a command line packet analyzer

learn more… | top users | synonyms

1
vote
0answers
22 views

record contents of packets dropped in iptables

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables. At present, I have a rule to log these packets (with a ...
1
vote
1answer
29 views

how to capture and see packet contents with tcpdump

I am trying to HTTP traffic to port 8007 in a file and then view them later. # tcpdump -i eth0 -s0 -n -w /tmp/capture port 8007 & # tcpdump -r /tmp/capture -A | grep '10.2.1.50' I expected to ...
0
votes
1answer
12 views

Itcpdump output - why is it showing an Ethernet status?

tcpdump -i mlan0 -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on mlan0, link-type EN10MB (Ethernet), capture size 262144 bytes Why is this ...
0
votes
0answers
23 views

Sendmail - I/O error “Premature EOM” in maillogs

We're using sendmail as an MTA to send confirmation emails to customers that place orders on another server running IIS. Occasionally we see lines like this in the logs: SYSERR(root): collect: I/O ...
1
vote
1answer
49 views

tcpdump won't capture entire packet

I'm using sudo tcpdump -A -s0 -ien0 port 80 | grep schemas-microsoft >> ~/Downloads/convert.txt to capture microsoft-schema xmls being sent throught the internet, when tcpdump is supposed to ...
1
vote
0answers
76 views

TCPDump To Capture A Tracepath6 Datagram

I'm trying to use TCPDump to capture an IPv6 datagram using: tcpdump -c 1 -i eth1 -vvvs0 ip6 and dst host H2.net2 & tracepath6 H2.net2 I'm running this script on H1.net1; R12.net1 is the ...
1
vote
0answers
33 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
2answers
65 views

tcpdump doesn't appear to be capturing any data, why?

I'm trying to capture data with tcpdump like so: $ sudo tcpdump -Xi eth0 I have the device and the PC connected to each other. On both sides I launch a simple test application that sends a message ...
1
vote
1answer
65 views

tcpdump and nc with udp

I don't understand the behaviour of netcat. Let's say that I have one host acting as server: [root@localhost tmp]# nc -u -l -p 670 Then I try to connect from a client: root@debian:/tmp# nc -u ...
0
votes
0answers
28 views

Unable to capture trace with -w option

I am not able to capture trace with the -w option on my fedora machine. Please see the log below : [root@localhost home]# tcpdump -w /home/trace.cap -i eth2 -s 0 tcpdump: listening on eth2, link-type ...
1
vote
1answer
195 views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
0
votes
1answer
15 views

tcpdump Filter with certain file types?

I use the unix command tcpdump with these extensions -A -s0 -ien0 port 80 I know how to add, for example a new host, that would be and \ host random.com Can I sniff for certain filetypes? I have ...
1
vote
1answer
102 views

How to update tcpdump?

I would like to update tcpdump on my computer (CentOS 6.5) which is currently old. I download the zip file from TCPDUMP/LIBPCAP public repository already but I don't know how to update with this file. ...
2
votes
2answers
536 views

Piping tcpdump traffic via SSH - but no root ssh access

The situation I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH ...
5
votes
2answers
3k views

Why would the kernel drop packets?

I interrupted tcpdump with Ctrl+C and got this total summary: 579204 packets captured 579346 packets received by filter 142 packets dropped by kernel What are the "packets dropped by kernel"? Why ...
1
vote
0answers
244 views

tcpdump not capturing http or tcp/ssl traffic

I have been trying to learn tcpdump and I am using this command to attempt to monitor my network: sudo tcpdump -I -i en1 But this gives me a bunch of stuff I don't want, so I used this version to ...
2
votes
0answers
774 views

Creating multicast join for tcpdump captures

I want to write a linux shell script which will capture specific multicast traffic. Specific as in, I want to create a pcap file that has all the traffic for one specific multicast group/port. Here ...
1
vote
1answer
182 views

Capture web traffic grouped by individual TCP streams

As far as I know a HTTP request and response constructs one TCP connection. To debug a web application on a GUI-less server, I'd like to be able to capture these TCP streams in a single ...
4
votes
1answer
341 views

How to investigate a random reset on TCP client port connected via loopback interface to a server

I have a test suite which initializes a server on the localhost and then runs thousands of stress tests which include starting and stopping clients connecting to this local server on same machine. I ...
2
votes
2answers
113 views

“tcpdump” to capture the last packets

I am monitoring a certain port, because my application uses that port, it seems that the connection drops at random times, I want to see what are the last packets passing through before the connection ...
1
vote
2answers
48 views

Remove pauses greater than x from pcap file

I've captured udp traffic to a pcap file. When replaying with tcpreplay-edit, I'd like to shorten all pauses (where there is no udp traffic at all) to x seconds max. tcpreplay-edit only has a global ...
1
vote
2answers
97 views

Do not display ACK packets

I have the following tcpdump -i eth0 -n tcp port 5000 to filter every packet flowing between 2 hosts. However, one of the hosts always sends an ACK. How do I hide this ACK?
1
vote
0answers
65 views

Is it possible to view unicode text in tcpdump capture output?

Unfortunately seems like tcpdump is not capable of detecting and displaying Unicode-encoded text (specifically utf-8) in captures. It treats unicode text like regular binary data and displays it in ...
1
vote
1answer
142 views

How to log incoming icmp traffic?

I am watching my ip6table and observing an icmp packet arriving and getting dropped at the rate of 1 per second. I am trying to find out what that message is about. I tried using tcpdump (it is ...
2
votes
1answer
34 views

How to sniff download information of different pc's on a network(router)

Actually I am making an Log Analyzer for downloads on a network by different users.So i want to know who downloaded what in a same network.I know SSL packets cannot be sniffed but I want only ...
6
votes
3answers
681 views

How does one capture traffic on virtual interfaces?

