Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
471
questions
0
votes
0
answers
109
views
Tcpdump is not capturing traffic in whole network
Isn't this command is supposed to capture whole network traffic
**tcpdump -i any net "192.168.1.0/24 "**
nothing is being shown on terminal.
4
votes
1
answer
604
views
tcpdump -vvv is not verbose enough
For tcpdump, I use this command to see the packet details:
tcpdump -vvv -i interface
and to save the packets into a pcap file:
tcpdump -i interface -w output
The details from the first command are ...
0
votes
0
answers
22
views
NIPS appliance 100 MB limit pcap find vlan id tag
Background
I have a Network IPS Appliance at work. The configuration is not well documented and I want to work out what traffic has been configured to flow through which interfaces. The network is ...
0
votes
1
answer
90
views
tcpdump expression to collect vlan tag id only
Is there a tcpdump expression that collects the vlan tag id only?
I have an interface that has multiple vlan tagged traffic flowing through it. I can write expressions looking for IP pairs, or ...
0
votes
1
answer
310
views
How do I only capture WriteRequest from OPC UA data with only TCPDUMP
I have a PLC where I capture data through TCPDUMP command. Now The issue that I have is that when I read the hex valua of the saved data it shows it though this format:
0x0000: 0009 0f09 0021 a874 ...
0
votes
1
answer
49
views
Established TCP Communication terminates without any clue
I'm not able to understand what might be the reason for a lost TCP Communication over RPC between a CentOS 7 and Windows 2019 Server.
From the Wireshark I could see that the TCP Communication is ...
0
votes
1
answer
153
views
Why does iperf3 or TCP stack merge TCP packets?
Using this simple command:
iperf3 -c localhost --time 1 -l 100 --bitrate 100M
Then watching the output with:
sudo tcpdump -i lo -B 10000000 tcp port 5201
I would expect to see lots of 100 byte ...
0
votes
0
answers
203
views
NGINX TCP reverse proxy resolves queries differently
The Setup
I currently have a server and a mongodb database running in the cloud (Oracle Cloud Infrastructure).
The Problem
My connection to the database is bound by a select number of static IP's. ...
7
votes
1
answer
3k
views
Filtering for HTTP methods in IPv6 packets using tcpdump
I am using "tcpdump" to capture traffic, and I want to filter by HTTP methods. When I have IPv4 packets, I am using: tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' ...
0
votes
0
answers
394
views
Proxying Traffic from Android with iptables
I have a Android device, and I'm trying to redirect HTTPS traffic to another host on my local network.
I've tried defining the proxy in the device network configuration, which works for everything ...
0
votes
0
answers
338
views
Can't see udp packets with nc command, works with tcpdump
I'm trying to capture UDP data using the nc (netcat) command but it doesn't output anything. What options/parameters do I need to pass to the nc command to get the output?
tcpdump does show the UDP ...
1
vote
1
answer
1k
views
Why do UDP packets generated by Linux running in a virtual machine have defective UDP checksums?
I've set up some interconnected qemu VMs to test out port forwarding rules. For now, my current blocker is much simpler and has nothing to do with port forwarding. When I send a UDP packet from a go ...
0
votes
1
answer
26
views
Find out what's causing the sudden rise in traffic?
My webserver (Debian Bullseye, Apache2) is serving about 50 (small) websites spread over 16 ip addresses. I just noticed that on one of the ip addresses, since the beginning of this month traffic has ...
0
votes
0
answers
126
views
Can't connect to MariaDB from internal VM Structure
S1
Virtual Machine 1: Ubuntu app server
Virtual Machine 2: MariaDB 1
S2
Virtual Machine 3: Ubuntu app server
Virtual Machine 4: MariaDB 2
from vm04 and 03 I can connect to DB1 with connection string ...
0
votes
1
answer
89
views
tcpdump shows these hostnames - should I be worried
I'm investigatinmg a strnage hang with our NextCLoud instance and think it might be todo with a misconfigured hostname somewhere.
I thought of using tcpdump to look at what addresses/names are being ...
