Questions tagged [tcpdump]

commandline packet analyzer

Filter by
Sorted by
Tagged with
1
vote
1answer
45 views

Filter tcp packet payload length in tcpdump

The greater filter filters packets by their total length. Is it possible to filter by the payload's length? I know this is possible as a display filter, but I was wondering if it's possible to do this ...
0
votes
0answers
22 views

What does tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 mean and how do I fix it?

I can't see any other question that asks the same thing as mine. I want to know what tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 means. I received it when ...
0
votes
0answers
31 views

replay pcap with tcpreplay through internet

I'm trying to replay a PCAP file recorded from my first server online. In order to make some tests, I successfully changed the IP source and destination, mac source and destination. The PCAP file ...
2
votes
1answer
94 views

Capture only TCP SYN-ACK packets with tcpdump

I'm trying to capture only TCP SYN-ACK packets, i.e. with both SYN and ACK bits set with: tcpdump -vvvni eth0 tcp[tcpflags] == tcp-syn and tcp[tcpflags] == tcp-ack but it gives such error: tcpdump: ...
0
votes
0answers
21 views

Why do `tcpdump` and Chrome's network logs disagree? - net::ERR_EMPTY_RESPONSE

I'm trying to diagnose an issue where we occasionally see fetch requests to an internal service fail with a net::ERR_EMPTY_RESPONSE error in Chrome. I have recorded both a packet capture with ...
0
votes
0answers
27 views

Start tcpdump with script on system start

I'm trying to run a script on startup that runs the tcpdump command on Centos 7 and Centos 6. The aim is to start a rolling pcap when the system starts. I've tried using a cron with @reboot, but it ...
0
votes
0answers
33 views

Routing ports 80 443 traffic from Anbox LXC container to the proxy on Localhost

I want to route all packets heading for ports 80 and 443 to the privoxy running on my machine on its default port 8118. These are the interfaces on Kali rolling host $ ifconfig anbox0: flags=4163&...
1
vote
1answer
480 views

Capture packets on Asus router

I have Asus RT-AC87U router in my home network. I would like to analyse packets on specific ports like Wireshark does. Is it possible to build such system that could make traffic going trough router ...
0
votes
1answer
128 views

How can I display wireless client mac addresses with tcpdump?

If using tcpdump to monitor a wireless interface and listen on a specific channel for traffic associated with a BSSID, how can I display information (e.g. mac address) about any connected clients? ...
0
votes
0answers
173 views

Packet Sniffing on wlan0 is saying 0 packets captured

I am trying to practice some packet sniffing on my virtual machine using tcpdump and writing it to a pcap file. I put wlan0 into monitor mode using these commands: ifconfig wlan0 down iwconfig wlan0 ...
0
votes
1answer
108 views

What are these expressions' meanings? ip[2:2] ,ip[0], tcp[12], ip[16]

I am learning tcpdump recently, but I have some troubles now. I have already search them in google and there is nothing can help me solve my problem. If you know the answer, please help me. Thank you ...
0
votes
0answers
36 views

How to filter and write tcpdump data into a textfile

I have an Old pcapng file and need to produce a text file consisting of three columns, the first showing flow ID (IP addresses and port numbers), the second showing time in seconds+milliseconds and ...
2
votes
1answer
228 views

tcpdump says “expression rejects all packets”

I want to create a filter which has 2 conditions:- Filter packets with network. (src net 2a01:111:xxxx::/44) Filter based on tcp handshake alert messages. (tcp[((tcp[12] & 0xf0) >> 2)] = ...
0
votes
0answers
32 views

Is it possible to sniff input traffic after iptables

Normally, tshark sniff traffic like this : before iptables for input traffic after iptables for output traffic is it possible to sniff the traffic ? after iptables for input traffic before iptables ...
1
vote
1answer
50 views

tcpdump: “packet exceeded snapshot”

I am using tcpdump to look into some pcap files, but in the output, I see the following error, instead of getting the header information: packet exceeded snapshot I googled it, but I couldn't find ...
0
votes
0answers
27 views

tcpdump ends output with “[!http]”. What does it mean?

When "tcpdump -v" parses http replies, it prints the expected content followed by "[!http]". I don't see such substring in the manpage and web search engines seem incapable of searching for this ...
0
votes
1answer
435 views

Why server doesn't stop sending packets when client sends TCP RST multiple times?

