Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tcpdump]

commandline packet analyzer

0
votes
1answer
15 views

remote ssh tcpdump command, through a gateway, to be opened, in realtime, in Wireshark, on local machine

I (Host A - Windows based using plink) am trying to connect to a remote linux server (Host C), through a gateway linux server (Host B), and run this tcpdump on Host C to be piped all the way back to ...
1
vote
1answer
75 views

tcpdump read both ipv4 and ipv6 packets from pcap

I'm trying to gain some info from payload of tcp and udp. The filter (tcp.stream && tcp.flags.push == 1) || udp.stream in Wireshark gives me both ipv4 and ipv6 packets. But I can't figure ...
0
votes
0answers
41 views

Linux Terminal: traffic volume on IP xxxx.xxxx.xxxx.xxxx

I have a client and a server. When I click something in the GUI on the client computer, I want to know how much data (MB) the server is sending to the client. How do I measure that? I cannot install ...
2
votes
1answer
48 views

Why do I see Ethernet frames that exceed the MTU+Ethernet header size?

I have a consumer-grade Wi-Fi router that hosts a local network. The router is connected to the Internet through a campus network (i.e., an Ethernet cable connects the WAN port to a campus Ethernet ...
0
votes
0answers
15 views

How to see real destination IP using tcpdump? [duplicate]

I'm a newbie with tcpdump. My setup is simple: 1 machine A behind a router B 1 machine C outside, on the Internet On machine A, I ping machine C, and I want to track what's happening with tcpdump: ...
2
votes
0answers
81 views

Why does traceroute increment the destination port by 1 for each probe it sends?

I captured the packets sent by Traceroute using Tcpdump. Here is the screenshot Tcpdump below. Why does traceroute increment the destination port by 1 for each probe it sends?
0
votes
0answers
32 views

WinDump - how to capture network communication to separate files by hour ? (windows)

I'm trying to capture all the communication (packets) that goes through my computer. I would like to record every hour to separate capture file and limit the size of those files. I tried working with ...
0
votes
1answer
80 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
0
votes
1answer
45 views

Add .pcap ending to all files created with tcpdump

I'm using tcpdump for a rotating network traffic capture, and Moloch as a nice viewer for the data. The problem is that tcpdump appends a number to the end of the filename, while Moloch only uses ...
0
votes
1answer
110 views

How do I read output from tcpdump as quickly as it prints it to the terminal?

When running tcpdump on the command line, packets appear in realtime as they are received. However, when tcpdump is piped into anything, it resorts to buffered output. The -l and -U options are ...
1
vote
1answer
71 views

No outgoing tcp request for DHCPDISCOVER

I have been trying to figure out issues with my wifi setup on my laptop with ubuntu 16.04. For some reason it doesn't seem to connect. Have tried with wicd, network-manager as well as ifconfig. On ...
0
votes
1answer
56 views

tcp session - http request [ x out of y] in wireshark capture

As below, i am seeing this [HTTP request 1/2] and [HTTP request 2/2] in 2 separate payload, are they separate GET request in a single tcp session or are they the same GET request ??? ==== Added full ...
0
votes
0answers
54 views

tcpdump does not catch SCTP on local ethernet interface (lo)

When a server and client use interface lo (127.0.0.1) on Centos to send echo packets, tcpdump catches TCP packets succesfully but not SCTP. However, when server and client are located on different ...
0
votes
0answers
454 views

How to make tcpdump display only source IP, destination IP, ports and timestamps

I am running tcpdump to track traffic on 2 interfaces, one input and one output. The sole purpose is to measure the latency between the time when the input interface receives incoming TCP traffic and ...
0
votes
1answer
476 views

Tcpdump: get the flags of a fragmented packet

How does one distinguish a fragmented SYN packet from a fragmented FIN packet using tcpdump? Bar is running tcpdump -vvv. Foo scans Bar starting with a fragmented SYN Packet nmap -sS -f -p22 bar. ...
0
votes
2answers
108 views

Report tcpdump progress?

