1

I'm not very experience with networking, so on my free time, I usually try and learn some more things about the internet and how it works. While at school, I came across tcpdump and wanted to give it a try (I had experience with wireshark). The first things that come cranking out of it was similar to this line:

20:18:41.526871 IP Isaac-PC.39861 > 63-146-70-65.dia.static.qwest.net.http: Flags [.], ack 1449, win 137, options [nop,nop,TS val 4121497 ecr 3242277283], length 0

Note that this was taken at home, at school the string after Isaac-PC was much, MUCH longer.

My question is what is that whole 63-146-70-65.dia.static.qwest.net.http line represent? Why is it there, and not an ip address? What am I missing here?

Improve this question

1 Answer 1

Reset to default
1

tcpdump doesn't use colons to separate the address/hostname from the port, rather it just uses a period. So the answer to your question is 63-146-70-65.dia.static.qwest.net is the hostname, and http is the port (port 80).

So the TCP packet being displayed is being sent from host Isaac-PC and source port 39861 to 63-146-70-65.dia.static.qwest.net on destination port 80.

If you don't want tcpdump to convert addresses and port numbers to name, run it with the argument -n.

Improve this answer
2
  • Okay, that makes sense, but why is the hostname so HUGE? Even when going on this site, tcpdump is giving me some big thing.
    – ILikePizza555
    Mar 8, 2013 at 4:42
  • That depends on what host you are communicating with. This looks like you are sending packets to a consumer using quest as their ISP. Since consumer connections aren't suppose to host servers, ISPs don't care how long or big those hostnames are and generally just derive them from the IP address as you can see.
    – Fred Thomsen
    Mar 8, 2013 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.