Questions tagged [tcpdump]

commandline packet analyzer

Filter by
Sorted by
Tagged with
0 votes
1 answer
44 views

Nobody listens on port, yet something accepts connection on it

Here is some background information first, although it may not be relevant to the problem. I am learning Kubernetes and I set up a cluster where pi-hole runs as a service. I can access the admin ...
user avatar
  • 11
0 votes
0 answers
57 views

Extract Data from pcap file

Is there any way to extract this data (red box on below image) and save it in a text file in Linux command line? I tried searching on web but couldn't get anything related to my issue. I want to drop ...
user avatar
  • 17
1 vote
1 answer
24 views

tcpdump missing most packets when -w is used

When I use $ sudo tcpdump -i ens160 I can see a lot of noise in my VM. Like 150 packages in a few seconds. Mostly on port 64651. I don't know what that noise is so I am trying to figure it out. So I ...
user avatar
  • 11
0 votes
0 answers
21 views

Why did tcpdump output differs for arp requests?

There are two ARP requests, first one is from gateway and second from pc in same network. Traffic is captured by tcpdump -nn -e -i enp1s0 arp. The gateway make requests automatically, the pc uses ncat ...
user avatar
0 votes
0 answers
127 views

tcpdump capture every hour and delete previous dumps after 1 day

I am trying to troubleshoot my network and I want to capture tcpdumps every hour for a day and the next day the dumps should be replaced by that days dumps. I tried using the following tcpdump -i any -...
user avatar
0 votes
1 answer
53 views

Cant capture packets on open wifi Network and only getting Wifi Beacons?

I set up an open WPA2 network and I'm trying to capture traffic on it, so I putted interface on monitor mode and first tried to capture using airodump using this command sudo airodump-ng -o pcap --...
user avatar
  • 113
1 vote
1 answer
156 views

tcpdump doesn't capture WiFi-to-WiFi traffic

I have configured a transparent bridge on a network that should capture all the traffic of its connected devices with tcpdump (see diagram 1). The bridge is configured on a Debian 11 server and has an ...
user avatar
  • 13
2 votes
1 answer
145 views

Bash and SSH connection hangs after stopping tcpdump on ssh interface

My SSH connection hangs for ever if i stop tcpdump using ctl c or using linux timeout command. The tcpdump is being done on the ssh interface. timeout 10 tcpdump -i eth0 In other words when using any ...
user avatar
  • 71
0 votes
0 answers
32 views

Why I can't detect traffic with TCPDump on host that receive through port mirroring

I can try to detect the traffic with tcpdump on host described in subject. with the #tcpdump -i any I can't view the traffic from span port. I think that the cause of this behaviour is the traffic was ...
user avatar
0 votes
0 answers
148 views

Capture of packets with tcpdump delayed for seconds until next invocation

I am maintaining a hardware test suite for a 40G network device, and many of our tests consist of sending handcrafted UDP packets from a test host via tcpreplay to our DUT and back to the test host, ...
user avatar
  • 101
0 votes
1 answer
232 views

I am trying to run the tcpdump on remote machine using ssh using nohup

I am trying to run the tcpdump on remote machine using ssh using nohup. [support@sv4-haswell107-bqkp91500107-node-1 ~]$ nohup sudo tcpdump -i lo port 2049 -s0 -w ./test.pcap >/dev/null& ...
user avatar
0 votes
1 answer
133 views

Ubuntu server wont respond to any requests (ssh, telnet, ping, etc)

I am relatively new to things like this so please bear with me. OS info: PC - Arch Linux (5.10.67-1-lts) RPi - Ubuntu Server (20.04.3 LTS) About a week ago I set up a small Samba NAS server on a ...
user avatar
0 votes
1 answer
122 views

How to replay tcpdump's recorded traffic (.pcap) into my proxy so I could inspect it?

I capture traffic on my local interface with tcpdump (in pcap/pcapng file) and I want to study it using apps like Charles/Fiddler, but then I have to direct it to its proxy somehow. How can I replay ...
user avatar
0 votes
0 answers
86 views

NFTables: outgoing packages with internal IP despite of NAT?

