Questions tagged [tcpdump]
commandline packet analyzer
200
questions
93
votes
6
answers
91k
views
Can I monitor a local unix domain socket like tcpdump?
I'd like to monitor responses on a unix socket without disturbing the original connections and pipe them to a script for processing.
I know how to do this with tcpdump for tcp connections but I ...
- 101
0
votes
0
answers
10
views
Why does netcat -v send extra X packets?
I'm using netcat 1.218 on Ubuntu 22.04 to generate test syslog packets, and I noticed an odd behavior I can't explain. When I use the -v flag, netcat sends 2 additional packets containing the letter ...
- 1,215
2
votes
3
answers
7k
views
Unable to see broadcast packets with tcpdump
I am launching an application which broadcasts udp packets. I also have a simple python script to confirm that these packets are being broadcast:
sock = socket.socket(socket.AF_INET, socket....
CommunityBot
- 1
0
votes
1
answer
188
views
Configure Virtualbox to capture network traffic between 2 VMs on the same host from another physical machine
My context is:
A physical machine with windows 10 (PC_Physcial_01) that host 2
virtualbox linux VMs PC_VM_01 & PC_VM_02)
An other physical machine dedicated to sniff network traffic
(...
- 1
2
votes
1
answer
9k
views
How to set NIC in promiscuous mode on mac book air?
With MacOSx, I am trying to run my nic in promiscuous mode and then use tshark / tcpdump to capture traffic.
Option 1:
ifconfig en0 promisc
but I get this message:
ifconfig: promisc: bad value
...
- 322
0
votes
0
answers
85
views
Saving the captured traffic of tcpdump after 24 hours
I'm currently setting up multiple Linux Servers in order to build a honeypot infrastructure. I want to capture the incoming and outgoing traffic with tcpdump too. Is it possible to save the captured ...
Jan
1
vote
0
answers
133
views
Capture network traffic from physical devices in a Linux VM
I have a Linux VM hosted in a physical Windows PC in Hyper-V. The VM is using an external switch. There are a few more physical devices in the network. When I run tcpdump inside the VM, I can only see ...
- 111
0
votes
3
answers
804
views
Analyse UDP delay from tcpdump files
I have a video streamer (VLC) which is using RTP to stream video to a client. I have captured the packet trace from both the sender and the receiver side using tcpdump separately.
The streaming ...
- 1
17
votes
6
answers
46k
views
How to capture last N seconds of packets using tcpdump
How can I capture the last N seconds of packets using tcpdump?
- 75
0
votes
0
answers
28
views
File service latency is high, How to troubleshoot?
This service is a file upload service and the request packet capture in the live network is as follows:
The data uploaded by the client is halfway through, and then it will not be sent
The server ...
- 6,799
77
votes
2
answers
37k
views
Does tcpdump bypass iptables?
I mistakenly setup open resolver DNS server, which was soon used for a bunch of DDoS attacks originating somewhere from / to Russia. For that reason I completely blocked port 53 on both DNS servers ...
- 6,799
0
votes
2
answers
211
views
Cannot gather Google PING data with tcpdump command
I am baffled at this point following a Linux course on Udemy.
The command I am using in CentOS7 is:
tcpdump -i enp0s3 | grep 216.25.212.58
216.25.212.58 is the IP that is shown when I use the command:...
- 454k
8
votes
2
answers
4k
views
How many TCP retransmissions Internet traffic is considered normal for a basic home setup?
Out of curiosity, I connected my laptop with an ethernet cable to the router and fired up Wireshark to understand and 'visualize' what's going on.
Some packets caught my attention.
I was having some ...
0
votes
1
answer
251
views
tcpdump shows traffic even for down interface
Using Debian Buster and having configured VLAN interface online, I wonder that tcpdump shows any traffic send to the external IP address?
Having a server on Hetzner and want to configure VLAN traffic ...
- 4,694
2
votes
1
answer
382
views
tcpdump to capture time, URL and post data
I need to capture both the post data and the time the request was made. I want to use it to replay requests on the lab server.
When I run the following command:
tcpdump -i any -s 0 -A '(tcp dst port ...
- 7,766
3
votes
1
answer
200
views
What Does “BBS” in TCPDump Output Mean?
I've recently implemented stricter firewall rules, and I keep seeing the Apple devices on my local network attempt to reach out to 192.168.1.156 or 192.168.1.152. In an attempt to understand what it's ...
- 61
1
vote
1
answer
862
views
How to use ciscodump?
In wireshark, there is this option called Cisco remote capture: ciscodump, which, from my understanding, should enable to do a tcpdump on a cisco router (for example) via SSH and get back the results ...
