Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not very experience with networking, so on my free time, I usually try and learn some more things about the internet and how it works. While at school, I came across tcpdump and wanted to give it a try (I had experience with wireshark). The first things that come cranking out of it was similar to this line:

20:18:41.526871 IP Isaac-PC.39861 > Flags [.], ack 1449, win 137, options [nop,nop,TS val 4121497 ecr 3242277283], length 0

Note that this was taken at home, at school the string after Isaac-PC was much, MUCH longer.

My question is what is that whole line represent? Why is it there, and not an ip address? What am I missing here?

share|improve this question
up vote 1 down vote accepted

tcpdump doesn't use colons to separate the address/hostname from the port, rather it just uses a period. So the answer to your question is is the hostname, and http is the port (port 80).

So the TCP packet being displayed is being sent from host Isaac-PC and source port 39861 to on destination port 80.

If you don't want tcpdump to convert addresses and port numbers to name, run it with the argument -n.

share|improve this answer
Okay, that makes sense, but why is the hostname so HUGE? Even when going on this site, tcpdump is giving me some big thing. – ILikePizza555 Mar 8 '13 at 4:42
That depends on what host you are communicating with. This looks like you are sending packets to a consumer using quest as their ISP. Since consumer connections aren't suppose to host servers, ISPs don't care how long or big those hostnames are and generally just derive them from the IP address as you can see. – Fred Thomsen Mar 8 '13 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .