -SX -i any dst host host.site.com ...
Denver123's user avatar
0 votes
1 answer
65 views

daemonized alternative to tcpdump to save mirrored traffic

I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
George Shuklin's user avatar
1 vote
1 answer
120 views

How to find the linux user that sent the packet [duplicate]

Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this : our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
SmootQ's user avatar
  • 113
1 vote
0 answers
1k views

tcpdump: filtering out localhost, packets show up anyway?

I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web. I've came this far as of yet: lan_hosts="(hosts || to || exclude)" local_hosts="(127.0.0....
xogoxec344's user avatar
0 votes
1 answer
822 views

QEMU VM with tap interface sees all packages coming from hypervisor instead of real source IP

I have set up a very simple Hypervisor using Alpine Linux and my VM sees all traffic coming from the IP of the hypervisor. Which also means if fail2ban tries to block attacks, it always blocks the ...
Christian's user avatar
  • 333
1 vote
1 answer
286 views

Different length between ping and tcpdump

I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the ...
sqr's user avatar
  • 15
4 votes
2 answers
1k views

Piping SSH to wireshark on windows

In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
BANJOSA's user avatar
  • 398
0 votes
1 answer
1k views

Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?

I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
kansas_bulldog382's user avatar

1
2 3 4 5
10