64
votes
Tcpdump on multiple interfaces
According to the tcpdump man page:
On Linux systems with 2.2 or later kernels, an interface argument of ‘‘any’’ can be used to capture packets from all interfaces. Note that captures on the ‘‘...
- 766
22
votes
Tcpdump on multiple interfaces
The way I would approach this is to dump on each interface to a separate file and then merge them. The any interface also includes lo traffic which can pollute the capture.
This also allows for ...
- 410
18
votes
How to send captured packets to a different destination?
I wanted to capture some SNMP traps and keep them to test my application later. So I don't want to generate traps each time I wanted to test my application.
I would like to post how I have done this. ...
- 486
15
votes
How do I make tcpdump not print the tcp headers?
I feel the most elegant solution is just to ditch tcpdump. No pipes of any kind:
tcpflow -c port 6667
And that's it.
- 724
15
votes
Accepted
Why echo request doesn't show in tcpdump?
This answer assumes Linux as OS.
The output cannot be captured as plaintext by tcpdump: it's already encrypted before tcpdump has a chance to see it and its icmp filter will not match. The input, ...
- 11.2k
11
votes
Accepted
How can i see packets while capturing with tcpdump
So after a bit of experiment, the anwser if the following :
sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -
-w - : write to standard output.
-U : write packets as soon as they arrive. ...
- 261
10
votes
Accepted
Log network traffic with process ID on Mac OS X?
While the nettop is nice for viewing the snapshot of current connections, you can use the tcpdump to collect the data and process information as well. With tcpdump use the option -k to display ...
- 216
9
votes
tcpdump: capture one of several vlans
It can be done in more simply way than using deep packet exam, just use grep:
tcpdump -n -i eth1 -e | grep "vlan 1000"
-e: Print the link-level header on each dump line.
it will print lines like
...
- 91
9
votes
tcpdump capture new connections only
To capture only TCP SYN packets:
# tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) != 0"
- 117
8
votes
Accepted
tcpdump only showing output after stopping it
You probably want the -l or -U option.
See the info in man page ...
-l Make stdout line buffered. Useful if you want to see the data
while capturing it.
...
-...
- 4,517
8
votes
Accepted
Running tcpdump starts ssh flood
My command is just > tcpdump -i eth0. but what I dont understans it why running tcpdump suddenly esclates to huge amount of traffic.
Try facing a mirror at a mirror, you'll get the idea. If not, ...
- 131k
7
votes
How to display interface in tcpdump output flow?
Just a note, tcpdump 4.99 now displays the interface name/direction in the output:
[vagrant@localhost]$sudo tcpdump -i any arp
tcpdump: data link type LINUX_SLL2
tcpdump: verbose output suppressed, ...
- 71
7
votes
How does TCP offload NIC cause the TCP checksum to be invalid?
Because, the checksum is being calculated by the NIC, and not by the operating system.
The wiki page you linked to did explain this:
If you capture on a recent Ethernet NIC, you may see many such "...
- 244k
7
votes
Accepted
How to specify both IP address and port in tcpdump?
Tcpdump filters can be combined with the and and or keywords. Here is the command that satisfied my filtering requirements:
tcpdump -i enp1s9 dst 192.168.6.1 and src 192.168.6.2 and src port 80
Where ...
- 251
6
votes
Accepted
How would a PCAP filter look like to capture all DHCP related traffic?
I settled with the following PCAP filter:
( udp and ( port 67 or port 68 ) )
or arp
or ( icmp and (icmp[icmptype] == 8 or icmp[icmptype] == 0 ) )
or ( udp and ( port 546 or port 547 ) )
or ( icmp6 ...
- 417
6
votes
How can I capture IPSEC packets on my VPN server?
The filter with tcp port 80 will never capture ESP, since esp protocol (IP protocol 50) is not tcp (IP protocol 6) and will never match this filter.
For Linux, this schematic and its few places ...
- 11.2k
5
votes
Accepted
How do I see absolute time stamps in Wireshark?
(from comment)
A pcap file (from tcpdump or wireshark or AFAIK anything else using libpcap) already has absolute time; it's only the Wireshark display you need to adjust.
In the View menu click Time ...
- 3,292
5
votes
Accepted
How does TCP offload NIC cause the TCP checksum to be invalid?
A TCP segment is located in computer RAM. It contains all the fields required for the TCP segment.
When TCP checksum offload is used, this is what happens when transmitting a segment:
The OS fills ...
- 36.8k
5
votes
Accepted
Netstat and ss doesn't see connection
After couple of weeks I found answer. I needed to run netstat -tapn in all namespaces with following command:
sudo ip -all netns exec netstat -tapn | grep 34226
Now I have PID number of process ...
- 653
5
votes
How can I capture IPSEC packets on my VPN server?
I was able to capture traffic inside IPSEC using this strongswan page
In short:
iptables -I INPUT -m addrtype --dst-type LOCAL -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5
iptables -I ...
- 71
5
votes
Accepted
openvpn server not showing traffic using tcpdump
If you use client-to-client option, there is no way to see it with tcpdump. In this case OpenVPN doesn't forward any traffic to the kernel. It receives a packet, processes it and sends to another ...
- 11.2k
4
votes
Filtering GRE enacpsulated packets with tcpdump
In case your tcpdump version does not support protochain like the one in Debian 8 for example, you can manually calculate the position, where the protocol number of the ip packet within the GRE tunnel ...
- 41
4
votes
Filtering GRE enacpsulated packets with tcpdump
Since this was of use to me, updating this answer.
If you want to look at a proto inside of another proto, you can't just use proto in the match.
protochain works like proto, however it specifically ...
- 49
4
votes
Log network traffic with process ID on Mac OS X?
I recently had this problem too. One approach you can potentially take is to use both tcpdump and nettop in parallel (each, side by side, in their own terminal shells), and visually observe as the ...
- 41
4
votes
how to split a pcap file into a set of smaller ones
I know this answer is a little late, but it may serve other people as well. I found a great tool for splitting pcap files: PcapSplitter. It's part of the PcapPlusPlus library which means it's cross-...
- 408
4
votes
Accepted
tcpdump - prevent interpreting/decoding protocols
You can use the '-q' option to remove the content decoding. You can maybe add the '-A' to see in ASCII the content of the packets, or -dd to see in C format.
- 6,743
4
votes
icmp ping reply not received by ping process, seen by tcpdump/wireshark
wireshark see the packet before the firewall in reception. that mean a firewall or a similar product filter your reception. (reference)
the bad checksum just mean usually that tcp checksum offload is ...
- 16.8k
4
votes
tcpdump capture new connections only
The following will capture both TCP-SYN and SYN-ACK packets.
tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) !=0"
The following will only capture TCP-SYN packets.
tcpdump -i <...
- 41
4
votes
Only top scored, non community-wiki answers of a minimum length are eligible