3
votes
1answer
90 views

Using tcpdump to log blacklisted IPs

I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially ...
4
votes
1answer
210 views

Tell tcpdump to skip custom header

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
1
vote
1answer
650 views

Tcpdump: how to capture outgoing packets on a virtual interface?

On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header. now this ...
8
votes
1answer
859 views

what level of the network stack does tcpdump get its info from?

As I was trying in vain to fix a faulty ethernet controller here, one thing I tried was running tcpdump on the machine. I found it interesting that tcpdump was able to detect that some of the ICMP ...
2
votes
1answer
360 views

How to know the number of messages received in a message queue at a point of time

I have a implementation where the hardware dispatches 300 packets every second to a host application through DMA transfer and then to the host application's message queue. When packets are sent at ...
0
votes
2answers
695 views

Understanding tcpdump output on a linux router

My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address. When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN). 05:34:19.504895 ...