My device connects to the server which provides some video clips. After connecting to the server, I check the wireshark and see there're multiple RST from client(port 40334) to server(80), but the ...
0
votes
0answers
38 views

Ubuntu 18.04: the first HTTP(s) request times out. tspdump log attached

The timeout issue happens with the first request only. The second similar GET request is successful. After some time of inactivity (around 10 minutes), the problem repeats. From tcpdump output i see ...
0
votes
0answers
17 views

Slow Response - host send a ACK packet slowly than usual

I study the Behavior TCP and did a small experiment about TCP. In the experiment, [10.0.0.1] host send a TCP flow to [10.0.0.2] host. I found that a re-transmission occur. To find the cause, I used ...
1
vote
0answers
66 views

tcpdump doesn't capture DHCP Discovery

I tried to capture DHCP Discovery through the tcpdump: # ip l | grep enp5s0 3: enp5s0: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 # tcpdump -ni ...
0
votes
0answers
39 views

How to see the statistics of GET and POST connections from a PCAP dump?

I have a .pcap file generated though a tcpdump -w file.pcap. I can open it in Wireshark and would like to use the statistics feature to see how many HTTP requests (GET and POST). When going into the ...
2
votes
1answer
4k views

What does TCP packet [P.] flag means in tcpdump's output?

If an IP x.x.x.x connects to IP z.z.z.z using [P.] Flag for TCP packet what exactly this [P.] flag means? Does it means that x.x.x.x sends some data to z.z.z.z?
0
votes
1answer
254 views

How to stream captured packets via UDP? tcpdump or other tool

I want to capture traffic or router and send it to remote host via tzcp or other udp proto. How to stream captured packets via UDP? tcpdump or other tool Use case: Linux box connected to internet ...
0
votes
0answers
2k views

tcpdump socket type not supported

I'm having some trouble with tcpdump in Ubuntu. I have installed Wireshark and tcpdump with no problems and can't seem to capture traffic.
1
vote
0answers
242 views

WiFi stops working when I run tcpdump on wlp2s0

Very strange thing is happening to me, as soon as I run a simple: $ sudo tcpdump -c 10 -i wlp2s0 port 22 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ...
2
votes
1answer
501 views

command line plink remote target capture traffic via jumphost [duplicate]

I am trying to capture remote host traffic via jumphost from a Windows machine and display in Wireshark. When PUTTY GUI is used and configured as below Created and saved SSH session (bastion-host) ...
1
vote
1answer
3k views

Filtering TCPDUMP over packet length

I am looking to narrow down my tcpdump by packet length. I know I can `| grep but I was wondering if I can pass this particular packet length as an option in 'tcpdump'. I am trying to write a script ...
0
votes
1answer
123 views

How to block a pcap pumped by tcpreplay from one server by iptables on the other?

I am new to stack exchange. What I am trying is: I am pumping traffic from one server by the following command: tcpreplay -i ens3 ~/daniel/sipdump.pcap from server 1 And I am capturing the traffic in ...
0
votes
0answers
144 views

tcpdump on openwrt does not output anything

I installed openwrt on my router and I'm looking for a way to use tcpdump properly. My internal IP address is 192.168.1.10. Running tcpdump -i any -l -vvv src 192.168.1.10 and dst not 192.168.1.1 ...
0
votes
1answer
88 views

tcpdump: (all BPF devices are busy) - How to solve this

I was running tcpdump and then after some time I got this error: tcpdump: (all BPF devices are busy) I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
0
votes
1answer
349 views

remote ssh tcpdump command, through a gateway, to be opened, in realtime, in Wireshark, on local machine

I (Host A - Windows based using plink) am trying to connect to a remote linux server (Host C), through a gateway linux server (Host B), and run this tcpdump on Host C to be piped all the way back to ...
1
vote
1answer
2k views

tcpdump read both ipv4 and ipv6 packets from pcap

I'm trying to gain some info from payload of TCP and UDP. The filter (tcp.stream && tcp.flags.push == 1) || udp.stream in Wireshark gives me both IPv4 and IPv6 packets. But I can't figure ...
0
votes
0answers
107 views

Linux Terminal: traffic volume on IP xxxx.xxxx.xxxx.xxxx

I have a client and a server. When I click something in the GUI on the client computer, I want to know how much data (MB) the server is sending to the client. How do I measure that? I cannot install ...
2
votes
1answer
87 views

Why do I see Ethernet frames that exceed the MTU+Ethernet header size?

