16
votes
Accepted
tcpdump: how to get grepable output?
For those like you who cannot use ngrep, here's how to use awk to make the tcpdump output of packet contents grepable.
First some sample output as provided by tcpdump -x, in order to present the task ...
16
votes
How many TCP retransmissions Internet traffic is considered normal for a basic home setup?
TCP retransmissions are perfectly normal and expected as long as there aren't too many. It should probably be less than 1% of your TCP segments that get retransmitted.
Retransmissions are normal ...
- 102k
12
votes
Can I monitor a local unix domain socket like tcpdump?
// backup the socket
sudo mv /var/run/docker.sock /var/run/docker.sock.original
// use tcp port 8089 proxy the original socket
sudo socat TCP-LISTEN:8089,reuseaddr,fork UNIX-CONNECT:/var/run/docker....
- 131
12
votes
Accepted
tcpdump not capturing any packets
As per the tcpdump man page:
-i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loop‐
...
- 5,569
10
votes
tcpdump – rotate capture files using -G, -W and -C
Expanding upon flabdablet’s answer
(changing -G 1800 to -G 300 –
rotation every five minutes –
just for testing purposes),
tcpdump -i en0 -w /var/tmp/trace-%m-%d-%H-%M-%S-%s -W 3 -G 300
will give ...
- 101
8
votes
Accepted
What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?
What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?
What is usually the cause of such behaviour? (if there is a "usual"
cause).
PSH ACK ...
8
votes
How to measure data sent when I have a dump file created by tcpdump
You are right, the file size does not reflect the amount of data transmitted: the pcap format contains extra metadata.
One nice tool to get actual data size is using capinfos which is part of the ...
- 924
5
votes
Accepted
How to tcpreplay only packets satisfying a pcap filter rule?
tcpdump can do the filtering and its result then be piped to tcpreplay.
tcpdump -r dump.pcap -w- 'udp port 1234' | tcpreplay -ieth0 -
5
votes
What does TCP packet [P.] flag means in tcpdump's output?
What exactly this [P.] Flag
It is a PUSH flag.
Tcpflags are some combination of S (SYN), F (FIN), P (PUSH), R (RST), U (URG), W (ECN CWR), E (ECN-Echo) or `.' (ACK), or `none' if no flags are set. ...
- 153k
5
votes
Capture packets on Asus router
First things first, you need to enable ssh access on your router. Someone asked a question regarding this here
Once you have your ssh setup done, you can connect to your user via SSH using a Linux ...
- 193
5
votes
Accepted
Capture only TCP SYN-ACK packets with tcpdump
Based on looking at the pcap-filter man page and especially the examples at the end I would suggest that the correct filter syntax to match packets which have at least both SYN and ACK are set would ...
- 5,632
4
votes
tcpdump – rotate capture files using -G, -W and -C
Seems to me that all you need is
tcpdump -i en0 -G 1800 -w /var/tmp/trace-%H-%M.pcap
The strftime format specifier that -G expects in the -w filename doesn't have to represent a complete date and ...
- 194
4
votes
How to capture "dropped packets" in tcpdump
The problem can be with tcpdump itself: If it doesn't respond quickly enough then old packets will be overwritten with new ones, which means that they are dropped.
If you capture all the bytes of ...
- 458k
4
votes
tcpdump not capturing any packets
I'm not in front of it right now but
there is a switch for tcpdump to list all interfaces, then you can specify specifically the one you want. Try tcpdump --list-interfaces then you can do e.g. ...
- 23.5k
4
votes
Accepted
How to measure data sent when I have a dump file created by tcpdump
You could open the dump file with wireshark to use it's filters and statistics for getting what you want. To see instructions regarding the filtering see this page from wireshark forum: https://ask....
- 681
4
votes
Accepted
Filtering TCPDUMP over packet length
Total Ethernet packet size
According to pcap-filter(7), you can use the following conditions:
less length, equivalent to len <= length
greater length, equivalent to len >= length
Based on the ...
- 429k
3
votes
Accepted
How to select syn packets going to given destination port with tcpdump
There are two problems with your command:
You're missing logical operator and between port and packet type
tcp-syn is a constant - because of this the comparison in quotes is always true.
This ...
- 2,056
3
votes
What's the purpose of the -interface option in tcpdump?
If your computer has several network interfaces, you can choose which one to monitor.
interfaces can proliferate if you have virtual machines with some types of network support.
It is not unusual ...
- 82.1k
3
votes
Accepted
tcpdump is not capturing packets
The error is here:
and port 5060 and port 6060
If port is 5060, port cannot be 6060, and viceversa, so the condition you entered will always be false. You probable want to use or instead.
- 5,569
3
votes
Accepted
How many ARP Request/Reply for Ping command to work
In theory two, but in reality, one should suffice: the one sending its ping needs to know where to send it. The recipient needs to know where to send the reply, but should already have this info based ...
- 5,998
3
votes
Accepted
What is a cache flush, and how do you explain this TCPdump pattern?
Your question is incomplete – many tcpdump markings are protocol-specific, so just saying "packets marked (Cache Flush)" means nothing at all; you need to post the full packet information.
In ...
- 429k
3
votes
Accepted
Report tcpdump progress?
You are probably looking for the -v option of tcpdump. From man tcpdump:
-v ...
When writing to a file with the -w option, report,
every 10 seconds, the number of ...
- 924
3
votes
Why do I see Ethernet frames that exceed the MTU+Ethernet header size?
This is just your router doing LRO (or maybe GRO).
It’s not TSO/GSO because you’re only seeing it on packets received by your router, not ones it is transmitting.
- 102k
3
votes
Accepted
tcpdump read both ipv4 and ipv6 packets from pcap
Perhaps it will help you:
tcpdump 'ip6[6]==17 or udp or (ip6[6]==6 and ip6[53]&8!=0) or tcp[13]&8!=0' -X -r some.pcap
In tcpdump you can't retrieve ipv6 packets the way you are trying, ...
- 214
2
votes
How to split pcap files maintaining tcp sessions
I suggest using PcapSplitter which is part of PcapPlusPlus suite. You can compile its code yourself or download binaries for several platform from here
The you can use the tool to achieve what you ...
- 121
2
votes
Wireless packet sniffing on Linux. Captured data is almost only broadcasts
To capture, on a Wi-Fi network, unicast traffic not sent to or from the capturing machine, you will probably need to capture in monitor mode. The Wireshark Wiki article on WLAN captures gives a lot of ...
- 5,152
2
votes
tcpdump is not capturing any packets for host
You haven't assigned an IP address to your eth0. So tcpdump and ping cannot work via eth0.
So either assign one if you are connected to a wired network or use your wlan0 interface instead.
E.g. ping ...
- 236
2
votes
How to capture "dropped packets" in tcpdump
Your questions seems to pertain to going back and finding out what might have caused a previous packet to drop rather than attempting to capture real time packets to try to find one that drops. For ...
- 1,482
2
votes
Accepted
Snort finding the alert file DATA with snort.logs.xxxxxxx
Like you said, by default, Snort will log two ways:
alert file - Contains alert metadata in text format
snort.log.########## - PCAP of the packet(s) that triggered the alert
The way I would go about ...
- 273
Only top scored, non community-wiki answers of a minimum length are eligible