commandline packet analyzer

learn more… | top users | synonyms

0
votes
0answers
10 views

Log to file WSS Websocket packet traffic

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen ...
0
votes
0answers
10 views

How do I find out to what hostname a potential malware wants to connect?

Without connecting my computer to Internet. I can only think about netstat and packet capturing tools, but I dont really know which method is suitable.
0
votes
0answers
25 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
0
votes
0answers
31 views

Duplicate SYN package forwarded by Docker? [migrated]

I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down. I've been ...
1
vote
1answer
42 views

Wireless packet sniffing on Linux. Captured data is almost only broadcasts

Environment: Home network that operates on channel 8 (I am the admin so all the passwords are known and I have physical access to all devices), with a PC and a laptop connected to it (both standing ...
0
votes
1answer
37 views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
0
votes
0answers
18 views

How can I capture a list of all servers my computer connects to?

I'd like to capture, in real-time, a list of all servers (URL preferred, IP address ok) my computer connects to. I've used tshark and tcpdump, but they return different results. This makes me wonder ...
1
vote
1answer
29 views

What is a cache flush, and how do you explain this TCPdump pattern?

I ran TCPdump a few times on my home network and found a lot of packets that were marked (Cache Flush), seemingly originating with my sister's laptop. I can't see any HTTP or HTTPS packets during the ...
0
votes
2answers
78 views

Capturing incoming UDP packet fails

My Environment: Mac OS X 10.8.5 (IP: 192.168.10.5) CentOS 6.5 (IP: 192.168.10.8) I'm trying to capture UDP incoming packet on OS X. I tried on the Terminal of OS X # tcpdump -In udp portrange ...
0
votes
0answers
26 views

TCP Dump received from Verizon, along with an abuse notice

Apologies in advance if this Question is not a good fit for your forum, but I hope it is and someone can help. I'm a FIOS customer and received from "abuse@verizon.net" a TCP dump as part of an email ...
0
votes
1answer
50 views

how to use tcpdump to capture LAN packets which are not from or destined to my PC?

I'm using wifi for network access. I'm doing an experiment with my smartphone to do some experiment and I want to capture packets which are from my smartphone. My idea is to use my laptop with tcpdump ...
0
votes
0answers
67 views

How to capture packets of rysnc using tcpdump

I am trying to do rysnc a 4G file to another directory and want to capture rsync packets using tcpdump. I tried listning to port 873 which is used for rsync but did not find anything captured. I ...
1
vote
1answer
229 views

Check for packets MARKed by iptables

I am marking TCP and UDP packets in order to send them to two different interfaces (say wlan0 and eth0), I did this by following this answer. Assuming this configuration: eth0 address: 192.168.0.84 ...
0
votes
0answers
138 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
0
votes
1answer
69 views

Yosemite Run Command on Boot as Root without Password

I run OS X Yosemite and I would like to always have the command run, as root, on startup: tcpdump -i en0 'icmp and icmp[icmptype]=icmp-echo' >> /var/vtcakavsmoace/Desktop/ping_information.txt ...
0
votes
2answers
736 views

tcpdump not capturing any packets

I'm trying to monitor what's going on in my network, so I've tried tcpdump command. I'm just learning to use it, so I thought on playing around a little bit with it. My problem is that I cannot ...
0
votes
0answers
47 views

Review RDP Session from TCPDump

Is it possible to visualize a RDP-Session (ie. convert to video) if you have the tcpdump (containing the entire session) and all involved cryptographic keys (client and server)?
0
votes
1answer
41 views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump ...
0
votes
1answer
25 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
85 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
1
vote
0answers
105 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
2answers
245 views

How to find IP address of ADSL modem?

Our fall back Internet connection uses a SpeedStream 4100 modem, which just broke, so I have replaced it with a new one. I need to configure it to bridge mode, but I can't even find its IP address. ...
0
votes
1answer
68 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
1
vote
1answer
548 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
1
vote
1answer
61 views

Unable to see broadcast packets with tcpdump

I am launching an application which broadcasts udp packets. I also have a simple python script to confirm that these packets are being broadcast: sock = socket.socket(socket.AF_INET, ...
0
votes
0answers
80 views

UDP traceroute delay?

