a command line packet analyzer

learn more… | top users | synonyms

1
vote
1answer
15 views

pcap file 20 times smaller than ifconfig TX/RX difference for same period

I run tcpdump on a usb modem in network card mode. [ 18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64 I run it ...
-1
votes
0answers
7 views

mergepcap how to select pcaps to merge

i am running a loop which should output 7G pcap file so i used the -C 1000 and -W 7 option to do that, the problem is i need to merge those 7 files into 1 and since i'm not doing it manually i don't ...
1
vote
0answers
92 views

Huge packet loss on openwrt

I have a strange issue on mikrotik rb951-2hnd router. I firmwared it to openwrt a few years ago and everything worked fine. Just a few months ago I decided to update firmware. So I did it and ...
1
vote
1answer
18 views

Use different filtering criteria with tcpdump packet size

When running tcpdump like this tcpdump -s96 -i eth0 ip -w output_filename is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?
1
vote
1answer
35 views

Adding the ip to the filter of tcpdump

I use this tcpdump command to HTTP GET filtering : tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' How can add IP address to this filter?
1
vote
1answer
51 views

check tcp packets reception below tcpdump level

I am having an issue with my smartphone device and packets monitoring: I am trying to find a reason why I cannot establish a VPN connection via PPTP protocol. I have the following successful ...
0
votes
1answer
33 views

How to capture traffic from a website using tcpdump

I need to capture traffic to https://gmail.com using tcpdump. I solved this by using tcpdump -n dst host <ipaddress of gmail> But is there any way I can directly specify gmail.com instead of the ...
0
votes
2answers
87 views

packets seen in ifconfig but not on tcpdump

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received ...
1
vote
2answers
204 views

tcpdump captures network-wide UDP traffic, but not TCP

When observing traffic with sudo tcpdump udp, it behaves like it should: I can see all traffic which is happening in the network, even when the machine which I am using is not involved. However, when ...
0
votes
1answer
25 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
0
votes
1answer
149 views

tcpdump - capture trace in both directions on RHEL6

I am using redhat bonding and have identified my active interface as eth5. I am using Redhat 6.5 Server Here is my command: tcpdump -i eth5 src host actual_ip_address_of_external_client after ...
4
votes
1answer
434 views

what is “rfc3442-classless-static-routes” in /etc/dhcp/dhclient.conf

I am trying to debug DHCP on my laptop (I am using dhcping and dhcdump to see what the DHCP server sends back). Following is my /etc/dhcp/dhclient.conf. option rfc3442-classless-static-routes code ...
1
vote
0answers
29 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
0
votes
1answer
83 views

put tcpdump in promiscuous mode and sniffing from any pc

At my home I use a wireless router to connect to internet, so every device uses wireless card to use it. In this way using sudo tcpdump -i wlan0 from my pc I should be able to see all the packets ...
0
votes
1answer
127 views

tcpdump -i any and promiscuous mode

From the man page for tcpdump 4.1.1 (yes I know its old) -i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured ...
1
vote
0answers
55 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
0
votes
1answer
78 views

Smallest packet sniffer for an embedded device?

Are there tiny packet sniffers out there? I'm looking for something that can be compiled for a embedded device with very limited space. I thought of tcpdump but a dynamically linked and stripped ...
1
vote
1answer
177 views

one way file sync with unison or better alternative

I have been collecting a logs for user actions on the network using a program similar to tcpdumps; with every millisecond the file being written to. I am currently using unison to synchronize the logs ...
0
votes
1answer
60 views

tcpreplay output to STDOUT?

$ tcpreplay tcpdump-2015-01-02-18h-13m.pcap ERROR: The intf1 option is required tcpreplay (tcpreplay) - Replay network traffic stored in pcap files USAGE: tcpreplay [ -<flag> ...
0
votes
0answers
53 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
1
vote
0answers
60 views

How can I log outgoing TCP traffic including the full path of URLs?

I use a program regularly on Linux that makes a TCP request when it starts up and updates a file with an access token before launching. I'd like to write a batch script that makes this request (using ...
0
votes
0answers
230 views

tcpdump - packets dropped by interface

The man for tcpdump states what can cause "packets dropped by kernel" but it doesn't state what can cause "packets dropped by interface". Can anyone shed some light as to why the interface may be ...
1
vote
1answer
462 views

record contents of packets dropped in iptables

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables. At present, I have a rule to log these packets (with a ...
1
vote
1answer
149 views

how to capture and see packet contents with tcpdump

I am trying to HTTP traffic to port 8007 in a file and then view them later. # tcpdump -i eth0 -s0 -n -w /tmp/capture port 8007 & # tcpdump -r /tmp/capture -A | grep '10.2.1.50' I expected to ...
0
votes
1answer
35 views

Itcpdump output - why is it showing an Ethernet status?

tcpdump -i mlan0 -n tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on mlan0, link-type EN10MB (Ethernet), capture size 262144 bytes Why is this ...
0
votes
0answers
93 views

Sendmail - I/O error “Premature EOM” in maillogs

We're using sendmail as an MTA to send confirmation emails to customers that place orders on another server running IIS. Occasionally we see lines like this in the logs: SYSERR(root): collect: I/O ...
2
votes
1answer
385 views

tcpdump won't capture entire packet

I'm using sudo tcpdump -A -s0 -ien0 port 80 | grep schemas-microsoft >> ~/Downloads/convert.txt to capture microsoft-schema xmls being sent throught the internet, when tcpdump is supposed to ...
1
vote
0answers
126 views

TCPDump To Capture A Tracepath6 Datagram

I'm trying to use TCPDump to capture an IPv6 datagram using: tcpdump -c 1 -i eth1 -vvvs0 ip6 and dst host H2.net2 & tracepath6 H2.net2 I'm running this script on H1.net1; R12.net1 is the ...
1
vote
0answers
139 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
2answers
280 views

tcpdump doesn't appear to be capturing any data, why?

