2
votes
0answers
56 views

Creating multicast join for tcpdump captures

I want to write a linux shell script which will capture specific multicast traffic. Specific as in, I want to create a pcap file that has all the traffic for one specific multicast group/port. Here ...
3
votes
1answer
114 views

Using tcpdump to log blacklisted IPs

I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially ...
4
votes
1answer
279 views

Tell tcpdump to skip custom header

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
1
vote
1answer
729 views

Tcpdump: how to capture outgoing packets on a virtual interface?

On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header. now this ...
9
votes
1answer
1k views

what level of the network stack does tcpdump get its info from?

As I was trying in vain to fix a faulty ethernet controller here, one thing I tried was running tcpdump on the machine. I found it interesting that tcpdump was able to detect that some of the ICMP ...
2
votes
1answer
480 views

How to know the number of messages received in a message queue at a point of time

I have a implementation where the hardware dispatches 300 packets every second to a host application through DMA transfer and then to the host application's message queue. When packets are sent at ...
0
votes
2answers
759 views

Understanding tcpdump output on a linux router

My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address. When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN). 05:34:19.504895 ...