a command line packet analyzer

learn more… | top users | synonyms

1
vote
1answer
312 views

How to rotate tcpdump files?

I want to take a continuous dump file of particular size and after the dump reached it predefined size the new data should overwrite the file. Help
1
vote
1answer
44 views

Network issue - only one machine can't access webpage on another machine

I'm trying to figure out why my MacBook is unable to reach the web page served by my Raspberry Pi while other computers on my local network (or on external networks) have no problems seeing the web ...
2
votes
2answers
6k views

tcp dump outgoing connection packets

What is the command syntax to log all tcp connection packets? I am trying to see what address and ports my computer is trying to connect to outgoing so that I may config my firewall.
2
votes
3answers
963 views

Running tcpdump, tee and scp

I'm trying to run the following: $ tcpdump -l -X -i eth1 -n tcp port <port> | tee capture.txt | \ scp capture.txt root@10.3.3.227:/home/checker/ tcpdump -l -X -i eth1 -n tcp port ...
3
votes
3answers
669 views

tcpdump syntax error when specifying portrange as documented

I am using tcpdump on OpenBSD and trying to learn it from a primer on it. I want to capture a range of ports, but it seems how this is done has changed. I can't even find portrange as a keyword in ...
3
votes
2answers
3k views

Using tcpdump to extract NFS RPC contents

Fairly simple question... I'm running tcpdump and trying to analyze the contents of the TCP packets between server/client. I see the "GETATTR" RPC being received, which is great! However, I want to ...
2
votes
3answers
769 views

Rotating logs generated from tcpdump with logrotate

On one production linux box, I am capturing SIP packets using the following configuration: logrotate.conf: # Opensips SIP traces /var/log/sip.log { rotate 31 daily missingok ...
4
votes
1answer
398 views

tcpdump don't show src and dst address

I'm having a problem with a tcpdump. The output is: 21:53:53.877873 MPLS (label 266837, exp 0, [S], ttl 255), IP, length: 193 21:53:53.878037 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: ...
1
vote
1answer
246 views

What does “0x0030: 061c 0dd8 4745 5420 2f20 4854 5450 2f31” mean in tcpdump?

I am trying to learn tcpdump. I ran the following command:- tcpdump -i eth0 -lnXs1600 host google.com and port 80 and got the following results:- 2:23:45.781779 IP 10.16.30.28.42957 > ...
3
votes
1answer
173 views

Using tcpdump to log blacklisted IPs

I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially ...
2
votes
1answer
2k views

Sniffing VirtualBox machine behind NAT

I have a VirtualBox machine with a single interface connected to VB's NAT mode. What I would like to do is sniff all traffic coming from/to any machine behind that NAT. (I don't think I will need to ...
-1
votes
1answer
265 views

tcpdump host filter doesn't work

I'm using tcpdump on a linux ARM computer (Raspberry Pi). The command tcpdump host "ip" -v gives nothing when I go on the website "ip" with my laptop, but if I try tcpdump port 80 -v it works ...
1
vote
0answers
590 views

Packets not received by TUN device

I created a TUN device(nat64) and created a route so that all the required packets are forwarded to the TUN device from an eth device. But, I see that many packets are not received by the TUN device. ...
4
votes
1answer
468 views

Tell tcpdump to skip custom header

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
1
vote
1answer
958 views

Tcpdump: how to capture outgoing packets on a virtual interface?

On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header. now this ...
5
votes
1answer
321 views

What does this tcpdump line means?

Reading the manpage of tcpdump I found this example tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet' but I don't understand it, especially the last part. The ...
0
votes
1answer
116 views

Filesystem writes seemingly lost

I've been experimenting with tcpdump, and I've found some very bizarre filesystem behavior. It doesn't look to be a tcpdump problem as I'll explain in a second. The following command produces no ...
1
vote
1answer
899 views

tcpdump and https

Why following command doesnt grab the packets to faceebook site sudo tcpdump host facebook.com and dst port 443 but next grabs sudo tcpdump host java.com
4
votes
4answers
2k views

How to capture images transferred via HTTP?

I have multiple browsers and I want save all images with size more than 30KB and save to specified address. What is best way? listen to tcpdump and read the content, and then save to a file, or use ...
2
votes
0answers
204 views

router latency measured by tcpdump increases

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
1
vote
1answer
503 views

How to log all domains accessed?

Maybe I could use tcpdump, filter out all non-HTTP packets to reduce disk consumption, and then parse the output looking for domain names. Maybe there is a better solution. Do you know one?
2
votes
1answer
11k views

tcpdump: “packets captured” vs “packets received by filter”

We have a script which calls tcpdump -v src host <IP address> and port <port number> >>out.txt 2>>err.txt -w capture.cap on multiple IP-s while the other parts of the script ...
3
votes
1answer
246 views

sandbox tcpdump under OpenBSD?

From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running: tcpdump -w output.pcap because it can be only used ...
4
votes
1answer
1k views

How to recover a file from a tcpdump?

I use tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap to monitor for ex.: my HTTP traffic. I upload a .zip file through HTTP. How can I retrieve the .zip file from the ...
1
vote
3answers
1k views

using “-vvv” with “-w FILENAME” with tcpdump makes better output?

Does it makes a more detailed output if I use tcpdump -vvv -w FILENAME vs. if I use: tcpdump -w FILENAME or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?
3
votes
1answer
2k views

Count in real time the output lines from another output command

I think what I want to do is very easy, but I can not find a way to do that: If I put this command: [root@:Active] tmp # tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X | ...
2
votes
2answers
14k views

How to gather DNS A record requests?

I need to record all outgoing A records on a RedHat PC. I tried using tcpdump: tcpdumpdns=OUTPUT-FILENAME-HERE nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 & It makes ...
2
votes
1answer
3k views

iptrace for linux: how can I trace full packet contents?

I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos. Does anyone know what the analog would be? ...
2
votes
1answer
686 views

How to read a hexdump byte by byte in bash or awk?

This is the hexadecimal output of an IPv6 TCP packet captured with tcpdump: 6000 0000 0018 0620 0000 0000 0000 0000 0000 0000 0000 0001 0000 0000 0000 0000 0000 0000 0000 0002 *0026 0026 0000 ...
10
votes
1answer
2k views

what level of the network stack does tcpdump get its info from?

As I was trying in vain to fix a faulty ethernet controller here, one thing I tried was running tcpdump on the machine. I found it interesting that tcpdump was able to detect that some of the ICMP ...
1
vote
2answers
2k views

How to modify the output of tcpdump to be human-readable?

I have a tcpdump command: tcpdump -i wlan0 dst port 80 and ! dst 192.168.1.201 and ! src 192.168.1.201 -vvv -s0 -w proba.txt Which gives the following output: root@SERVER:/tmp# egrep "GET|Host:" ...
4
votes
1answer
2k views

How can I run tcpdump from a Python script without AppArmor complaining?

For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just ...
2
votes
1answer
694 views

How to know the number of messages received in a message queue at a point of time

I have a implementation where the hardware dispatches 300 packets every second to a host application through DMA transfer and then to the host application's message queue. When packets are sent at ...
12
votes
1answer
7k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
3
votes
1answer
2k views

Is it possible to capture all network traffic using tcpdump?

I have 3 computers on the same sub-net. Computer A and B are communicating with each other (ping, telnet, etc.). I'd like to see the packets between A and B on computer C. Is it possible to do this ...
9
votes
3answers
10k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or ...
0
votes
2answers
948 views

Understanding tcpdump output on a linux router

My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address. When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN). 05:34:19.504895 ...