I'm trying to capture data with tcpdump like so: $ sudo tcpdump -Xi eth0 I have the device and the PC connected to each other. On both sides I launch a simple test application that sends a message ...
1
vote
1answer
231 views

tcpdump and nc with udp

I don't understand the behaviour of netcat. Let's say that I have one host acting as server: [root@localhost tmp]# nc -u -l -p 670 Then I try to connect from a client: root@debian:/tmp# nc -u ...
0
votes
0answers
38 views

Unable to capture trace with -w option

I am not able to capture trace with the -w option on my fedora machine. Please see the log below : [root@localhost home]# tcpdump -w /home/trace.cap -i eth2 -s 0 tcpdump: listening on eth2, link-type ...
1
vote
1answer
730 views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
0
votes
1answer
18 views

tcpdump Filter with certain file types?

I use the unix command tcpdump with these extensions -A -s0 -ien0 port 80 I know how to add, for example a new host, that would be and \ host random.com Can I sniff for certain filetypes? I have ...
2
votes
1answer
529 views

How to update tcpdump?

I would like to update tcpdump on my computer (CentOS 6.5) which is currently old. I download the zip file from TCPDUMP/LIBPCAP public repository already but I don't know how to update with this file. ...
3
votes
2answers
2k views

Piping tcpdump traffic via SSH - but no root ssh access

The situation I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH ...
15
votes
3answers
12k views

Why would the kernel drop packets?

I interrupted tcpdump with Ctrl+C and got this total summary: 579204 packets captured 579346 packets received by filter 142 packets dropped by kernel What are the "packets dropped by kernel"? Why ...
1
vote
0answers
308 views

tcpdump not capturing http or tcp/ssl traffic

I have been trying to learn tcpdump and I am using this command to attempt to monitor my network: sudo tcpdump -I -i en1 But this gives me a bunch of stuff I don't want, so I used this version to ...
2
votes
0answers
2k views

Creating multicast join for tcpdump captures

I want to write a linux shell script which will capture specific multicast traffic. Specific as in, I want to create a pcap file that has all the traffic for one specific multicast group/port. Here ...
1
vote
1answer
624 views

Capture web traffic grouped by individual TCP streams

As far as I know a HTTP request and response constructs one TCP connection. To debug a web application on a GUI-less server, I'd like to be able to capture these TCP streams in a single ...
4
votes
1answer
652 views

How to investigate a random reset on TCP client port connected via loopback interface to a server

I have a test suite which initializes a server on the localhost and then runs thousands of stress tests which include starting and stopping clients connecting to this local server on same machine. I ...
2
votes
2answers
224 views

“tcpdump” to capture the last packets

I am monitoring a certain port, because my application uses that port, it seems that the connection drops at random times, I want to see what are the last packets passing through before the connection ...
1
vote
2answers
95 views

Remove pauses greater than x from pcap file

I've captured udp traffic to a pcap file. When replaying with tcpreplay-edit, I'd like to shorten all pauses (where there is no udp traffic at all) to x seconds max. tcpreplay-edit only has a global ...
2
votes
2answers
352 views

Do not display ACK packets

I have the following tcpdump -i eth0 -n tcp port 5000 to filter every packet flowing between 2 hosts. However, one of the hosts always sends an ACK. How do I hide this ACK?
1
vote
0answers
156 views

Is it possible to view unicode text in tcpdump capture output?

Unfortunately seems like tcpdump is not capable of detecting and displaying Unicode-encoded text (specifically utf-8) in captures. It treats unicode text like regular binary data and displays it in ...
1
vote
1answer
224 views

How to log incoming icmp traffic?

I am watching my ip6table and observing an icmp packet arriving and getting dropped at the rate of 1 per second. I am trying to find out what that message is about. I tried using tcpdump (it is ...
2
votes
1answer
40 views

How to sniff download information of different pc's on a network(router)

Actually I am making an Log Analyzer for downloads on a network by different users.So i want to know who downloaded what in a same network.I know SSL packets cannot be sniffed but I want only ...
7
votes
3answers
2k views

How does one capture traffic on virtual interfaces?

I would like to capture traffic on Linux virtual interfaces, for debugging purposes. I have been experimenting with veth, tun and dummy interface types; on all three, I am having trouble getting ...
3
votes
1answer
306 views

tcpdump command works only on local ip

I am trying to capture some IP packets in my personal LAN with tcpdump, through the command tcpdump -A -i eth0 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) ...
3
votes
3answers
1k views

How to record an interactice socat TCP/TLS session?

Socat is great for interactively testing line based human readable protocols like HTTP or IMAP. For example: $ socat -d -d READLINE,history=$HOME/s.hist openssl:host:port,crnl,cafile=some.ca For ...