People who code: we want your input. Take the Survey

Questions tagged [tcpdump]

commandline packet analyzer

Filter by
Sorted by
Tagged with
0
votes
0answers
52 views

security - Linux, remote connection program as a backdoor, tcpdump

Recently I saw that 'upload' shows anomalies. I read a bit why I may have a big upload, and I found set of nettools, specifically: tcpdump (What do you do if you are being hacked by something coming ...
1
vote
1answer
29 views

Troubleshooting outbound internet traffic - Fedora Linux

Without any programs open except an empty terminal window and System Monitor, I'm seeing network traffic. Roughly every 1 second there's a small spike in outbound and a little inbound traffic. $ sudo ...
0
votes
0answers
27 views

How to dynamically change the filter conditions of the tcpdump process

The scene is like this, I have a background process here to capture packets 7*24 nohup tcpdump -i p2p1 port 1111 or 2222 -s 0 -G 600 -w'Server01_%Y%m%d_%H%M%S.pcap' & But sometimes, the filter ...
1
vote
0answers
21 views

understand ss -to4 output for a jdbc connection

My application connects to a database over JDBC, and performs a lot of sequential inserts. There is only 1 JDBC connection opened by the application. As the performance is not as expected, I started ...
0
votes
0answers
132 views

improve TCPDUMP performance while capturing big amount of traffic

so I'm sending to some machine of mine ~2gbps of small packets (around 3.8 million packets per sec). the machine have a tcpdump process that writes to a file running continuously without any filters. ...
1
vote
1answer
141 views

Ignore outbound conversations in Wireshark/tcpdump

I'm collecting pcap data on servers, and I'd like to only collect packets corresponding to inbound connections. Note that I am not looking to filter to inbound packets, but remove both outbound and ...
0
votes
0answers
32 views

SPA122 issuing TCP RST every 14 minutes

I've got a SPA112 behind a firewall connecting to voip.ms. Every few minutes (looks like it happens every 14 minutes) the SIP connection gets interrupted. After getting a packet capture during the SIP ...
0
votes
1answer
67 views

How to set filter tcpdump by tcp.len

How can I set a filter with tcpdump to filter tcp.len !=0 in Wireshark . it's easy, but how can I set that filter in tcpdump ?
2
votes
1answer
2k views

Filter tcp packet payload length in tcpdump

The greater filter filters packets by their total length. Is it possible to filter by the payload's length? I know this is possible as a display filter, but I was wondering if it's possible to do this ...
1
vote
0answers
530 views

What does tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 mean and how do I fix it?

I can't see any other question that asks the same thing as mine. I want to know what tcpdump: pcap_loop: truncated dump file; tried to read 1899 captured bytes, only got 1880 means. I received it when ...
2
votes
1answer
4k views

Capture only TCP SYN-ACK packets with tcpdump

I'm trying to capture only TCP SYN-ACK packets, i.e. with both SYN and ACK bits set with: tcpdump -vvvni eth0 tcp[tcpflags] == tcp-syn and tcp[tcpflags] == tcp-ack but it gives such error: tcpdump: ...
1
vote
0answers
335 views

Start tcpdump with script on system start

I'm trying to run a script on startup that runs the tcpdump command on Centos 7 and Centos 6. The aim is to start a rolling pcap when the system starts. I've tried using a cron with @reboot, but it ...
1
vote
2answers
5k views

Capture packets on Asus router

I have Asus RT-AC87U router in my home network. I would like to analyse packets on specific ports like Wireshark does. Is it possible to build such system that could make traffic going trough router ...
0
votes
1answer
453 views

How can I display wireless client mac addresses with tcpdump?

