Hot answers tagged

112 votes
Accepted

Human readable format for http headers with tcpdump

Here's a one-liner I came up with for displaying request and response HTTP headers using tcpdump (which should work for your case too): sudo tcpdump -A -s 10240 'tcp port 4080 and (((ip[2:2] - ((ip[0]...
user avatar
  • 1,236
52 votes

Tcpdump on multiple interfaces

According to the tcpdump man page: On Linux systems with 2.2 or later kernels, an interface argument of ‘‘any’’ can be used to capture packets from all interfaces. Note that captures on the ‘‘...
user avatar
26 votes

How to display interface in tcpdump output flow?

I hope somebody is still interested in the solution to the problem. ;) We had the same issue in our company and I started writing a script for this. I wrote a blog post about it with the source code ...
user avatar
20 votes

Tcpdump on multiple interfaces

The way I would approach this is to dump on each interface to a separate file and then merge them. The any interface also includes lo traffic which can pollute the capture. This also allows for ...
user avatar
17 votes

How to send captured packets to a different destination?

I wanted to capture some SNMP traps and keep them to test my application later. So I don't want to generate traps each time I wanted to test my application. I would like to post how I have done this. ...
user avatar
16 votes

TCP Dump, cannot understand these 4 lines?

Seems like client 192.168.246.128 tried to connect to web server 192.168.246.13 but client's window size of 92 bytes was refused by a slow-read attack prevention mechanism.
user avatar
  • 12.8k
15 votes
Accepted

Why echo request doesn't show in tcpdump?

This answer assumes Linux as OS. The output cannot be captured as plaintext by tcpdump: it's already encrypted before tcpdump has a chance to see it and its icmp filter will not match. The input, ...
user avatar
  • 8,747
12 votes

tcpdump: out.pcap: Permission denied

When I ran into this Permission denied issue it turned out to be that I was putting a .cap extension on the file instead of .pcap. As RichL pointed out in the comments, AppArmor profile on Ubuntu /...
user avatar
  • 3,629
12 votes

tcpdump increases udp performance

When tcpdump is running, it will be fairly prompt at reading in the incoming frames. My hypothesis is that the NIC's packet ring buffer settings may be a bit on the small size; when tcpdump is running ...
user avatar
  • 3,899
11 votes

How do I make tcpdump not print the tcp headers?

I feel the most elegant solution is just to ditch tcpdump. No pipes of any kind: tcpflow -c port 6667 And that's it.
user avatar
10 votes
Accepted

Log network traffic with process ID on Mac OS X?

While the nettop is nice for viewing the snapshot of current connections, you can use the tcpdump to collect the data and process information as well. With tcpdump use the option -k to display ...
user avatar
  • 216
9 votes

tcpdump: capture one of several vlans

It can be done in more simply way than using deep packet exam, just use grep: tcpdump -n -i eth1 -e | grep "vlan 1000" -e: Print the link-level header on each dump line. it will print lines like ...
user avatar
9 votes

TCP Dump, cannot understand these 4 lines?

EDIT after reading comment by @GuntramBlohm on answer by @XavierLucas I did a quick check how do certain nmap scans look like on the wire and it seems pattern in OP is match for nmap -sT known as TCP ...
user avatar
9 votes

tcpdump capture new connections only

To capture only TCP SYN packets: # tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) != 0"
user avatar
9 votes
Accepted

How can i see packets while capturing with tcpdump

So after a bit of experiment, the anwser if the following : sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r - -w - : write to standard output. -U : write packets as soon as they arrive. ...
user avatar
8 votes

Packet captures: filtering on RX vs TX

Use --direction option to tcpdump: -Q direction --direction=direction Choose send/receive direction direction for which packets should be captured. Possible values are `in', `out' and `...
user avatar
8 votes

Making TCP dump without packets loss

At your amount of traffic, I would claim that libpcap should have no trouble with dropped packets unless you have a particularly inefficient setup. If you are using tcpdump for capturing, it will ...
user avatar
  • 40.3k
8 votes
Accepted

tcpdump only showing output after stopping it

You probably want the -l or -U option. See the info in man page ... -l Make stdout line buffered. Useful if you want to see the data while capturing it. ... -...
user avatar
  • 4,447
7 votes

How does TCP offload NIC cause the TCP checksum to be invalid?

Because, the checksum is being calculated by the NIC, and not by the operating system. The wiki page you linked to did explain this: If you capture on a recent Ethernet NIC, you may see many such "...
user avatar
7 votes
Accepted

Running tcpdump starts ssh flood

My command is just > tcpdump -i eth0. but what I dont understans it why running tcpdump suddenly esclates to huge amount of traffic. Try facing a mirror at a mirror, you'll get the idea. If not, ...
user avatar
  • 128k
6 votes

tcpdump Server Hello Certificate Filter

If you just want to get the SSL Handshake Hello packet to see the contained SNI, the following filter seems to work for both TLS1.0 and TLS1.2 : tcpdump -i any -s 1500 (tcp[((tcp[12:1] & 0xf0) &...
user avatar
6 votes

How i can dump raw packets from an existing tcp socket using tcpdump on Mac and Linux?

From tcpdump(1) man page: -x When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level ...
user avatar
  • 3,887
6 votes
Accepted

How would a PCAP filter look like to capture all DHCP related traffic?

I settled with the following PCAP filter: ( udp and ( port 67 or port 68 ) ) or arp or ( icmp and (icmp[icmptype] == 8 or icmp[icmptype] == 0 ) ) or ( udp and ( port 546 or port 547 ) ) or ( icmp6 ...
user avatar
5 votes

Determine originating process for outbound traffic

The netstat command can only tell you which connections are currently open, but not how much traffic each has sent and received. To find out which connections are transferring most of the data, you ...
user avatar
  • 29.8k
5 votes

How to use tshark or tcpdump to calculate bytes transmitted

You can rely purely on tshark to do this, by using the statistics option with the IO stat calculator : tshark -r pcapfile -z io,stat,0,"SUM(frame.len)frame.len && ip.src == 192.168.1.1 &&...
user avatar
  • 12.8k
5 votes

Filtering GRE enacpsulated packets with tcpdump

Since this was of use to me, updating this answer. If you want to look at a proto inside of another proto, you can't just use proto in the match. protochain works like proto, however it specifically ...
user avatar
5 votes

Filtering GRE enacpsulated packets with tcpdump

In case your tcpdump version does not support protochain like the one in Debian 8 for example, you can manually calculate the position, where the protocol number of the ip packet within the GRE tunnel ...
user avatar
  • 41
5 votes

Why is wireshark capturing packets not destined to my host?

Wireshark, being a network sniffer, put both the interface firmware (if present) and driver into promiscuous mode, meaning that it instruct the network stack to capure any packets arriving at your ...
user avatar
  • 43.7k

Only top scored, non community-wiki answers of a minimum length are eligible