a command line packet analyzer

learn more… | top users | synonyms

0
votes
0answers
16 views

tcpdump detect if and which IP is under DDoS

I have 20 IPs on my server. I wish to automatically detect with tcpdump which IP is ddosed and remove the specific IP from the server, so it does not affect the other IPs. Can it be done? Will it ...
0
votes
1answer
53 views

ssh authentication and remote command output's redirection

I need to run a remote capture on a host via ssh and to authenticate twice, but the second prompt is being redirected. ssh -t user@host "sudo tcpdump -s 0 -n -w - -U -i eth0 not port 22" > ...
3
votes
2answers
78 views

tcpdump : lost packets

Running, either in promiscuous mode or not : tcpdump -i "$INTERFACE" -vvv -n -XX -S -s0 -e I got a bunch of lines and this conclusion when I stopped it : 601 packets captured 938 packets received ...
1
vote
0answers
63 views

killall doesn't work if I call it from a script

I'm starting a tcpdump inside a script and I also kill it from the same script. So I'm currently using the killall command for this: The script gets executed from an udev rule: This is the section, ...
0
votes
0answers
13 views

Do I get the exact same tcpdump output if I use bond or bridge?

I need to get the tcpdump output. I was unable to set up a bridge but I could set up a bond. Does it matter which one I use when looking at the output of a tcpdump?
0
votes
1answer
21 views

How often does the tcpdump save into the file

I've got an question, concerning the tcpdumd. Does it save the data directly in the File you can give it with -w, or does it save when it's stopped? So if it was writing on a usbstick, can I just ...
1
vote
2answers
41 views

tcpdump multiple pcaps w/ xargs

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine. There are examples online, but the only one I ...
-1
votes
1answer
89 views

capture FTP traffic for both active and passive FTP sessions

I understand that the command tcpdump can be used to capture traffic. How would I use that to record all the active and passive FTP traffic on my machine?
1
vote
2answers
53 views

Capturing Traffic of Router

My machine is connected to a wireless router. Is it possible to analyse packets coming and going to the router? Can I use the bridged mode for achieving this? Actually I want the original packets ...
1
vote
2answers
42 views

tcpdump bassed datalogger

I am building a datalogger with raspberry pi. I have used a Shell script in rc.local, I am capturing the bytes using tcpdump. The Problem am facing is that the log file is getting replaced each and ...
0
votes
1answer
38 views

how to remove NFLOG interface?

I am trying to make a packet sniffing program in C but the codes am trying to run from various public sources are not returning traffic from my Ethernet pot 'em1' but always reading 'nflog interface'. ...
2
votes
2answers
43 views

How to get different types of ICMP

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
5
votes
1answer
58 views

Can kernel drop an outgoing packet which has been captured by tcpdump?

When an outgoing packet is captured by tcpdump, will it 100% be sent out, and not be dropped by kernel? Does tcpdump intercept on packet delivering path before or after kernel does any/all filtering ...
0
votes
1answer
424 views

What does 'TS val' mean in tcpdump's output?

I'm monitoring the network activities between two processes on compute:42967 and controller:5672(controller.amqp). It captured compute.42967 with three SYN(they have the same seq number) while the ...
2
votes
2answers
43 views

Ping and tcpdump at the same time

The situation is this - There is one script on the server which make ping to somewhere and I don't know to where. I want to see to which machine is this ping make and why is returning FAILED. What I ...
0
votes
1answer
65 views

Sniffing packets realtime

I've been using tcpdump and it's good, but it exhibits issues here. Other programs like hexinject, tcpflow, and tracedump all use pcap so they delay a bit before displaying the packets. I've also ...
0
votes
0answers
37 views

How does aircrack-ng suite view Clients on networks we are not connected to?

I noticed with the tool airodump-ng which is apart of the aircrack-ng suite we can view all networks around us along with Client MAC address's which are connected to these networks. How can I acheive ...
2
votes
3answers
264 views

Why is tcpdump output file empty?

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, ...
2
votes
1answer
49 views

tcpdump waits a second before displaying packets

On Linux Mint (either 17 or 17.1) I'm using tcpdump to capture some packets with this command: tcpdump -UnvXSs 4096 -B 1024 -i eth0 Despite the -U option, it doesn't actually output packets ...
0
votes
2answers
349 views

date time as file name for dump file

I'm using Gulp to capture packets at 100Mbps to a folder. But I would like to name the files in format job_<'%Y_%m_%d_%H_%M_%S'>.pcap, but it gives files job.pcap0, job.pcap2 etc. The script I use ...
1
vote
1answer
60 views

pcap file 20 times smaller than ifconfig TX/RX difference for same period

I run tcpdump on a usb modem in network card mode. [ 18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64 I run it ...
3
votes
1answer
376 views

Huge packet loss on openwrt

I have a strange issue on mikrotik rb951-2hnd router. I built image a few years ago using revision 39392 and patch firmwared it and everything worked fine. Just a few months ago I decided to update ...
1
vote
1answer
45 views

Use different filtering criteria with tcpdump packet size

When running tcpdump like this tcpdump -s96 -i eth0 ip -w output_filename is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?
1
vote
1answer
54 views