If using tcpdump to monitor a wireless interface and listen on a specific channel for traffic associated with a BSSID, how can I display information (e.g. mac address) about any connected clients? ...
0
votes
0answers
225 views

Packet Sniffing on wlan0 is saying 0 packets captured

I am trying to practice some packet sniffing on my virtual machine using tcpdump and writing it to a pcap file. I put wlan0 into monitor mode using these commands: ifconfig wlan0 down iwconfig wlan0 ...
0
votes
1answer
111 views

What are these expressions' meanings? ip[2:2] ,ip[0], tcp[12], ip[16]

I am learning tcpdump recently, but I have some troubles now. I have already search them in google and there is nothing can help me solve my problem. If you know the answer, please help me. Thank you ...
2
votes
1answer
759 views

tcpdump says “expression rejects all packets”

I want to create a filter which has 2 conditions:- Filter packets with network. (src net 2a01:111:xxxx::/44) Filter based on tcp handshake alert messages. (tcp[((tcp[12] & 0xf0) >> 2)] = ...
1
vote
1answer
114 views

tcpdump: “packet exceeded snapshot”

I am using tcpdump to look into some pcap files, but in the output, I see the following error, instead of getting the header information: packet exceeded snapshot I googled it, but I couldn't find ...
0
votes
1answer
751 views

Why server doesn't stop sending packets when client sends TCP RST multiple times?

My device connects to the server which provides some video clips. After connecting to the server, I check the wireshark and see there're multiple RST from client(port 40334) to server(80), but the ...
1
vote
0answers
76 views

tcpdump doesn't capture DHCP Discovery

I tried to capture DHCP Discovery through the tcpdump: # ip l | grep enp5s0 3: enp5s0: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 # tcpdump -ni ...
3
votes
1answer
12k views

What does TCP packet [P.] flag means in tcpdump's output?

If an IP x.x.x.x connects to IP z.z.z.z using [P.] Flag for TCP packet what exactly this [P.] flag means? Does it means that x.x.x.x sends some data to z.z.z.z?
0
votes
1answer
748 views

How to stream captured packets via UDP? tcpdump or other tool

I want to capture traffic or router and send it to remote host via tzcp or other udp proto. How to stream captured packets via UDP? tcpdump or other tool Use case: Linux box connected to internet ...
0
votes
0answers
3k views

tcpdump socket type not supported

I'm having some trouble with tcpdump in Ubuntu. I have installed Wireshark and tcpdump with no problems and can't seem to capture traffic.
1
vote
0answers
245 views

WiFi stops working when I run tcpdump on wlp2s0

Very strange thing is happening to me, as soon as I run a simple: $ sudo tcpdump -c 10 -i wlp2s0 port 22 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ...
2
votes
1answer
971 views

command line plink remote target capture traffic via jumphost [duplicate]

I am trying to capture remote host traffic via jumphost from a Windows machine and display in Wireshark. When PUTTY GUI is used and configured as below Created and saved SSH session (bastion-host) ...
2
votes
1answer
8k views

Filtering TCPDUMP over packet length

I am looking to narrow down my tcpdump by packet length. I know I can `| grep but I was wondering if I can pass this particular packet length as an option in 'tcpdump'. I am trying to write a script ...
0
votes
1answer
187 views

How to block a pcap pumped by tcpreplay from one server by iptables on the other?

I am new to stack exchange. What I am trying is: I am pumping traffic from one server by the following command: tcpreplay -i ens3 ~/daniel/sipdump.pcap from server 1 And I am capturing the traffic in ...
0
votes
1answer
140 views

tcpdump: (all BPF devices are busy) - How to solve this

I was running tcpdump and then after some time I got this error: tcpdump: (all BPF devices are busy) I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
0
votes
1answer
463 views

remote ssh tcpdump command, through a gateway, to be opened, in realtime, in Wireshark, on local machine

I (Host A - Windows based using plink) am trying to connect to a remote linux server (Host C), through a gateway linux server (Host B), and run this tcpdump on Host C to be piped all the way back to ...
1
vote
1answer
5k views

tcpdump read both ipv4 and ipv6 packets from pcap

I'm trying to gain some info from payload of TCP and UDP. The filter (tcp.stream && tcp.flags.push == 1) || udp.stream in Wireshark gives me both IPv4 and IPv6 packets. But I can't figure ...
0
votes
0answers
115 views

Linux Terminal: traffic volume on IP xxxx.xxxx.xxxx.xxxx

I have a client and a server. When I click something in the GUI on the client computer, I want to know how much data (MB) the server is sending to the client. How do I measure that? I cannot install ...
2
votes
1answer
97 views

Why do I see Ethernet frames that exceed the MTU+Ethernet header size?

