commandline packet analyzer

learn more… | top users | synonyms

0
votes
1answer
14 views

What's the purpose of the -interface option in tcpdump?

doing the following command: tcpdump -i eth0:cp5 shows exactly the same thing as the default ... tcpdump what's the purpose of allowing user to specify interfaces?
0
votes
0answers
11 views

tcpdump doesn't captures properly on specific port

I'm in a network and I want to capture FTP packets from another server in the network but I have a problem with tcpdump about this. I've used this command, where X.X.X.X is the FTP server: tcpdump -...
0
votes
1answer
42 views

Can't connect local server by public domain name

I have my server (Debian Wheezy) in my local home network. On that server I have my own DNS server (dnsmasq) for other local servers (so I can type name instead of local IP) and reverse proxy (nginx). ...
1
vote
2answers
26 views

tcpdump is not capturing packets

Can anybody tell me what kind of error I have in this? It isn't reading any packets when I run it. nohup sudo tcpdump -i any host 10.0.1.107 and port 5060 and port 6060 -G 010 -W 015 -w capture_%Y-%m-...
0
votes
1answer
23 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
0answers
13 views

how to capture a certain http code responce with tcpdump

I want to capture http errors on openwrt. ngrep utility would be very useful but is not available there also tshark is not available also. so it leaves me with tcpdump. how do I tell tcpdump to ...
1
vote
1answer
28 views

How many ARP Request/Reply for Ping command to work

I would like know how many ARP Request/Reply are required for ping command to get work ? Let's say we have two machines connected point to point with ip's 192.168.110.2 and 192.168.110.3 and executes ...
0
votes
0answers
986 views

Multiple connections to Plex dlna port 32469

Sorry if this is not in the correct forum. I have Plex server installed on a Raspberry PI running Raspbian with Open Media Vault. Everything works well. The only issue I have is that I get lots of ...
1
vote
1answer
840 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
9
votes
2answers
6k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
4
votes
3answers
4k views

tcpdump: how to get grepable output?

I am trying to troubleshoot an issue where I only have tcpdump available on an appliance. I want to use tcpdump to filter web traffic, and only display traffic containing certain strings. I do the ...
0
votes
0answers
138 views

Log to file WSS Websocket packet traffic

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-...
0
votes
0answers
15 views

How do I find out to what hostname a potential malware wants to connect?

Without connecting my computer to Internet. I can only think about netstat and packet capturing tools, but I dont really know which method is suitable.
0
votes
0answers
56 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
2
votes
1answer
3k views

tcpdump - rotate capture files using -G -W and -C

I'm looking to be able to capture a rotating tcpdump output which captures 30-minutes worth of data, into 48 files, cyclically. The man implies this should be possible, but my testing doesn't seem to ...
1
vote
1answer
111 views

Wireless packet sniffing on Linux. Captured data is almost only broadcasts

Environment: Home network that operates on channel 8 (I am the admin so all the passwords are known and I have physical access to all devices), with a PC and a laptop connected to it (both standing ...
1
vote
1answer
1k views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
0
votes
0answers
20 views

How can I capture a list of all servers my computer connects to?

I'd like to capture, in real-time, a list of all servers (URL preferred, IP address ok) my computer connects to. I've used tshark and tcpdump, but they return different results. This makes me wonder ...
1
vote
1answer
59 views

What is a cache flush, and how do you explain this TCPdump pattern?

I ran TCPdump a few times on my home network and found a lot of packets that were marked (Cache Flush), seemingly originating with my sister's laptop. I can't see any HTTP or HTTPS packets during the ...
9
votes
4answers
19k views

how to make tcpdump to display ip and port number but not hostname and protocol

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like IP pl1snu.koren.kr.http > kitch.pl.sophia.inria.fr.dnp: Flags [P.], seq 54:72, ack 1, win ...
9
votes
2answers
102k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
0
votes
2answers
193 views

Capturing incoming UDP packet fails

My Environment: Mac OS X 10.8.5 (IP: 192.168.10.5) CentOS 6.5 (IP: 192.168.10.8) I'm trying to capture UDP incoming packet on OS X. I tried on the Terminal of OS X # tcpdump -In udp portrange ...
0
votes
0answers
34 views

TCP Dump received from Verizon, along with an abuse notice

Apologies in advance if this Question is not a good fit for your forum, but I hope it is and someone can help. I'm a FIOS customer and received from "abuse@verizon.net" a TCP dump as part of an email ...
0
votes
1answer
78 views

how to use tcpdump to capture LAN packets which are not from or destined to my PC?

I'm using wifi for network access. I'm doing an experiment with my smartphone to do some experiment and I want to capture packets which are from my smartphone. My idea is to use my laptop with tcpdump ...
0
votes
0answers
121 views

How to capture packets of rysnc using tcpdump

I am trying to do rysnc a 4G file to another directory and want to capture rsync packets using tcpdump. I tried listning to port 873 which is used for rsync but did not find anything captured. I ...
1
vote
0answers
250 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
1
vote
1answer
622 views

Check for packets MARKed by iptables

I am marking TCP and UDP packets in order to send them to two different interfaces (say wlan0 and eth0), I did this by following this answer. Assuming this configuration: eth0 address: 192.168.0.84 ...
0
votes
1answer
56 views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump -...
1
vote
1answer
297 views

how to capture “DROP”ped packets on OUTPUT of iptables?

having a fairly complex OUTPUT processing on iptables, how does one go about capturing / displaying (at least similarly to how tcpdump captures them) the packets that were to leave through an ...
0
votes
1answer
78 views

Yosemite Run Command on Boot as Root without Password

I run OS X Yosemite and I would like to always have the command run, as root, on startup: tcpdump -i en0 'icmp and icmp[icmptype]=icmp-echo' >> /var/vtcakavsmoace/Desktop/ping_information.txt ...
0
votes
2answers
2k views

tcpdump not capturing any packets

I'm trying to monitor what's going on in my network, so I've tried tcpdump command. I'm just learning to use it, so I thought on playing around a little bit with it. My problem is that I cannot ...
0
votes
0answers
85 views

Review RDP Session from TCPDump

Is it possible to visualize a RDP-Session (ie. convert to video) if you have the tcpdump (containing the entire session) and all involved cryptographic keys (client and server)?
0
votes
1answer
31 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
94 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
1
vote
0answers
162 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
2answers
353 views

How to find IP address of ADSL modem?

Our fall back Internet connection uses a SpeedStream 4100 modem, which just broke, so I have replaced it with a new one. I need to configure it to bridge mode, but I can't even find its IP address. ...
1
vote
1answer
89 views

Unable to see broadcast packets with tcpdump

I am launching an application which broadcasts udp packets. I also have a simple python script to confirm that these packets are being broadcast: sock = socket.socket(socket.AF_INET, socket....
0
votes
1answer
83 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
0
votes
0answers
99 views

UDP traceroute delay?

We are seeing timeout packages when running traceroute command between two Linux systems on a private network. However, we do not see such symptoms using TCP or ICMP over traceroute. This is a private ...
1
vote
0answers
62 views

ICMP flood with ping working only one time

my problem is simple: The first time I made a flooding ping to a fake ip on my network (for testing if someone is on promisc mode), it works perfectly: $ping -f 192.168.1.10 After perfoming this, ...
0
votes
1answer
784 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 -...
4
votes
0answers
256 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
2answers
215 views

Decompress logged GZIP binary data

In an effort to verify my app was sending back and forth with my server correctly, I had run tcpdump -w ~/capture.txt -s 0 port 80 on a server with proxy sitting in between to capture all requests....
0
votes
1answer
421 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
2
votes
1answer
228 views

what does `tcpdump -xx` do in Mac OS X?

I was playing with tcpdump, and I noticed that, on OS X, the -xx option does something that is different to what the man page describes. Here is what the man page says: -x When parsing and ...
1
vote
0answers
106 views

How do I troubleshoot if I see the incoming packet in tcpdump, but not at the socket?

For example, I see that the incoming packet in tcpdump, but not in strace for the program that is listening the appopriate socket. How do I trace the "fate" of this incoming packet on Linux? I ...
6
votes
4answers
9k views

How to capture last N seconds of packets using tcpdump

How can I capture the last N seconds of packets using tcpdump?
1
vote
1answer
8k views

How do I make tcpdump to write to file for each packet it captures?

I'm running the following version of tcpdump: tcpdump version 4.0.0 libpcap version 1.0.0 I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the ...
0
votes
0answers
32 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...