a command line packet analyzer

learn more… | top users | synonyms

0
votes
1answer
43 views

How to display all data using tcpdump?

I am capturing network traffic by using tcpdump. The problem is, I can't see all capture data when the package is too long. For example, when the tcp frame length more than 500,I just see 100-200 or ...
0
votes
1answer
36 views

How to print all MAC addresses of devices interacting with wifis in my area to stdout

How do I configure a tool like wireshark, kismet, tcpdump to passively listen to wifi traffic? How do I get one of these tools to print these MAC addresses to stdout? I want just one MAC address per ...
1
vote
1answer
33 views

Why don't I see packets when I listen on my ftp port with tcpdump on localhost?

I'm accessing my localhost ftp server by Iceweasel or by the terminal (with the command ftp) while listening on the ftp port with sudo tcpdump -vv -A 'port 20' or sudo tcpdump -vv -A port ftp ...
1
vote
1answer
80 views

Continuous log-rotated tcpdump - dealing with interface disconnections

I'm currently running a continuous tcpdump job with the following command: tcpdump -pni en4 -G 3600 -w 'data/trace_%Y-%m-%d_%H:%M:%S.pcap' It runs very well over long periods of time, creating one ...
1
vote
0answers
61 views

Userspace Network Stack

I am writing a (very simple) userland IP network stack. For this purpose, I need to go "around" the OS network stack and obtain the raw Ethernet frames. The tap interface sounds like a way to go, but ...
1
vote
0answers
63 views

Is there a utility that allows to create structured data from tcpdump hexdumps?

Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse. Is there a utility that could read tcpdump packets in hex dump format and ...
0
votes
2answers
104 views

Using Both Grep and Cut

I want to grep the output of tcpdump and cut some part of it but the command below is not working. tcpdump ... | grep -i --line-buffered "..." | cut -d'&' -f1,2 Do you know what is the problem? ...
0
votes
0answers
73 views

tcpdump detect if and which IP is under DDoS

I have 20 IPs on my server. I wish to automatically detect with tcpdump which IP is ddosed and remove the specific IP from the server, so it does not affect the other IPs. Can it be done? Will it ...
0
votes
1answer
84 views

ssh authentication and remote command output's redirection

I need to run a remote capture on a host via ssh and to authenticate twice, but the second prompt is being redirected. ssh -t user@host "sudo tcpdump -s 0 -n -w - -U -i eth0 not port 22" > /tmp/...
3
votes
2answers
318 views

tcpdump : lost packets

Running, either in promiscuous mode or not : tcpdump -i "$INTERFACE" -vvv -n -XX -S -s0 -e I got a bunch of lines and this conclusion when I stopped it : 601 packets captured 938 packets received ...
2
votes
0answers
115 views

killall doesn't work if I call it from a script

I'm starting a tcpdump inside a script and I also kill it from the same script. So I'm currently using the killall command for this: The script gets executed from an udev rule: This is the section, ...
0
votes
0answers
17 views

Do I get the exact same tcpdump output if I use bond or bridge?

I need to get the tcpdump output. I was unable to set up a bridge but I could set up a bond. Does it matter which one I use when looking at the output of a tcpdump?
0
votes
1answer
29 views

How often does the tcpdump save into the file

I've got an question, concerning the tcpdumd. Does it save the data directly in the File you can give it with -w, or does it save when it's stopped? So if it was writing on a usbstick, can I just ...
1
vote
2answers
113 views

tcpdump multiple pcaps w/ xargs

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine. There are examples online, but the only one I ...
-1
votes
1answer
133 views

capture FTP traffic for both active and passive FTP sessions

I understand that the command tcpdump can be used to capture traffic. How would I use that to record all the active and passive FTP traffic on my machine?
1
vote
2answers
115 views

Capturing Traffic of Router

My machine is connected to a wireless router. Is it possible to analyse packets coming and going to the router? Can I use the bridged mode for achieving this? Actually I want the original packets ...
1
vote
2answers
49 views

tcpdump bassed datalogger

I am building a datalogger with raspberry pi. I have used a Shell script in rc.local, I am capturing the bytes using tcpdump. The Problem am facing is that the log file is getting replaced each and ...
0
votes
1answer
94 views

how to remove NFLOG interface?

I am trying to make a packet sniffing program in C but the codes am trying to run from various public sources are not returning traffic from my Ethernet pot 'em1' but always reading 'nflog interface'. ...
2
votes
2answers
88 views

How to get different types of ICMP

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
5
votes
1answer
104 views

Can kernel drop an outgoing packet which has been captured by tcpdump?

When an outgoing packet is captured by tcpdump, will it 100% be sent out, and not be dropped by kernel? Does tcpdump intercept on packet delivering path before or after kernel does any/all filtering ...
0
votes
1answer
1k views

What does 'TS val' mean in tcpdump's output?

I'm monitoring the network activities between two processes on compute:42967 and controller:5672(controller.amqp). It captured compute.42967 with three SYN(they have the same seq number) while the ...
2
votes
2answers
95 views

Ping and tcpdump at the same time

The situation is this - There is one script on the server which make ping to somewhere and I don't know to where. I want to see to which machine is this ping make and why is returning FAILED. What I ...
0
votes
1answer
103 views

Sniffing packets realtime

I've been using tcpdump and it's good, but it exhibits issues here. Other programs like hexinject, tcpflow, and tracedump all use pcap so they delay a bit before displaying the packets. I've also ...
0
votes
1answer
55 views

How does aircrack-ng suite view Clients on networks we are not connected to?

I noticed with the tool airodump-ng which is apart of the aircrack-ng suite we can view all networks around us along with Client MAC address's which are connected to these networks. How can I acheive ...
2
votes
3answers
838 views

Why is tcpdump output file empty?

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, ...
2
votes
1answer
100 views

tcpdump waits a second before displaying packets

On Linux Mint (either 17 or 17.1) I'm using tcpdump to capture some packets with this command: tcpdump -UnvXSs 4096 -B 1024 -i eth0 Despite the -U option, it doesn't actually output packets ...
0
votes
2answers
823 views

date time as file name for dump file

I'm using Gulp to capture packets at 100Mbps to a folder. But I would like to name the files in format job_<'%Y_%m_%d_%H_%M_%S'>.pcap, but it gives files job.pcap0, job.pcap2 etc. The script I use ...
1
vote
1answer
88 views

pcap file 20 times smaller than ifconfig TX/RX difference for same period

I run tcpdump on a usb modem in network card mode. [ 18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64 I run it ...
3
votes
1answer
566 views

Huge packet loss on openwrt

I have a strange issue on mikrotik rb951-2hnd router. I built image a few years ago using revision 39392 and patch firmwared it and everything worked fine. Just a few months ago I decided to update ...
1
vote
1answer
65 views

Use different filtering criteria with tcpdump packet size

When running tcpdump like this tcpdump -s96 -i eth0 ip -w output_filename is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?
1
vote
1answer
61 views

Adding the ip to the filter of tcpdump

I use this tcpdump command to HTTP GET filtering : tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' How can add IP address to this filter?
1
vote
1answer
135 views

check tcp packets reception below tcpdump level

I am having an issue with my smartphone device and packets monitoring: I am trying to find a reason why I cannot establish a VPN connection via PPTP protocol. I have the following successful scenario:...
1
vote
1answer
318 views

How to capture traffic from a website using tcpdump

I need to capture traffic to https://gmail.com using tcpdump. I solved this by using tcpdump -n dst host <ipaddress of gmail> But is there any way I can directly specify gmail.com instead of the ...
0
votes
2answers
390 views

packets seen in ifconfig but not on tcpdump

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received ...
1
vote
2answers
415 views

tcpdump captures network-wide UDP traffic, but not TCP

When observing traffic with sudo tcpdump udp, it behaves like it should: I can see all traffic which is happening in the network, even when the machine which I am using is not involved. However, when ...
0
votes
1answer
38 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
0
votes
1answer
1k views

tcpdump - capture trace in both directions on RHEL6

I am using redhat bonding and have identified my active interface as eth5. I am using Redhat 6.5 Server Here is my command: tcpdump -i eth5 src host actual_ip_address_of_external_client after ...
6
votes
1answer
2k views

what is “rfc3442-classless-static-routes” in /etc/dhcp/dhclient.conf

I am trying to debug DHCP on my laptop (I am using dhcping and dhcdump to see what the DHCP server sends back). Following is my /etc/dhcp/dhclient.conf. option rfc3442-classless-static-routes code ...
1
vote
0answers
60 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
0
votes
1answer
268 views

put tcpdump in promiscuous mode and sniffing from any pc

At my home I use a wireless router to connect to internet, so every device uses wireless card to use it. In this way using sudo tcpdump -i wlan0 from my pc I should be able to see all the packets ...
0
votes
1answer
2k views

tcpdump -i any and promiscuous mode

From the man page for tcpdump 4.1.1 (yes I know its old) -i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured ...
2
votes
0answers
204 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
0
votes
1answer
311 views

Smallest packet sniffer for an embedded device?

Are there tiny packet sniffers out there? I'm looking for something that can be compiled for a embedded device with very limited space. I thought of tcpdump but a dynamically linked and stripped ...
1
vote
1answer
440 views

one way file sync with unison or better alternative

I have been collecting a logs for user actions on the network using a program similar to tcpdumps; with every millisecond the file being written to. I am currently using unison to synchronize the logs ...
0
votes
1answer
160 views

tcpreplay output to STDOUT?

$ tcpreplay tcpdump-2015-01-02-18h-13m.pcap ERROR: The intf1 option is required tcpreplay (tcpreplay) - Replay network traffic stored in pcap files USAGE: tcpreplay [ -<flag> [<val&...
1
vote
1answer
193 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
1
vote
0answers
146 views

How can I log outgoing TCP traffic including the full path of URLs?

I use a program regularly on Linux that makes a TCP request when it starts up and updates a file with an access token before launching. I'd like to write a batch script that makes this request (using ...
1
vote
1answer
735 views

Why are tcpdump - packets being dropped by interface? [duplicate]

I'm using Ubuntu 14.04 via Virtual Box on a Windows 7 host. The NIC is a USB to Ethernet adapter. The man for tcpdump states what can cause "packets dropped by kernel" but it doesn't state what ...
1
vote
1answer
1k views

record contents of packets dropped in iptables

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables. At present, I have a rule to log these packets (with a ...
1
vote
1answer
411 views

how to capture and see packet contents with tcpdump

I am trying to HTTP traffic to port 8007 in a file and then view them later. # tcpdump -i eth0 -s0 -n -w /tmp/capture port 8007 & # tcpdump -r /tmp/capture -A | grep '10.2.1.50' I expected to ...