commandline packet analyzer

learn more… | top users | synonyms

0
votes
1answer
7 views

How to tcpreplay only packets satisfying a pcap filter rule?

I have a dump file with lots of various packets in it, but I want to selectively replay, say, only all udp packets to a given port number, without having to edit the dump file first. How?
0
votes
1answer
18 views

What's the purpose of the -interface option in tcpdump?

doing the following command: tcpdump -i eth0:cp5 shows exactly the same thing as the default ... tcpdump what's the purpose of allowing user to specify interfaces?
0
votes
0answers
13 views

tcpdump doesn't captures properly on specific port

I'm in a network and I want to capture FTP packets from another server in the network but I have a problem with tcpdump about this. I've used this command, where X.X.X.X is the FTP server: tcpdump -...
0
votes
1answer
53 views

Can't connect local server by public domain name

I have my server (Debian Wheezy) in my local home network. On that server I have my own DNS server (dnsmasq) for other local servers (so I can type name instead of local IP) and reverse proxy (nginx). ...
1
vote
2answers
27 views

tcpdump is not capturing packets

Can anybody tell me what kind of error I have in this? It isn't reading any packets when I run it. nohup sudo tcpdump -i any host 10.0.1.107 and port 5060 and port 6060 -G 010 -W 015 -w capture_%Y-%m-...
0
votes
1answer
25 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
0answers
14 views

how to capture a certain http code responce with tcpdump

I want to capture http errors on openwrt. ngrep utility would be very useful but is not available there also tshark is not available also. so it leaves me with tcpdump. how do I tell tcpdump to ...
1
vote
1answer
32 views

How many ARP Request/Reply for Ping command to work

I would like know how many ARP Request/Reply are required for ping command to get work ? Let's say we have two machines connected point to point with ip's 192.168.110.2 and 192.168.110.3 and executes ...
0
votes
1answer
1k views

Multiple connections to Plex dlna port 32469

Sorry if this is not in the correct forum. I have Plex server installed on a Raspberry PI running Raspbian with Open Media Vault. Everything works well. The only issue I have is that I get lots of ...
0
votes
0answers
159 views

Log to file WSS Websocket packet traffic

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-...
0
votes
0answers
17 views

How do I find out to what hostname a potential malware wants to connect?

Without connecting my computer to Internet. I can only think about netstat and packet capturing tools, but I dont really know which method is suitable.
0
votes
0answers
66 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
1
vote
1answer
134 views

Wireless packet sniffing on Linux. Captured data is almost only broadcasts

Environment: Home network that operates on channel 8 (I am the admin so all the passwords are known and I have physical access to all devices), with a PC and a laptop connected to it (both standing ...
1
vote
1answer
1k views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
0
votes
0answers
20 views

How can I capture a list of all servers my computer connects to?

I'd like to capture, in real-time, a list of all servers (URL preferred, IP address ok) my computer connects to. I've used tshark and tcpdump, but they return different results. This makes me wonder ...
1
vote
1answer
66 views

What is a cache flush, and how do you explain this TCPdump pattern?

I ran TCPdump a few times on my home network and found a lot of packets that were marked (Cache Flush), seemingly originating with my sister's laptop. I can't see any HTTP or HTTPS packets during the ...
0
votes
2answers
221 views

Capturing incoming UDP packet fails

My Environment: Mac OS X 10.8.5 (IP: 192.168.10.5) CentOS 6.5 (IP: 192.168.10.8) I'm trying to capture UDP incoming packet on OS X. I tried on the Terminal of OS X # tcpdump -In udp portrange ...
0
votes
0answers
37 views

TCP Dump received from Verizon, along with an abuse notice

Apologies in advance if this Question is not a good fit for your forum, but I hope it is and someone can help. I'm a FIOS customer and received from "abuse@verizon.net" a TCP dump as part of an email ...
0
votes
1answer
84 views

how to use tcpdump to capture LAN packets which are not from or destined to my PC?

I'm using wifi for network access. I'm doing an experiment with my smartphone to do some experiment and I want to capture packets which are from my smartphone. My idea is to use my laptop with tcpdump ...
0
votes
0answers
133 views

How to capture packets of rysnc using tcpdump

I am trying to do rysnc a 4G file to another directory and want to capture rsync packets using tcpdump. I tried listning to port 873 which is used for rsync but did not find anything captured. I ...
1
vote
1answer
742 views

Check for packets MARKed by iptables

I am marking TCP and UDP packets in order to send them to two different interfaces (say wlan0 and eth0), I did this by following this answer. Assuming this configuration: eth0 address: 192.168.0.84 ...
1
vote
0answers
254 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
0
votes
1answer
79 views