I have a consumer-grade Wi-Fi router that hosts a local network. The router is connected to the Internet through a campus network (i.e., an Ethernet cable connects the WAN port to a campus Ethernet ...
0
votes
0answers
27 views

How to see real destination IP using tcpdump? [duplicate]

I'm a newbie with tcpdump. My setup is simple: 1 machine A behind a router B 1 machine C outside, on the Internet On machine A, I ping machine C, and I want to track what's happening with tcpdump: ...
2
votes
1answer
402 views

Why does traceroute increment the destination port by 1 for each probe it sends?

I captured the packets sent by Traceroute using Tcpdump. Here is the screenshot Tcpdump below. Why does traceroute increment the destination port by 1 for each probe it sends?
1
vote
1answer
751 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
0
votes
1answer
416 views

Add .pcap ending to all files created with tcpdump

I'm using tcpdump for a rotating network traffic capture, and Moloch as a nice viewer for the data. The problem is that tcpdump appends a number to the end of the filename, while Moloch only uses ...
0
votes
1answer
1k views

How do I read output from tcpdump as quickly as it prints it to the terminal?

When running tcpdump on the command line, packets appear in realtime as they are received. However, when tcpdump is piped into anything, it resorts to buffered output. The -l and -U options are ...
1
vote
1answer
375 views

No outgoing tcp request for DHCPDISCOVER

I have been trying to figure out issues with my wifi setup on my laptop with ubuntu 16.04. For some reason it doesn't seem to connect. Have tried with wicd, network-manager as well as ifconfig. On ...
0
votes
1answer
844 views

tcp session - http request [ x out of y] in wireshark capture

As below, i am seeing this [HTTP request 1/2] and [HTTP request 2/2] in 2 separate payload, are they separate GET request in a single tcp session or are they the same GET request ??? ==== Added full ...
0
votes
0answers
2k views

How to make tcpdump display only source IP, destination IP, ports and timestamps

I am running tcpdump to track traffic on 2 interfaces, one input and one output. The sole purpose is to measure the latency between the time when the input interface receives incoming TCP traffic and ...
0
votes
1answer
2k views

Tcpdump: get the flags of a fragmented packet

How does one distinguish a fragmented SYN packet from a fragmented FIN packet using tcpdump? Bar is running tcpdump -vvv. Foo scans Bar starting with a fragmented SYN Packet nmap -sS -f -p22 bar. ...
2
votes
2answers
841 views

Report tcpdump progress?

I run tcpdump as follows: $ sudo tcpdump -i eth0 -w dump.pcap host 1.2.3.4 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes Is there a way to see how many packets ...
3
votes
1answer
677 views

ipkg can't install tcpdump

I have the new Asus Blue Cave router with a USB drive mounted at /mnt/DRIVE. I installed ipkg via a GUI-based install of their Download Manager. I am trying to ipkg install tcpdump. I have mount -o ...
0
votes
1answer
5k views

Snort finding the alert file DATA with snort.logs.xxxxxxx

I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
2
votes
0answers
329 views

How does tcpdump configure an interface it begins to capture packets from?

On an Arago embedded linux system, an interface would normally be able to ping other destinations on the network. However, the pings stop working when using a utility such as iperf or scp to send TCP ...
1
vote
1answer
59 views

can only ssh unidirectional

I have two centos 7.2 server. One machine ip is 10.104.196.18, another machine is 10.240.197.21. I can successfully ssh from 10.104.196.18 to 10.240.197.21. But failed to ssh into 10.104.196.18 from ...
9
votes
2answers
2k views

How to measure data sent when I have a dump file created by tcpdump

I dumped a network traffic with the following command: tcpdump -w myfile.dump Now I want to know how much data was transmitted. I guess the file size does not equal the size of data transferred, ...
0
votes
1answer
68 views

What should I submit to my ISP for faster fix

I'm having a hard time using my Internet lately, I'm wondering what kind of data collection / diagnostic of my network should I do before calling tech support. I'm doing a video capture of 'ping' ...
0
votes
1answer
546 views

how to program tcpdump to only capture packets and nothing else

I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
0
votes
0answers
4k views

Why I can't detect traffic from UDP port 69 with tcpdump?

I have a strange case where I don't know what happen. Usually using tcpdump shall allow us to know if a packet reach to the NIC before iptable filter. This works so far on most UDP port I tried but ...