Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am troubleshooting a problem where a long TCP transaction (>=60s) would disconnect between my source (Point A) and destination (Point B), whilst passing through an internal Linux Gateway and several other CISCO routers/switches in between.

To investigate the issue further, I would need to enable TCP logging and facilitate my root cause analysis. However, I have very low disk space available and could not perform this logging for as long as I would like to. Therefore, I would like to know if there's a way to enable TCP logging for only selected TCP packets? I would need to enable logging at both the Gateway and the intermediate network devices in between.

Specifically, I am investigating whether Point A has received a FIN packet from Point B or from any other devices in between, which resulted in the abovementioned disconnect when a transaction takes more than 60s to complete.

share|improve this question

migrated from Oct 22 '12 at 7:31

This question came from our site for professional and enthusiast programmers.

i think this belongs to SuperUser. anyways i would suggest to read "man tcpdump" – Tanuki Software Oct 19 '12 at 4:03
tcpdump or wireshark, if you prefer GUI to command line tool. – divanov Oct 19 '12 at 7:22

tcpdump is your friend. From the pcap-filter man page:

To select the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.

tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet

So, tcpdump -ieth0 filter_expression should give you what you need. You can add things like and host a.b.c.d and port efg to limit the capture even further. You should be able to use that same filter expression with WireShark if you prefer a GUI program.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .