a command line packet analyzer

learn more… | top users | synonyms

1
vote
1answer
659 views

Why are tcpdump - packets being dropped by interface? [duplicate]

I'm using Ubuntu 14.04 via Virtual Box on a Windows 7 host. The NIC is a USB to Ethernet adapter. The man for tcpdump states what can cause "packets dropped by kernel" but it doesn't state what ...
4
votes
1answer
984 views

How to investigate a random reset on TCP client port connected via loopback interface to a server

I have a test suite which initializes a server on the localhost and then runs thousands of stress tests which include starting and stopping clients connecting to this local server on same machine. I ...
0
votes
1answer
1k views

tcpdump - capture trace in both directions on RHEL6

I am using redhat bonding and have identified my active interface as eth5. I am using Redhat 6.5 Server Here is my command: tcpdump -i eth5 src host actual_ip_address_of_external_client after ...
1
vote
1answer
33 views

Continuous log-rotated tcpdump - dealing with interface disconnections

I'm currently running a continuous tcpdump job with the following command: tcpdump -pni en4 -G 3600 -w 'data/trace_%Y-%m-%d_%H:%M:%S.pcap' It runs very well over long periods of time, creating one ...
1
vote
0answers
29 views

Userspace Network Stack

I am writing a (very simple) userland IP network stack. For this purpose, I need to go "around" the OS network stack and obtain the raw Ethernet frames. The tap interface sounds like a way to go, but ...
0
votes
1answer
50 views

How does aircrack-ng suite view Clients on networks we are not connected to?

I noticed with the tool airodump-ng which is apart of the aircrack-ng suite we can view all networks around us along with Client MAC address's which are connected to these networks. How can I acheive ...
1
vote
0answers
56 views

Is there a utility that allows to create structured data from tcpdump hexdumps?

Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse. Is there a utility that could read tcpdump packets in hex dump format and ...
0
votes
2answers
74 views

Using Both Grep and Cut

I want to grep the output of tcpdump and cut some part of it but the command below is not working. tcpdump ... | grep -i --line-buffered "..." | cut -d'&' -f1,2 Do you know what is the problem? ...
0
votes
0answers
47 views

tcpdump detect if and which IP is under DDoS

I have 20 IPs on my server. I wish to automatically detect with tcpdump which IP is ddosed and remove the specific IP from the server, so it does not affect the other IPs. Can it be done? Will it ...
0
votes
1answer
78 views

ssh authentication and remote command output's redirection

I need to run a remote capture on a host via ssh and to authenticate twice, but the second prompt is being redirected. ssh -t user@host "sudo tcpdump -s 0 -n -w - -U -i eth0 not port 22" > ...
13
votes
1answer
11k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
3
votes
2answers
207 views

tcpdump : lost packets

Running, either in promiscuous mode or not : tcpdump -i "$INTERFACE" -vvv -n -XX -S -s0 -e I got a bunch of lines and this conclusion when I stopped it : 601 packets captured 938 packets received ...
3
votes
1answer
507 views

Huge packet loss on openwrt

I have a strange issue on mikrotik rb951-2hnd router. I built image a few years ago using revision 39392 and patch firmwared it and everything worked fine. Just a few months ago I decided to update ...
1
vote
0answers
93 views

killall doesn't work if I call it from a script

I'm starting a tcpdump inside a script and I also kill it from the same script. So I'm currently using the killall command for this: The script gets executed from an udev rule: This is the section, ...
0
votes
0answers
15 views

Do I get the exact same tcpdump output if I use bond or bridge?

I need to get the tcpdump output. I was unable to set up a bridge but I could set up a bond. Does it matter which one I use when looking at the output of a tcpdump?
0
votes
1answer
26 views

How often does the tcpdump save into the file

I've got an question, concerning the tcpdumd. Does it save the data directly in the File you can give it with -w, or does it save when it's stopped? So if it was writing on a usbstick, can I just ...
1
vote
2answers
81 views

tcpdump multiple pcaps w/ xargs

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine. There are examples online, but the only one I ...
-1
votes
1answer
124 views

capture FTP traffic for both active and passive FTP sessions

I understand that the command tcpdump can be used to capture traffic. How would I use that to record all the active and passive FTP traffic on my machine?
1
vote
2answers
78 views

Capturing Traffic of Router

My machine is connected to a wireless router. Is it possible to analyse packets coming and going to the router? Can I use the bridged mode for achieving this? Actually I want the original packets ...
1
vote
2answers
47 views

tcpdump bassed datalogger

I am building a datalogger with raspberry pi. I have used a Shell script in rc.local, I am capturing the bytes using tcpdump. The Problem am facing is that the log file is getting replaced each and ...
0
votes
1answer
68 views

how to remove NFLOG interface?

I am trying to make a packet sniffing program in C but the codes am trying to run from various public sources are not returning traffic from my Ethernet pot 'em1' but always reading 'nflog interface'. ...
2
votes
2answers
72 views

How to get different types of ICMP

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
2
votes
1answer
1k views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
2
votes
3answers
574 views

Why is tcpdump output file empty?

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, ...
5
votes
1answer
87 views

Can kernel drop an outgoing packet which has been captured by tcpdump?

When an outgoing packet is captured by tcpdump, will it 100% be sent out, and not be dropped by kernel? Does tcpdump intercept on packet delivering path before or after kernel does any/all filtering ...
1
vote
1answer
169 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
0
votes
1answer
1k views

What does 'TS val' mean in tcpdump's output?

I'm monitoring the network activities between two processes on compute:42967 and controller:5672(controller.amqp). It captured compute.42967 with three SYN(they have the same seq number) while the ...
2
votes
2answers
73 views

Ping and tcpdump at the same time

The situation is this - There is one script on the server which make ping to somewhere and I don't know to where. I want to see to which machine is this ping make and why is returning FAILED. What I ...
0
votes
1answer
86 views

Sniffing packets realtime

I've been using tcpdump and it's good, but it exhibits issues here. Other programs like hexinject, tcpflow, and tracedump all use pcap so they delay a bit before displaying the packets. I've also ...
14
votes
4answers
16k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or ...
2
votes
1answer
75 views

tcpdump waits a second before displaying packets

On Linux Mint (either 17 or 17.1) I'm using tcpdump to capture some packets with this command: tcpdump -UnvXSs 4096 -B 1024 -i eth0 Despite the -U option, it doesn't actually output packets ...
0
votes
2answers
668 views

date time as file name for dump file

I'm using Gulp to capture packets at 100Mbps to a folder. But I would like to name the files in format job_<'%Y_%m_%d_%H_%M_%S'>.pcap, but it gives files job.pcap0, job.pcap2 etc. The script I use ...
1
vote
1answer
80 views

pcap file 20 times smaller than ifconfig TX/RX difference for same period

I run tcpdump on a usb modem in network card mode. [ 18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64 I run it ...
4
votes
2answers
21k views

How to gather DNS A record requests?

I need to record all outgoing A records on a RedHat PC. I tried using tcpdump: tcpdumpdns=OUTPUT-FILENAME-HERE nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 & It makes ...
1
vote
1answer
59 views

Use different filtering criteria with tcpdump packet size

When running tcpdump like this tcpdump -s96 -i eth0 ip -w output_filename is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?
1
vote
1answer
60 views

Adding the ip to the filter of tcpdump

I use this tcpdump command to HTTP GET filtering : tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' How can add IP address to this filter?
0
votes
2answers
353 views

packets seen in ifconfig but not on tcpdump

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received ...
1
vote
1answer
116 views

check tcp packets reception below tcpdump level

I am having an issue with my smartphone device and packets monitoring: I am trying to find a reason why I cannot establish a VPN connection via PPTP protocol. I have the following successful ...
1
vote
1answer
242 views

How to capture traffic from a website using tcpdump

I need to capture traffic to https://gmail.com using tcpdump. I solved this by using tcpdump -n dst host <ipaddress of gmail> But is there any way I can directly specify gmail.com instead of the ...
1
vote
2answers
399 views

tcpdump captures network-wide UDP traffic, but not TCP

When observing traffic with sudo tcpdump udp, it behaves like it should: I can see all traffic which is happening in the network, even when the machine which I am using is not involved. However, when ...
0
votes
1answer
36 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
4
votes
1answer
2k views

what is “rfc3442-classless-static-routes” in /etc/dhcp/dhclient.conf

I am trying to debug DHCP on my laptop (I am using dhcping and dhcdump to see what the DHCP server sends back). Following is my /etc/dhcp/dhclient.conf. option rfc3442-classless-static-routes code ...
1
vote
0answers
56 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
0
votes
1answer
206 views

put tcpdump in promiscuous mode and sniffing from any pc

At my home I use a wireless router to connect to internet, so every device uses wireless card to use it. In this way using sudo tcpdump -i wlan0 from my pc I should be able to see all the packets ...
22
votes
3answers
25k views

Why would the kernel drop packets?

I interrupted tcpdump with Ctrl+C and got this total summary: 579204 packets captured 579346 packets received by filter 142 packets dropped by kernel What are the "packets dropped by kernel"? Why ...
0
votes
1answer
1k views

tcpdump -i any and promiscuous mode

From the man page for tcpdump 4.1.1 (yes I know its old) -i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured ...
2
votes
0answers
176 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
0
votes
1answer
247 views

Smallest packet sniffer for an embedded device?

Are there tiny packet sniffers out there? I'm looking for something that can be compiled for a embedded device with very limited space. I thought of tcpdump but a dynamically linked and stripped ...
1
vote
1answer
398 views

one way file sync with unison or better alternative

I have been collecting a logs for user actions on the network using a program similar to tcpdumps; with every millisecond the file being written to. I am currently using unison to synchronize the logs ...
0
votes
1answer
139 views

tcpreplay output to STDOUT?

$ tcpreplay tcpdump-2015-01-02-18h-13m.pcap ERROR: The intf1 option is required tcpreplay (tcpreplay) - Replay network traffic stored in pcap files USAGE: tcpreplay [ -<flag> ...