I'm running a linux machine as firewall/router/gateway which uses nftables with the following rule for outgoing IPv4 packages (mostly copied from the "Basic NAT" example in the Gentoo Wiki): ...
user avatar
  • 624
-1 votes
2 answers
33 views

What's wrong with this tcpdump syntax or will it produce different result?

tcpdump -nnvi any port 514 -l | grep -i 'urls,events,flows,ids-alerts' Will it match ulrs events flows ids-alerts or will consider everything as one word ?
user avatar
0 votes
0 answers
29 views

tcpdump boost upload speed

I have a server running Ubuntu where I installed Plex Media Server. The server has an Armhf processor and 2GB of RAM. I am having issues with download speed. The server has 250Mbits link and the ...
user avatar
  • 185
1 vote
1 answer
73 views

Troubleshooting outbound internet traffic - Fedora Linux

Without any programs open except an empty terminal window and System Monitor, I'm seeing network traffic. Roughly every 1 second there's a small spike in outbound and a little inbound traffic. $ sudo ...
user avatar
  • 125
1 vote
0 answers
31 views

understand ss -to4 output for a jdbc connection

My application connects to a database over JDBC, and performs a lot of sequential inserts. There is only 1 JDBC connection opened by the application. As the performance is not as expected, I started ...
user avatar
0 votes
0 answers
325 views

improve TCPDUMP performance while capturing big amount of traffic

so I'm sending to some machine of mine ~2gbps of small packets (around 3.8 million packets per sec). the machine have a tcpdump process that writes to a file running continuously without any filters. ...
user avatar
1 vote
1 answer
216 views

Ignore outbound conversations in Wireshark/tcpdump

I'm collecting pcap data on servers, and I'd like to only collect packets corresponding to inbound connections. Note that I am not looking to filter to inbound packets, but remove both outbound and ...
user avatar
0 votes
1 answer
227 views

How to set filter tcpdump by tcp.len

How can I set a filter with tcpdump to filter tcp.len !=0 in Wireshark . it's easy, but how can I set that filter in tcpdump ?
user avatar
  • 1
2 votes
1 answer
3k views

Filter tcp packet payload length in tcpdump

The greater filter filters packets by their total length. Is it possible to filter by the payload's length? I know this is possible as a display filter, but I was wondering if it's possible to do this ...
user avatar
1 vote
1 answer
994 views

What does tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 mean and how do I fix it?

I can't see any other question that asks the same thing as mine. I want to know what tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 means. I received it when ...
user avatar
  • 321
2 votes
1 answer
6k views

Capture only TCP SYN-ACK packets with tcpdump

I'm trying to capture only TCP SYN-ACK packets, i.e. with both SYN and ACK bits set with: tcpdump -vvvni eth0 tcp[tcpflags] == tcp-syn and tcp[tcpflags] == tcp-ack but it gives such error: tcpdump: ...
user avatar
  • 174
1 vote
0 answers
558 views

Start tcpdump with script on system start

I'm trying to run a script on startup that runs the tcpdump command on Centos 7 and Centos 6. The aim is to start a rolling pcap when the system starts. I've tried using a cron with @reboot, but it ...
user avatar
2 votes
2 answers
8k views

Capture packets on Asus router

I have Asus RT-AC87U router in my home network. I would like to analyse packets on specific ports like Wireshark does. Is it possible to build such system that could make traffic going trough router ...
user avatar
  • 2,089
0 votes
1 answer
574 views

How can I display wireless client mac addresses with tcpdump?

If using tcpdump to monitor a wireless interface and listen on a specific channel for traffic associated with a BSSID, how can I display information (e.g. mac address) about any connected clients? ...
user avatar
0 votes
0 answers
286 views

Packet Sniffing on wlan0 is saying 0 packets captured

I am trying to practice some packet sniffing on my virtual machine using tcpdump and writing it to a pcap file. I put wlan0 into monitor mode using these commands: ifconfig wlan0 down iwconfig wlan0 ...
user avatar
0 votes
1 answer
171 views

What are these expressions' meanings? ip[2:2] ,ip[0], tcp[12], ip[16]

I am learning tcpdump recently, but I have some troubles now. I have already search them in google and there is nothing can help me solve my problem. If you know the answer, please help me. Thank you ...
user avatar
2 votes
1 answer
2k views

tcpdump says "expression rejects all packets"

I want to create a filter which has 2 conditions:- Filter packets with network. (src net 2a01:111:xxxx::/44) Filter based on tcp handshake alert messages. (tcp[((tcp[12] & 0xf0) >> 2)] = ...
user avatar
1 vote
1 answer
157 views

tcpdump: "packet exceeded snapshot"

I am using tcpdump to look into some pcap files, but in the output, I see the following error, instead of getting the header information: packet exceeded snapshot I googled it, but I couldn't find ...
user avatar
  • 121
0 votes
1 answer
1k views

Why server doesn't stop sending packets when client sends TCP RST multiple times?

My device connects to the server which provides some video clips. After connecting to the server, I check the wireshark and see there're multiple RST from client(port 40334) to server(80), but the ...
user avatar
1 vote
0 answers
97 views

tcpdump doesn't capture DHCP Discovery

I tried to capture DHCP Discovery through the tcpdump: # ip l | grep enp5s0 3: enp5s0: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 # tcpdump -ni ...
user avatar
  • 174
5 votes
1 answer
21k views

What does TCP packet [P.] flag means in tcpdump's output?