Adding the ip to the filter of tcpdump

I use this tcpdump command to HTTP GET filtering : tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' How can add IP address to this filter?
1
vote
1answer
93 views

check tcp packets reception below tcpdump level

I am having an issue with my smartphone device and packets monitoring: I am trying to find a reason why I cannot establish a VPN connection via PPTP protocol. I have the following successful ...
0
votes
1answer
129 views

How to capture traffic from a website using tcpdump

I need to capture traffic to https://gmail.com using tcpdump. I solved this by using tcpdump -n dst host <ipaddress of gmail> But is there any way I can directly specify gmail.com instead of the ...
0
votes
2answers
258 views

packets seen in ifconfig but not on tcpdump

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received ...
1
vote
2answers
342 views

tcpdump captures network-wide UDP traffic, but not TCP

When observing traffic with sudo tcpdump udp, it behaves like it should: I can see all traffic which is happening in the network, even when the machine which I am using is not involved. However, when ...
0
votes
1answer
34 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
0
votes
1answer
687 views

tcpdump - capture trace in both directions on RHEL6

I am using redhat bonding and have identified my active interface as eth5. I am using Redhat 6.5 Server Here is my command: tcpdump -i eth5 src host actual_ip_address_of_external_client after ...
4
votes
1answer
2k views

what is “rfc3442-classless-static-routes” in /etc/dhcp/dhclient.conf

I am trying to debug DHCP on my laptop (I am using dhcping and dhcdump to see what the DHCP server sends back). Following is my /etc/dhcp/dhclient.conf. option rfc3442-classless-static-routes code ...
1
vote
0answers
51 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
0
votes
1answer
158 views

put tcpdump in promiscuous mode and sniffing from any pc

At my home I use a wireless router to connect to internet, so every device uses wireless card to use it. In this way using sudo tcpdump -i wlan0 from my pc I should be able to see all the packets ...
0
votes
1answer
895 views

tcpdump -i any and promiscuous mode

From the man page for tcpdump 4.1.1 (yes I know its old) -i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured ...
1
vote
0answers
118 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
0
votes
1answer
196 views

Smallest packet sniffer for an embedded device?

Are there tiny packet sniffers out there? I'm looking for something that can be compiled for a embedded device with very limited space. I thought of tcpdump but a dynamically linked and stripped ...
1
vote
1answer
343 views

one way file sync with unison or better alternative

I have been collecting a logs for user actions on the network using a program similar to tcpdumps; with every millisecond the file being written to. I am currently using unison to synchronize the logs ...
0
votes
1answer
102 views

tcpreplay output to STDOUT?

$ tcpreplay tcpdump-2015-01-02-18h-13m.pcap ERROR: The intf1 option is required tcpreplay (tcpreplay) - Replay network traffic stored in pcap files USAGE: tcpreplay [ -<flag> ...
1
vote
1answer
100 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
1
vote
0answers
106 views

How can I log outgoing TCP traffic including the full path of URLs?

I use a program regularly on Linux that makes a TCP request when it starts up and updates a file with an access token before launching. I'd like to write a batch script that makes this request (using ...
1
vote
0answers
505 views

tcpdump - packets dropped by interface

The man for tcpdump states what can cause "packets dropped by kernel" but it doesn't state what can cause "packets dropped by interface". Can anyone shed some light as to why the interface may be ...
1
vote
1answer
842 views

record contents of packets dropped in iptables

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables. At present, I have a rule to log these packets (with a ...
1
vote
1answer
299 views

how to capture and see packet contents with tcpdump

I am trying to HTTP traffic to port 8007 in a file and then view them later. # tcpdump -i eth0 -s0 -n -w /tmp/capture port 8007 & # tcpdump -r /tmp/capture -A | grep '10.2.1.50' I expected to ...
0
votes
1answer
57 views

Itcpdump output - why is it showing an Ethernet status?

tcpdump -i mlan0 -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on mlan0, link-type EN10MB (Ethernet), capture size 262144 bytes Why is this ...
0
votes
0answers
137 views

Sendmail - I/O error “Premature EOM” in maillogs

We're using sendmail as an MTA to send confirmation emails to customers that place orders on another server running IIS. Occasionally we see lines like this in the logs: SYSERR(root): collect: I/O ...
2
votes
1answer
1k views

tcpdump won't capture entire packet

I'm using sudo tcpdump -A -s0 -ien0 port 80 | grep schemas-microsoft >> ~/Downloads/convert.txt to capture microsoft-schema xmls being sent throught the internet, when tcpdump is supposed to ...
1
vote
0answers
154 views

TCPDump To Capture A Tracepath6 Datagram

I'm trying to use TCPDump to capture an IPv6 datagram using: tcpdump -c 1 -i eth1 -vvvs0 ip6 and dst host H2.net2 & tracepath6 H2.net2 I'm running this script on H1.net1; R12.net1 is the ...
1
vote
0answers
200 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
2answers
873 views

tcpdump doesn't appear to be capturing any data, why?

I'm trying to capture data with tcpdump like so: $ sudo tcpdump -Xi eth0 I have the device and the PC connected to each other. On both sides I launch a simple test application that sends a message ...
1
vote
1answer
403 views

tcpdump and nc with udp

I don't understand the behaviour of netcat. Let's say that I have one host acting as server: [root@localhost tmp]# nc -u -l -p 670 Then I try to connect from a client: root@debian:/tmp# nc -u ...