I run tcpdump as follows: $ sudo tcpdump -i eth0 -w dump.pcap host 1.2.3.4 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes Is there a way to see how many packets ...
3
votes
1answer
160 views

ipkg can't install tcpdump

I have the new Asus Blue Cave router with a USB drive mounted at /mnt/DRIVE. I installed ipkg via a GUI-based install of their Download Manager. I am trying to ipkg install tcpdump. I have mount -o ...
0
votes
0answers
108 views

Does anyone experience issues with Cradlepoint's GPS send-to-server timestamp being incorrect?

I have a Cradlepoint MBR1400v2 router for which I have configured the GPS send-to-server option (the router also has a send-to-client service). I noted, while developing a PHP server to receive the ...
0
votes
0answers
111 views

What does `(1)` mean in `sctp (1)` in tcpdump output?

I start a SCTP testing with following commands: - server: iperf3 -s -4 -p 12345 -B 25.0.110.6 -A 7 - client: iperf3 -c 25.0.110.6 -4 -p 12345 -B 25.0.110.5 -A 7 --sctp -P 4 -l 512 -t30 Tcpdump at ...
0
votes
0answers
645 views

tcpdump: How can I detect the end of a packet in realtime captures?

I am capturing packets using tcpdump for real-time processing. I'm using the IEEE_80211_RADIO headers and processing the output in a python 3 script. My invocation currently looks like this: tcpdump -...
0
votes
1answer
770 views

Snort finding the alert file DATA with snort.logs.xxxxxxx

I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
2
votes
0answers
155 views

How does tcpdump configure an interface it begins to capture packets from?

On an Arago embedded linux system, an interface would normally be able to ping other destinations on the network. However, the pings stop working when using a utility such as iperf or scp to send TCP ...
1
vote
1answer
44 views

can only ssh unidirectional

I have two centos 7.2 server. One machine ip is 10.104.196.18, another machine is 10.240.197.21. I can successfully ssh from 10.104.196.18 to 10.240.197.21. But failed to ssh into 10.104.196.18 from ...
9
votes
2answers
647 views

How to measure data sent when I have a dump file created by tcpdump

I dumped a network traffic with the following command: tcpdump -w myfile.dump Now I want to know how much data was transmitted. I guess the file size does not equal the size of data transferred, ...
0
votes
1answer
66 views

What should I submit to my ISP for faster fix

I'm having a hard time using my Internet lately, I'm wondering what kind of data collection / diagnostic of my network should I do before calling tech support. I'm doing a video capture of 'ping' ...
0
votes
1answer
308 views

how to program tcpdump to only capture packets and nothing else

I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
0
votes
0answers
1k views

Why I can't detect traffic from UDP port 69 with tcpdump?

I have a strange case where I don't know what happen. Usually using tcpdump shall allow us to know if a packet reach to the NIC before iptable filter. This works so far on most UDP port I tried but ...
0
votes
0answers
328 views

How to find out the PID which generates traffics to port 9229 in MacBook

There are unknown traffics to port 9229 in my MacBook. $ sudo tcpdump -i any -n port 9229 ...... 12:10:39.176502 IP6 ::1.62261 > ::1.9229: Flags [S], seq 638850191, win 65535, options [mss 16324,...
3
votes
0answers
119 views

Inactive / Unknown TCP connections

I can see the following TCP connections in one of my linux host. root@odb-us:~# netstat -a | grep ESTAB | grep 10.12 tcp 0 0 odb-us.:2424 10.12.0.77:40000 ESTABLISHED tcp 0 ...
5
votes
2answers
9k views

How to capture “dropped packets” in tcpdump

I have a problem with my networking performance. I am using Ubuntu 16.04 on VMware Cloud Server with NIC E1000. But I see some packets dropped in sections of ifconfig command: root@ubuntu:~# ifconfig ...
1
vote
0answers
213 views

Tcpdump or similar - How can I only capture one instance of each packet destination and port?

I want to leave something like tcpdump running for up to a week and therefore make its output as concise as possible to reduce file size and speed up post-capture analysis. All I need to to do is log ...
0
votes
1answer
92 views

How to capture network traffic periodically, with every capture file containing full network flows

I need to dump network flow periodically on a Linux platform, ideally using the command line interface (i.e., non-GUI tools), and I want every capture file (pcap files) to contain complete flows. How ...
0
votes
1answer
112 views

tcpdump does not recognize or operator

I want to capture packets that are either a PPPoE Discovery or Session packet. Does tcpdump support combining protocols with or? The manpage seems to say so, but it does not seem to work on Raspbian ...
0
votes
1answer
673 views

tcpdump only showing beacon packets for certain mac address filters

I'm using an ubuntu OS to capture data packets in monitor mode (https://sandilands.info/sgordon/capturing-wifi-in-monitor-mode-with-iw) The command I'm using to capture packets from my laptop is: ...
0
votes
2answers
263 views

Analyse UDP delay from tcpdump files

I have a video streamer (VLC) which is using RTP to stream video to a client. I have captured the packet trace from both the sender and the receiver side using tcpdump separately. The streaming ...
1
vote
0answers
108 views

tcpdump on debian 8

I had installed tcpdump on debian 8 via the apt-get command. When I try to record packet on a monitoring interface which gets packets via SPAN port with the following command "tcpdump -i interface -...
0
votes
1answer
240 views

tcpreplay does not work

I have a problem with tcpreplay and hostapd, this is my scenario: a client connects to 172.24.1.91/OPEN and /CLOSE and processes a GET request to a server that lights up or down a Led. I made a Java ...
-1
votes
1answer
167 views

Dissecting HTTP-Capture

I have the below HTTP-get capture. I am trying to learn to dissect it manually using protocols and packet math. And am struggling with the following questions. This is not a graded project, just ...
1
vote
0answers
3k views

tcpdump is overlooking some snmp traffic

I am sniffing for SNMP traffic to code a testcase for some network hardware. Currently I start tcpdump like this: tcpdump -i any -nn port snmp I then send some SNMP traffic from the same host: ...
2
votes
1answer
44 views

Calculating network usage from a server

I am trying to calculate the % network utilization for a server on my network for any snmp traffic, (in or out). I have followed the below steps, can someone point out if I have gone wrong in the ...
-1
votes
1answer
467 views

tcpdump is not capturing any packets for host

Here is the output of the ip addr command: I tried out this command for showing network traffic: sudo tcpdump -n host google.com But it's giving output like this: tcpdump: WARNING: eth0: no ...
0
votes
1answer
57 views

Does The Same Layer 2 Routing Information From A Source End Up On The Other Side Of The Internet?

when I do tcpdump -e eth0 I get the traffic stream going through eth0, and I'm seeing various source MAC addresses of packets being received by eth0. I only have one default gateway connection with ...
0
votes
3answers
387 views

Why does TCP sends more than 1 ack per packet?

My source sends packets of 4794 bytes (at least according to the capturing it looks like 1 packet each), however, the destination machine sends 2 acks for every packet sent from source. I've tried ...
0
votes
1answer
287 views

How to select syn packets going to given destination port with tcpdump

I'm trying to capture syn packets going to a given destination port with tcpdump with the following command : tcpdump dst port 80 "(tcp-syn) !=0" but it says tcp: syntax error Any idea how to ...
4
votes
1answer
1k views

How to tcpreplay only packets satisfying a pcap filter rule?

I have a dump file with lots of various packets in it, but I want to selectively replay, say, only all udp packets to a given port number, without having to edit the dump file first. How?
0
votes
1answer
92 views

What's the purpose of the -interface option in tcpdump?

doing the following command: tcpdump -i eth0:cp5 shows exactly the same thing as the default ... tcpdump what's the purpose of allowing user to specify interfaces?
0
votes
1answer
830 views

Can't connect local server by public domain name

I have my server (Debian Wheezy) in my local home network. On that server I have my own DNS server (dnsmasq) for other local servers (so I can type name instead of local IP) and reverse proxy (nginx). ...
1
vote
2answers
145 views

tcpdump is not capturing packets

Can anybody tell me what kind of error I have in this? It isn't reading any packets when I run it. nohup sudo tcpdump -i any host 10.0.1.107 and port 5060 and port 6060 -G 010 -W 015 -w capture_%Y-%m-...
0
votes
1answer
93 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
2
votes
0answers
248 views

how to capture a certain http code responce with tcpdump

I want to capture http errors on openwrt. ngrep utility would be very useful but is not available there also tshark is not available also. so it leaves me with tcpdump. how do I tell tcpdump to ...