- 481k
1
vote
1
answer
2k
views
Extract Data from pcap file
Is there any way to extract this data (red box on below image) and save it in a text file in Linux command line? I tried searching on web but couldn't get anything related to my issue. I want to drop ...
- 101
0
votes
1
answer
762
views
tcpdump captured packets not readable
I am new to tcpdump, when I use the following command to capture incoming http packet, I cannot recognize anything readable, such as HTTP, GET, etc. I need to check the header and content part. How to ...
1
vote
0
answers
42
views
Can anyone help me to understand this output from tcpdump?
I wrote a code in python that extracts data from the FTX exchange using their API.
I am running the code in an AWS instance (free plan), located very closeby to the servers of the exchange.
...
- 111
0
votes
0
answers
84
views
Determine/Configure which IP address gets offered next by a DHCP server?
I need a way to determine the next IP address a DHCP server will offer.
RFC 2131 states:
Each server may respond with a DHCPOFFER message that includes an available network address in the 'yiaddr' ...
- 13
0
votes
1
answer
504
views
Extract data from a pcap file
Is there any way to export the data section of all the packets from a pcap file?
For eg: the data section according to the image is ffffffff72636f6e203434207174
I tried searching a lot on web but ...
0
votes
1
answer
106
views
Nobody listens on port, yet something accepts connection on it
Here is some background information first, although it may not be relevant to the problem.
I am learning Kubernetes and I set up a cluster where pi-hole runs as a service. I can access the admin ...
- 11
1
vote
1
answer
648
views
tcpdump missing most packets when -w is used
When I use $ sudo tcpdump -i ens160 I can see a lot of noise in my VM. Like 150 packages in a few seconds. Mostly on port 64651. I don't know what that noise is so I am trying to figure it out.
So I ...
- 454k
2
votes
1
answer
3k
views
What does tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 mean and how do I fix it?
I can't see any other question that asks the same thing as mine. I want to know what tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 means. I received it when ...
- 101
0
votes
1
answer
579
views
Cant capture packets on open wifi Network and only getting Wifi Beacons?
I set up an open WPA2 network and I'm trying to capture traffic on it, so I putted interface on monitor mode and first tried to capture using airodump using this command
sudo airodump-ng -o pcap --...
- 105k
1
vote
1
answer
961
views
tcpdump doesn't capture WiFi-to-WiFi traffic
I have configured a transparent bridge on a network that should capture all the traffic of its connected devices with tcpdump (see diagram 1).
The bridge is configured on a Debian 11 server and has an ...
- 5,936
19
votes
6
answers
67k
views
tcpdump: how to get grepable output?
I am trying to troubleshoot an issue where I only have tcpdump available on an appliance.
I want to use tcpdump to filter web traffic, and only display traffic containing certain strings.
I do the ...
2
votes
1
answer
533
views
Bash and SSH connection hangs after stopping tcpdump on ssh interface
My SSH connection hangs for ever if i stop tcpdump using ctl c or using linux timeout command. The tcpdump is being done on the ssh interface.
timeout 10 tcpdump -i eth0
In other words when using any ...
- 1
0
votes
0
answers
648
views
Capture of packets with tcpdump delayed for seconds until next invocation
I am maintaining a hardware test suite for a 40G network device, and many of our tests consist of sending handcrafted UDP packets from a test host via tcpreplay to our DUT and back to the test host, ...
- 101
0
votes
1
answer
1k
views
I am trying to run the tcpdump on remote machine using ssh using nohup
I am trying to run the tcpdump on remote machine using ssh using nohup.
[support@sv4-haswell107-bqkp91500107-node-1 ~]$ nohup sudo tcpdump -i lo port 2049 -s0 -w ./test.pcap >/dev/null& ...
- 125
0
votes
1
answer
984
views
Ubuntu server wont respond to any requests (ssh, telnet, ping, etc)
I am relatively new to things like this so please bear with me.
OS info:
PC - Arch Linux (5.10.67-1-lts)
RPi - Ubuntu Server (20.04.3 LTS)
About a week ago I set up a small Samba NAS server on a ...
0
votes
1
answer
2k
views
How to replay tcpdump's recorded traffic (.pcap) into my proxy so I could inspect it?
I capture traffic on my local interface with tcpdump (in pcap/pcapng file) and I want to study it using apps like Charles/Fiddler, but then I have to direct it to its proxy somehow.
How can I replay ...
- 4,694
-1
votes
2
answers
147
views
What's wrong with this tcpdump syntax or will it produce different result?
tcpdump -nnvi any port 514 -l | grep -i 'urls,events,flows,ids-alerts'
Will it match ulrs events flows ids-alerts or will consider everything as one word ?