We are seeing timeout packages when running traceroute command between two Linux systems on a private network. However, we do not see such symptoms using TCP or ICMP over traceroute. This is a private ...
0
votes
0answers
56 views

ICMP flood with ping working only one time

my problem is simple: The first time I made a flooding ping to a fake ip on my network (for testing if someone is on promisc mode), it works perfectly: $ping -f 192.168.1.10 After perfoming this, ...
0
votes
1answer
534 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
4
votes
0answers
198 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
2answers
160 views

Decompress logged GZIP binary data

In an effort to verify my app was sending back and forth with my server correctly, I had run tcpdump -w ~/capture.txt -s 0 port 80 on a server with proxy sitting in between to capture all ...
2
votes
1answer
1k views

tcpdump - rotate capture files using -G -W and -C

I'm looking to be able to capture a rotating tcpdump output which captures 30-minutes worth of data, into 48 files, cyclically. The man implies this should be possible, but my testing doesn't seem to ...
0
votes
1answer
298 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
2
votes
1answer
184 views

what does `tcpdump -xx` do in Mac OS X?

I was playing with tcpdump, and I noticed that, on OS X, the -xx option does something that is different to what the man page describes. Here is what the man page says: -x When parsing and ...
1
vote
0answers
65 views

How do I troubleshoot if I see the incoming packet in tcpdump, but not at the socket?

For example, I see that the incoming packet in tcpdump, but not in strace for the program that is listening the appopriate socket. How do I trace the "fate" of this incoming packet on Linux? I ...
0
votes
0answers
59 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
0answers
30 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
1
vote
1answer
207 views

how to capture “DROP”ped packets on OUTPUT of iptables?

having a fairly complex OUTPUT processing on iptables, how does one go about capturing / displaying (at least similarly to how tcpdump captures them) the packets that were to leave through an ...
1
vote
0answers
145 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
1answer
183 views

Why does tcpdump not come precompiled and how to compile it?

Hello I recently downloaded tcpdump from the www.tcpdump.org/ website, extracted the tar.gz file and found nothing but source and header files, I do not posses the necessary knowledge to get a working ...
0
votes
1answer
755 views

ipv6 ping host got destination host unreachable until run tcpdump

At first (all computer booted) when I ping the gateway (linux computer, two network cards(one is usb)) from a windows computer, I got: "Destination host unreachable", but when I run "tcpdump -i ...
1
vote
2answers
81 views

Can tcpdump be instructed not to report packets to a specific source?

I would like to monitor packets using TCPdump. Sadly, I must do this remotely - in this case, I'm using a remote desktop from VNC, but at best I can do it over SSH. What I mean by "at best" is: I am ...
1
vote
0answers
411 views

What's wrong with this tcpdump syntax?

sudo tcpdump -i ath1 -s 0 -nne "(type mgt and subtype beacon)" Can anyone help me? I was following a tutorial at http://wiki.secarmour.com/2013/09/capture-wireless-traffic.html but seems I got ...
0
votes
1answer
57 views

tcpdump prints nothing while trying to listen communication with sip server

The following command sudo tcpdump -nqt -s 0 -A -i eth0 port 5060 works and prints incoming SIP messages. Now I want to see entire communication and entering the IP address of the SIP server: ...
2
votes
2answers
2k views

tcpdump: how to get grepable output?

I am trying to troubleshoot an issue where I only have tcpdump available on an appliance. I want to use tcpdump to filter web traffic, and only display traffic containing certain strings. I do the ...
1
vote
0answers
489 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
0
votes
2answers
5k views

Why are some tcp packets with the RST flag classified as new incoming connection?

While looking through my iptables log, I keep observing periodically incoming connections with the RESET flag being set from a few ip addresses within my ISP's network. This is a sample tcpdump on one ...
0
votes
1answer
544 views

Captured packets with tcpdump vs. tcpdump > file

Why is there such difference in number of packets captured by tcpdump when the output is written to console and to file? $ tcpdump ... 1681 packets captured 1681 packets received by filter 0 packets ...
1
vote
1answer
2k views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
2answers
884 views

How to quieten tcpdump output when reading a pcap file?

I notice that when using tcpdump to read a pcap file, the tcpdump command somehow manages to print information to my console even when I redirect both STDOUT and STDERR. How can I prevent tcpdump from ...
0
votes
1answer
58 views

Get external email from action “mailto”-form

Is it possible to pick out the email adress that a "mailto"-form will send an external email to? example from this (swedish "ebay" - ad) ...