Yosemite Run Command on Boot as Root without Password

I run OS X Yosemite and I would like to always have the command run, as root, on startup: tcpdump -i en0 'icmp and icmp[icmptype]=icmp-echo' >> /var/vtcakavsmoace/Desktop/ping_information.txt ...
0
votes
2answers
3k views

tcpdump not capturing any packets

I'm trying to monitor what's going on in my network, so I've tried tcpdump command. I'm just learning to use it, so I thought on playing around a little bit with it. My problem is that I cannot ...
0
votes
0answers
93 views

Review RDP Session from TCPDump

Is it possible to visualize a RDP-Session (ie. convert to video) if you have the tcpdump (containing the entire session) and all involved cryptographic keys (client and server)?
0
votes
1answer
61 views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump -...
0
votes
1answer
33 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
96 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
1
vote
0answers
180 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
2answers
373 views

How to find IP address of ADSL modem?

Our fall back Internet connection uses a SpeedStream 4100 modem, which just broke, so I have replaced it with a new one. I need to configure it to bridge mode, but I can't even find its IP address. ...
0
votes
1answer
86 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
1
vote
1answer
896 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
1
vote
1answer
99 views

Unable to see broadcast packets with tcpdump

I am launching an application which broadcasts udp packets. I also have a simple python script to confirm that these packets are being broadcast: sock = socket.socket(socket.AF_INET, socket....
0
votes
0answers
106 views

UDP traceroute delay?

We are seeing timeout packages when running traceroute command between two Linux systems on a private network. However, we do not see such symptoms using TCP or ICMP over traceroute. This is a private ...
1
vote
0answers
63 views

ICMP flood with ping working only one time

my problem is simple: The first time I made a flooding ping to a fake ip on my network (for testing if someone is on promisc mode), it works perfectly: $ping -f 192.168.1.10 After perfoming this, ...
0
votes
1answer
853 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 -...
4
votes
0answers
268 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
2answers
230 views

Decompress logged GZIP binary data

In an effort to verify my app was sending back and forth with my server correctly, I had run tcpdump -w ~/capture.txt -s 0 port 80 on a server with proxy sitting in between to capture all requests....
2
votes
1answer
3k views

tcpdump - rotate capture files using -G -W and -C

I'm looking to be able to capture a rotating tcpdump output which captures 30-minutes worth of data, into 48 files, cyclically. The man implies this should be possible, but my testing doesn't seem to ...
0
votes
1answer
436 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
2
votes
1answer
242 views

what does `tcpdump -xx` do in Mac OS X?

I was playing with tcpdump, and I noticed that, on OS X, the -xx option does something that is different to what the man page describes. Here is what the man page says: -x When parsing and ...
1
vote
0answers
116 views

How do I troubleshoot if I see the incoming packet in tcpdump, but not at the socket?

For example, I see that the incoming packet in tcpdump, but not in strace for the program that is listening the appopriate socket. How do I trace the "fate" of this incoming packet on Linux? I ...
0
votes
0answers
32 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
1
vote
1answer
334 views

how to capture “DROP”ped packets on OUTPUT of iptables?

having a fairly complex OUTPUT processing on iptables, how does one go about capturing / displaying (at least similarly to how tcpdump captures them) the packets that were to leave through an ...
1
vote
0answers
186 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
1answer
231 views

Why does tcpdump not come precompiled and how to compile it?

Hello I recently downloaded tcpdump from the www.tcpdump.org/ website, extracted the tar.gz file and found nothing but source and header files, I do not posses the necessary knowledge to get a working ...
0
votes
1answer
1k views

ipv6 ping host got destination host unreachable until run tcpdump

At first (all computer booted) when I ping the gateway (linux computer, two network cards(one is usb)) from a windows computer, I got: "Destination host unreachable", but when I run "tcpdump -i ...
1
vote
2answers
86 views

Can tcpdump be instructed not to report packets to a specific source?

I would like to monitor packets using TCPdump. Sadly, I must do this remotely - in this case, I'm using a remote desktop from VNC, but at best I can do it over SSH. What I mean by "at best" is: I am ...
1
vote
0answers
581 views

What's wrong with this tcpdump syntax?

sudo tcpdump -i ath1 -s 0 -nne "(type mgt and subtype beacon)" Can anyone help me? I was following a tutorial at http://wiki.secarmour.com/2013/09/capture-wireless-traffic.html but seems I got ...
0
votes
1answer
80 views

tcpdump prints nothing while trying to listen communication with sip server

The following command sudo tcpdump -nqt -s 0 -A -i eth0 port 5060 works and prints incoming SIP messages. Now I want to see entire communication and entering the IP address of the SIP server: ...