- 454k
0
votes
0
answers
63
views
tcpdump boost upload speed
I have a server running Ubuntu where I installed Plex Media Server. The server has an Armhf processor and 2GB of RAM.
I am having issues with download speed. The server has 250Mbits link and the ...
- 185
1
vote
1
answer
398
views
Troubleshooting outbound internet traffic - Fedora Linux
Without any programs open except an empty terminal window and System Monitor, I'm seeing network traffic. Roughly every 1 second there's a small spike in outbound and a little inbound traffic. $ sudo ...
- 989
1
vote
0
answers
44
views
understand ss -to4 output for a jdbc connection
My application connects to a database over JDBC, and performs a lot of sequential inserts. There is only 1 JDBC connection opened by the application. As the performance is not as expected, I started ...
- 11
0
votes
0
answers
737
views
improve TCPDUMP performance while capturing big amount of traffic
so I'm sending to some machine of mine ~2gbps of small packets (around 3.8 million packets per sec).
the machine have a tcpdump process that writes to a file running continuously without any filters.
...
- 1
1
vote
1
answer
322
views
Ignore outbound conversations in Wireshark/tcpdump
I'm collecting pcap data on servers, and I'd like to only collect packets corresponding to inbound connections. Note that I am not looking to filter to inbound packets, but remove both outbound and ...
- 633
3
votes
2
answers
15k
views
Capture packets on Asus router
I have Asus RT-AC87U router in my home network. I would like to analyse packets on specific ports like Wireshark does. Is it possible to build such system that could make traffic going trough router ...
20
votes
6
answers
107k
views
tcpdump – rotate capture files using -G, -W and -C
I'm looking to be able to capture a rotating tcpdump output which captures 30 minutes worth of data, into 48 files, cyclically.
The man page implies this should be possible, but my testing doesn't ...
- 101
1
vote
1
answer
938
views
How to set filter tcpdump by tcp.len
How can I set a filter with tcpdump to filter tcp.len !=0
in Wireshark . it's easy, but how can I set that filter in tcpdump ?
- 511
3
votes
1
answer
4k
views
have tcpdump show the 'conversation' as i would get from wireshark?
Is it possible to get the same output i would get from:
tcpdump port 80 -w log.pcap
wireshark log.pcap
in wireshark Analyze > Follow TCP Stream and then in the bottom drop down Entire ...
CommunityBot
- 1
3
votes
1
answer
4k
views
Filter tcp packet payload length in tcpdump
The greater filter filters packets by their total length. Is it possible to filter by the payload's length? I know this is possible as a display filter, but I was wondering if it's possible to do this ...
- 5,936
6
votes
1
answer
12k
views
Capture only TCP SYN-ACK packets with tcpdump
I'm trying to capture only TCP SYN-ACK packets, i.e. with both SYN and ACK bits set with:
tcpdump -vvvni eth0 tcp[tcpflags] == tcp-syn and tcp[tcpflags] == tcp-ack
but it gives such error:
tcpdump: ...
- 5,882
1
vote
0
answers
1k
views
Start tcpdump with script on system start
I'm trying to run a script on startup that runs the tcpdump command on Centos 7 and Centos 6.
The aim is to start a rolling pcap when the system starts.
I've tried using a cron with @reboot, but it ...
- 11
0
votes
1
answer
2k
views
How to stream captured packets via UDP? tcpdump or other tool
I want to capture traffic or router and send it to remote host via tzcp or other udp proto.
How to stream captured packets via UDP? tcpdump or other tool
Use case:
Linux box connected to internet ...
- 369
0
votes
1
answer
2k
views
Multiple connections to Plex dlna port 32469
Sorry if this is not in the correct forum.
I have Plex server installed on a Raspberry PI running Raspbian with Open Media Vault. Everything works well.
The only issue I have is that I get lots of ...
CommunityBot
- 1
6
votes
1
answer
39k
views
What does TCP packet [P.] flag means in tcpdump's output?
If an IP x.x.x.x connects to IP z.z.z.z using [P.] Flag for TCP packet what exactly this [P.] flag means? Does it means that x.x.x.x sends some data to z.z.z.z?
- 63.1k
1
vote
1
answer
1k
views
How to find out the PID which generates traffics to port 9229 in MacBook
There are unknown traffics to port 9229 in my MacBook.
$ sudo tcpdump -i any -n port 9229
......
12:10:39.176502 IP6 ::1.62261 > ::1.9229: Flags [S], seq 638850191, win 65535, options [mss 16324,...
- 105k