I would like to capture traffic on Linux virtual interfaces, for debugging purposes. I have been experimenting with veth, tun and dummy interface types; on all three, I am having trouble getting ...
3
votes
1answer
142 views

tcpdump command works only on local ip

I am trying to capture some IP packets in my personal LAN with tcpdump, through the command tcpdump -A -i eth0 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) ...
2
votes
3answers
711 views

How to record an interactice socat TCP/TLS session?

Socat is great for interactively testing line based human readable protocols like HTTP or IMAP. For example: $ socat -d -d READLINE,history=$HOME/s.hist openssl:host:port,crnl,cafile=some.ca For ...
2
votes
0answers
2k views

Dumping multicast UDP stream with socat

I am setting up video streaming. In local network, there are two devices streaming video over UDP multicast. One is regular computer with Linux (streaming to 239.220.221.10, port 9200), second one is ...
0
votes
0answers
30 views

Get the information of each (single) flowing packet

tcpdump buffers data up to the default buffer size and then dumps it into disk. But let's say I need to get the information of the current flowing packet (a single packet), i.e. I don't want to wait ...
2
votes
0answers
97 views

tcpdump hello server certificate

On a device located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet. So I'm trying to figure out how to get ...
1
vote
1answer
717 views

tcpdump of SCCP or GSM MAP messages

Right now I'm using tcpdump -i <interface_name> -p <port> -s0 -w /tmp/file.cap and then filter the capture in wireshark. How can I take packet capture with tcpdump only on SCCP or GSM_MAP ...
1
vote
1answer
191 views

Processing FreeBSD's PF logs with tcpdump/sed/awk

I'm running FreeBSD and have PF firewall set up and this is command i use to display daily number of firewall hits (blocked traffic) sudo tcpdump -n -e -tttt -r /var/log/pflog | grep $(date ...
1
vote
1answer
247 views

How to rotate tcpdump files?

I want to take a continuous dump file of particular size and after the dump reached it predefined size the new data should overwrite the file. Help
1
vote
1answer
41 views

Network issue - only one machine can't access webpage on another machine

I'm trying to figure out why my MacBook is unable to reach the web page served by my Raspberry Pi while other computers on my local network (or on external networks) have no problems seeing the web ...
2
votes
2answers
3k views

tcp dump outgoing connection packets

What is the command syntax to log all tcp connection packets? I am trying to see what address and ports my computer is trying to connect to outgoing so that I may config my firewall.
2
votes
3answers
660 views

Running tcpdump, tee and scp

I'm trying to run the following: $ tcpdump -l -X -i eth1 -n tcp port <port> | tee capture.txt | \ scp capture.txt root@10.3.3.227:/home/checker/ tcpdump -l -X -i eth1 -n tcp port ...
2
votes
3answers
362 views

tcpdump syntax error when specifying portrange as documented

I am using tcpdump on OpenBSD and trying to learn it from a primer on it. I want to capture a range of ports, but it seems how this is done has changed. I can't even find portrange as a keyword in ...
2
votes
1answer
2k views

Using tcpdump to extract NFS RPC contents

Fairly simple question... I'm running tcpdump and trying to analyze the contents of the TCP packets between server/client. I see the "GETATTR" RPC being received, which is great! However, I want to ...
2
votes
3answers
593 views

Rotating logs generated from tcpdump with logrotate

On one production linux box, I am capturing SIP packets using the following configuration: logrotate.conf: # Opensips SIP traces /var/log/sip.log { rotate 31 daily missingok ...
4
votes
1answer
303 views

tcpdump don't show src and dst address

I'm having a problem with a tcpdump. The output is: 21:53:53.877873 MPLS (label 266837, exp 0, [S], ttl 255), IP, length: 193 21:53:53.878037 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: ...
1
vote
1answer
213 views

What does “0x0030: 061c 0dd8 4745 5420 2f20 4854 5450 2f31” mean in tcpdump?

I am trying to learn tcpdump. I ran the following command:- tcpdump -i eth0 -lnXs1600 host google.com and port 80 and got the following results:- 2:23:45.781779 IP 10.16.30.28.42957 > ...
3
votes
1answer
138 views

Using tcpdump to log blacklisted IPs

I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially ...
2
votes
1answer
1k views

Sniffing VirtualBox machine behind NAT

I have a VirtualBox machine with a single interface connected to VB's NAT mode. What I would like to do is sniff all traffic coming from/to any machine behind that NAT. (I don't think I will need to ...
-1
votes
1answer
208 views

tcpdump host filter doesn't work

I'm using tcpdump on a linux ARM computer (Raspberry Pi). The command tcpdump host "ip" -v gives nothing when I go on the website "ip" with my laptop, but if I try tcpdump port 80 -v it works ...
1
vote
0answers
505 views

Packets not received by TUN device

I created a TUN device(nat64) and created a route so that all the required packets are forwarded to the TUN device from an eth device. But, I see that many packets are not received by the TUN device. ...
4
votes
1answer
365 views

Tell tcpdump to skip custom header

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
1
vote
1answer
809 views

Tcpdump: how to capture outgoing packets on a virtual interface?

On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header. now this ...
4
votes
1answer
262 views

What does this tcpdump line means?

Reading the manpage of tcpdump I found this example tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet' but I don't understand it, especially the last part. The ...
0
votes
1answer
109 views

Filesystem writes seemingly lost

I've been experimenting with tcpdump, and I've found some very bizarre filesystem behavior. It doesn't look to be a tcpdump problem as I'll explain in a second. The following command produces no ...