I have a consumer-grade Wi-Fi router that hosts a local network. The router is connected to the Internet through a campus network (i.e., an Ethernet cable connects the WAN port to a campus Ethernet ...
0
votes
0answers
23 views

How to see real destination IP using tcpdump? [duplicate]

I'm a newbie with tcpdump. My setup is simple: 1 machine A behind a router B 1 machine C outside, on the Internet On machine A, I ping machine C, and I want to track what's happening with tcpdump: ...
2
votes
1answer
239 views

Why does traceroute increment the destination port by 1 for each probe it sends?

I captured the packets sent by Traceroute using Tcpdump. Here is the screenshot Tcpdump below. Why does traceroute increment the destination port by 1 for each probe it sends?
1
vote
1answer
578 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
0
votes
1answer
295 views

Add .pcap ending to all files created with tcpdump

I'm using tcpdump for a rotating network traffic capture, and Moloch as a nice viewer for the data. The problem is that tcpdump appends a number to the end of the filename, while Moloch only uses ...
0
votes
1answer
809 views

How do I read output from tcpdump as quickly as it prints it to the terminal?

When running tcpdump on the command line, packets appear in realtime as they are received. However, when tcpdump is piped into anything, it resorts to buffered output. The -l and -U options are ...
1
vote
1answer
231 views

No outgoing tcp request for DHCPDISCOVER

I have been trying to figure out issues with my wifi setup on my laptop with ubuntu 16.04. For some reason it doesn't seem to connect. Have tried with wicd, network-manager as well as ifconfig. On ...
0
votes
1answer
613 views

tcp session - http request [ x out of y] in wireshark capture

As below, i am seeing this [HTTP request 1/2] and [HTTP request 2/2] in 2 separate payload, are they separate GET request in a single tcp session or are they the same GET request ??? ==== Added full ...
0
votes
0answers
2k views

How to make tcpdump display only source IP, destination IP, ports and timestamps

I am running tcpdump to track traffic on 2 interfaces, one input and one output. The sole purpose is to measure the latency between the time when the input interface receives incoming TCP traffic and ...
0
votes
1answer
1k views

Tcpdump: get the flags of a fragmented packet

How does one distinguish a fragmented SYN packet from a fragmented FIN packet using tcpdump? Bar is running tcpdump -vvv. Foo scans Bar starting with a fragmented SYN Packet nmap -sS -f -p22 bar. ...
0
votes
2answers
632 views

Report tcpdump progress?

I run tcpdump as follows: $ sudo tcpdump -i eth0 -w dump.pcap host 1.2.3.4 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes Is there a way to see how many packets ...
3
votes
1answer
488 views

ipkg can't install tcpdump

I have the new Asus Blue Cave router with a USB drive mounted at /mnt/DRIVE. I installed ipkg via a GUI-based install of their Download Manager. I am trying to ipkg install tcpdump. I have mount -o ...
0
votes
1answer
3k views

Snort finding the alert file DATA with snort.logs.xxxxxxx

I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
2
votes
0answers
271 views

How does tcpdump configure an interface it begins to capture packets from?

On an Arago embedded linux system, an interface would normally be able to ping other destinations on the network. However, the pings stop working when using a utility such as iperf or scp to send TCP ...
1
vote
1answer
58 views

can only ssh unidirectional

I have two centos 7.2 server. One machine ip is 10.104.196.18, another machine is 10.240.197.21. I can successfully ssh from 10.104.196.18 to 10.240.197.21. But failed to ssh into 10.104.196.18 from ...
9
votes
2answers
2k views

How to measure data sent when I have a dump file created by tcpdump

I dumped a network traffic with the following command: tcpdump -w myfile.dump Now I want to know how much data was transmitted. I guess the file size does not equal the size of data transferred, ...
0
votes
1answer
68 views

What should I submit to my ISP for faster fix

I'm having a hard time using my Internet lately, I'm wondering what kind of data collection / diagnostic of my network should I do before calling tech support. I'm doing a video capture of 'ping' ...