If an IP x.x.x.x connects to IP z.z.z.z using [P.] Flag for TCP packet what exactly this [P.] flag means? Does it means that x.x.x.x sends some data to z.z.z.z?
user avatar
  • 73
0 votes
1 answer
1k views

How to stream captured packets via UDP? tcpdump or other tool

I want to capture traffic or router and send it to remote host via tzcp or other udp proto. How to stream captured packets via UDP? tcpdump or other tool Use case: Linux box connected to internet ...
user avatar
  • 309
0 votes
0 answers
4k views

tcpdump socket type not supported

I'm having some trouble with tcpdump in Ubuntu. I have installed Wireshark and tcpdump with no problems and can't seem to capture traffic.
user avatar
  • 1
1 vote
0 answers
254 views

WiFi stops working when I run tcpdump on wlp2s0

Very strange thing is happening to me, as soon as I run a simple: $ sudo tcpdump -c 10 -i wlp2s0 port 22 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ...
user avatar
  • 11
2 votes
1 answer
1k views

command line plink remote target capture traffic via jumphost [duplicate]

I am trying to capture remote host traffic via jumphost from a Windows machine and display in Wireshark. When PUTTY GUI is used and configured as below Created and saved SSH session (bastion-host) ...
user avatar
  • 43
2 votes
1 answer
12k views

Filtering TCPDUMP over packet length

I am looking to narrow down my tcpdump by packet length. I know I can `| grep but I was wondering if I can pass this particular packet length as an option in 'tcpdump'. I am trying to write a script ...
user avatar
0 votes
1 answer
277 views

How to block a pcap pumped by tcpreplay from one server by iptables on the other?

I am new to stack exchange. What I am trying is: I am pumping traffic from one server by the following command: tcpreplay -i ens3 ~/daniel/sipdump.pcap from server 1 And I am capturing the traffic in ...
user avatar
0 votes
1 answer
189 views

tcpdump: (all BPF devices are busy) - How to solve this

I was running tcpdump and then after some time I got this error: tcpdump: (all BPF devices are busy) I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
user avatar
0 votes
1 answer
605 views

remote ssh tcpdump command, through a gateway, to be opened, in realtime, in Wireshark, on local machine

I (Host A - Windows based using plink) am trying to connect to a remote linux server (Host C), through a gateway linux server (Host B), and run this tcpdump on Host C to be piped all the way back to ...
user avatar
1 vote
1 answer
7k views

tcpdump read both ipv4 and ipv6 packets from pcap

I'm trying to gain some info from payload of TCP and UDP. The filter (tcp.stream && tcp.flags.push == 1) || udp.stream in Wireshark gives me both IPv4 and IPv6 packets. But I can't figure ...
user avatar
  • 127
0 votes
0 answers
130 views

Linux Terminal: traffic volume on IP xxxx.xxxx.xxxx.xxxx

I have a client and a server. When I click something in the GUI on the client computer, I want to know how much data (MB) the server is sending to the client. How do I measure that? I cannot install ...
user avatar
  • 139
2 votes
1 answer
124 views

Why do I see Ethernet frames that exceed the MTU+Ethernet header size?

I have a consumer-grade Wi-Fi router that hosts a local network. The router is connected to the Internet through a campus network (i.e., an Ethernet cable connects the WAN port to a campus Ethernet ...
user avatar
0 votes
0 answers
28 views

How to see real destination IP using tcpdump? [duplicate]

I'm a newbie with tcpdump. My setup is simple: 1 machine A behind a router B 1 machine C outside, on the Internet On machine A, I ping machine C, and I want to track what's happening with tcpdump: ...
user avatar
  • 103
2 votes
1 answer
593 views

Why does traceroute increment the destination port by 1 for each probe it sends?

I captured the packets sent by Traceroute using Tcpdump. Here is the screenshot Tcpdump below. Why does traceroute increment the destination port by 1 for each probe it sends?
user avatar
1 vote
1 answer
833 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
user avatar
0 votes
1 answer
533 views

Add .pcap ending to all files created with tcpdump

I'm using tcpdump for a rotating network traffic capture, and Moloch as a nice viewer for the data. The problem is that tcpdump appends a number to the end of the filename, while Moloch only uses ...
user avatar
0 votes
1 answer
1k views

How do I read output from tcpdump as quickly as it prints it to the terminal?

When running tcpdump on the command line, packets appear in realtime as they are received. However, when tcpdump is piped into anything, it resorts to buffered output. The -l and -U options are ...
user avatar