1
vote
1
answer
169
views
IPv6 port scanners hang after scanning a closed port
I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it.
For example with netcat and no firewall:
nc -6 fe80::9d08:b3e2:47fa:...
0
votes
1
answer
208
views
How to find out if TCP connection to server is being tampered with by third-parties?
I'm under an unreliable ISP/AS, something like the GFW. They actively try to sabotage a TCP+TLS session by attacks such as sending SYN RST to established connections, making the connection timeout, ...
1
vote
1
answer
239
views
Tcpdump output file is not storing the destination IP address and port number
I'm capturing tcpdump packets. Even though, when I want to see the output by tcpdump -r I see destination hostname instead of address IP and service name instead of port number.
Example:
tcpdump -w /...
1
vote
0
answers
315
views
What is the key file for ssldump?
I search google for a tool to decode https traffic and get the ssldump with examples like:
ssldump -k xxx.pem -i eth0 -d host example.com
I wonder what the key file xxx.pem is. On the server hosting ...
1
vote
1
answer
112
views
Client TCP segments arrive in batches
The scenario is the following: a WebSocket server and clients exchange messages at some pace (like 40-50 times in a second). However, for one client, once in a few minutes I'm observing that there is ...
0
votes
0
answers
106
views
Is there a way to capture packages by using tcpdump with ipset?
I got a big ipset and I want to capture networking packages related/not-related to these IPs.
Is there a way to capture packages by using tcpdump with ipset as param?
3
votes
0
answers
649
views
TCP retransmission inside of docker network
Just lately our server started experiencing increased CPU usage by the php(Symfony) and mysql processes. For quite some time we been trying to find the cause and we found out that we have big amount ...
0
votes
0
answers
108
views
using tcpdump how to capture only traffic between my server and elastic search database
I want to use tcpdump to capture traffic between my server and the elastic search database also I would like to capture traffic of one specific url POST https://vpc-my-es-3-abcd.us-east-1.es.amazonaws....
1
vote
0
answers
191
views
Why is TCP doing RTO based retransmits (200ms+ wait) vs other fast-retransmission mechanisms?
(Trying this forum after the question was deemed off-topic for Stack Overflow & Network Engineering)
I am investigating an issue where we see occasional 200ms+ spikes in a simple tcp client/server ...
2
votes
0
answers
156
views
Long latency to reply a TCP ACK
k8s environment(4 nodes, rke 1.21.5)
We noticed there is randomly significant latency in socket data transferring between different k8s pods. Latency could be as long as 15 seconds in some cases.
By ...
0
votes
1
answer
3k
views
Filter tcpdump by hostname using wildcard/regex with verbose output
Is it possible to create expression in tcpdump that would filter incoming packets with wildcard?
Something like this:
tcpdump -v -i bond0 -c 200 -Z root udp port 514 and src server-*.com
It doesn't ...
1
vote
1
answer
1k
views
Duplicate tcpdump output in cooked capture mode from bridge interfaces
I'm working with a system that has multiple bridge interfaces. I would like to monitor traffic on multiple interfaces, but tcpdump is capturing from both the master interface and its identical bridge, ...
1
vote
0
answers
592
views
dhcp-relay cannot recieve DHCPOFFER packet from DHCP server in shared network
I'm using the dnsmasq service as a DHCP server. I have a bridged interface per node named br0 that has two ip addresses assigned to it. One is the public IP address and the other one is considered the ...
0
votes
1
answer
155
views
TCP packets being lost
I have some TCP packets being lost. I have monitored the interface with tcpdump pcap file - https://www.dropbox.com/s/7m3hr1b7065tenx/tcp.pcap?dl=0
I noticed that when I lose packets I only get 5 ...
0
votes
0
answers
275
views
Traffic capture at boot
I'm trying to figure out what packets a linux host sends at boot in order to debug it.
Is there a way to start packet capture during boot time to not miss any packets?
What is your way of going about ...
1
vote
1
answer
3k
views
Trouble filtering DNS responses with tcpdump
I'm having troubles with tcpdump. I want to only capture DNS packets that are responses containing authoritative responses with a single RR that is 0.0.0.0. For example I want to only capture packets ...
0
votes
1
answer
253
views
Dump client ssh key from server side
To investigate on some issue, I need to dump the full ssh key offered by the ssh client to the ssh server.
Up to this point, I tried to
put the parent of all sshd server (belongs to root) LogLevel to ...
0
votes
1
answer
190
views
tcpdump and lenght with VLAN
I run ping:
ping -c 15 -s 120 -D 192.5.15.22
The same time I watch tcpdump:
tcpdump -n -e -vv -ttt -i iavf0 vlan
tcpdump: listening on iavf0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:...
0
votes
1
answer
2k
views
Linux: bridge vs. vlan vs. tcpdump
I have a Proxmox host with kernel 5.15.19-2-pve.
It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic.
I created a vmbr666 bridge that shows looks like this:
# /etc/...
0
votes
1
answer
1k
views
docker containaer promiscuous mode partially working
I have strange virtual (docker bridges) networking condition
I have two dockers connected to the same bridge via docker-compose. One docker is "probe" and one is "injector". ...
2
votes
0
answers
4k
views
How to figure out what is bad about a 400 bad request, on an Apache-server
The overarching question
How do I see what is 'bad' about a 400 - bad request?
Info about the error
When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
3
votes
1
answer
1k
views
Tcpdump showing different redirection port after adding REDIRECT rule in iptables
I am attempting to direct client traffic to a kubernetes cluster NodePort listening on 192.168.1.100.30000.
Client's needs to make a request to 192.168.1.100.8000 so I added the following REDIRECT ...
2
votes
1
answer
2k
views
Extracting TCP application data from pcap file
Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
0
votes
0
answers
2k
views
dnsmasq DHCP not working, not replying to DHCP requests
I have setup dnsmasq as DHCP server on a CentOS VM, however it is not replying to DHCP requests. What could be the issue? Following is the configuration and tcpdump logs.
interface=ens224
listen-...
1
vote
1
answer
867
views
TCPDUMP Order of Operations: exclude and include
Trying to look at multicast traffic so I created a filter to monitor the range, then began to slowly add statements to exclude things not relevant but didnt get expected results. Do you do the ...
0
votes
2
answers
154
views
TCDump Missing packets
We use TCPDump on an RPI to capture WiFi signals from nearby devices as a means to get an estimate of number of people.
We have notice the on "normal" days the numbers are reasonably ...
3
votes
2
answers
13k
views
tcpdump filtering out specific ips and specific ports with that ip
I want to filter out several specific ips and ports with tcpdump.
example 192.168.1.100 port 1111
192.168.1.101 port 3333
I know tcpdump -i ens192 not dst host 192.168.1.100 and dst port 1111 ...
1
vote
1
answer
842
views
tcpdump output has a different hostname
Sorry in advance for the simple question, but I'm trying to educate myself on tcpdump and networks.
I'm tracing all traffic going to a certain host with
tcpdump -SX -i any dst host host.site.com
...
0
votes
1
answer
65
views
daemonized alternative to tcpdump to save mirrored traffic
I need to save mirrored traffic for audit purposes. Traffic for audited server is send to other server. I need to capture that traffic on dedicated interface, save it to pcap files of reasonable scope ...
1
vote
1
answer
120
views
How to find the linux user that sent the packet [duplicate]
Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this :
our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
1
vote
0
answers
1k
views
tcpdump: filtering out localhost, packets show up anyway?
I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web.
I've came this far as of yet:
lan_hosts="(hosts || to || exclude)"
local_hosts="(127.0.0....
0
votes
1
answer
822
views
QEMU VM with tap interface sees all packages coming from hypervisor instead of real source IP
I have set up a very simple Hypervisor using Alpine Linux and my VM sees all traffic coming from the IP of the hypervisor.
Which also means if fail2ban tries to block attacks, it always blocks the ...
1
vote
1
answer
286
views
Different length between ping and tcpdump
I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the ...
4
votes
2
answers
1k
views
Piping SSH to wireshark on windows
In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
0
votes
1
answer
1k
views
Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?
I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...