a command line packet analyzer

learn more… | top users | synonyms

0
votes
2answers
338 views

packets seen in ifconfig but not on tcpdump

On ifconfig I can see the number of packets sent/received with the tx/rx values. With that interface on promiscuous mode, if I turn on tcpdump on that interface I should see all packets sent/received ...
4
votes
1answer
963 views

How to investigate a random reset on TCP client port connected via loopback interface to a server

I have a test suite which initializes a server on the localhost and then runs thousands of stress tests which include starting and stopping clients connecting to this local server on same machine. I ...
3
votes
1answer
238 views

Using tcpdump to log blacklisted IPs

I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially ...
1
vote
1answer
76 views

pcap file 20 times smaller than ifconfig TX/RX difference for same period

I run tcpdump on a usb modem in network card mode. [ 18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64 I run it ...
1
vote
1answer
51 views

Network issue - only one machine can't access webpage on another machine

I'm trying to figure out why my MacBook is unable to reach the web page served by my Raspberry Pi while other computers on my local network (or on external networks) have no problems seeing the web ...
0
votes
1answer
25 views

How often does the tcpdump save into the file

I've got an question, concerning the tcpdumd. Does it save the data directly in the File you can give it with -w, or does it save when it's stopped? So if it was writing on a usbstick, can I just ...
0
votes
1answer
59 views

how to remove NFLOG interface?

I am trying to make a packet sniffing program in C but the codes am trying to run from various public sources are not returning traffic from my Ethernet pot 'em1' but always reading 'nflog interface'. ...
0
votes
1answer
49 views

How does aircrack-ng suite view Clients on networks we are not connected to?

I noticed with the tool airodump-ng which is apart of the aircrack-ng suite we can view all networks around us along with Client MAC address's which are connected to these networks. How can I acheive ...
0
votes
1answer
36 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
0
votes
1answer
957 views

tcpdump - capture trace in both directions on RHEL6

I am using redhat bonding and have identified my active interface as eth5. I am using Redhat 6.5 Server Here is my command: tcpdump -i eth5 src host actual_ip_address_of_external_client after ...
0
votes
1answer
193 views

put tcpdump in promiscuous mode and sniffing from any pc

At my home I use a wireless router to connect to internet, so every device uses wireless card to use it. In this way using sudo tcpdump -i wlan0 from my pc I should be able to see all the packets ...
0
votes
1answer
235 views

Smallest packet sniffer for an embedded device?

Are there tiny packet sniffers out there? I'm looking for something that can be compiled for a embedded device with very limited space. I thought of tcpdump but a dynamically linked and stripped ...
0
votes
1answer
30 views

tcpdump Filter with certain file types?

I use the unix command tcpdump with these extensions -A -s0 -ien0 port 80 I know how to add, for example a new host, that would be and \ host random.com Can I sniff for certain filetypes? I have ...
-1
votes
1answer
117 views

capture FTP traffic for both active and passive FTP sessions

I understand that the command tcpdump can be used to capture traffic. How would I use that to record all the active and passive FTP traffic on my machine?
-1
votes
1answer
388 views

tcpdump host filter doesn't work

I'm using tcpdump on a linux ARM computer (Raspberry Pi). The command tcpdump host "ip" -v gives nothing when I go on the website "ip" with my laptop, but if I try tcpdump port 80 -v it works ...
3
votes
0answers
6k views

Dumping multicast UDP stream with socat

I am setting up video streaming. In local network, there are two devices streaming video over UDP multicast. One is regular computer with Linux (streaming to 239.220.221.10, port 9200), second one is ...
2
votes
0answers
167 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
2
votes
0answers
526 views

tcpdump not capturing http or tcp/ssl traffic

I have been trying to learn tcpdump and I am using this command to attempt to monitor my network: sudo tcpdump -I -i en1 But this gives me a bunch of stuff I don't want, so I used this version to ...
2
votes
0answers
4k views

Creating multicast join for tcpdump captures

I want to write a linux shell script which will capture specific multicast traffic. Specific as in, I want to create a pcap file that has all the traffic for one specific multicast group/port. Here ...
2
votes
0answers
309 views

Is it possible to view unicode text in tcpdump capture output?

Unfortunately seems like tcpdump is not capable of detecting and displaying Unicode-encoded text (specifically utf-8) in captures. It treats unicode text like regular binary data and displays it in ...
2
votes
0answers
267 views

tcpdump hello server certificate

On a device located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet. So I'm trying to figure out how to get ...
2
votes
0answers
224 views

router latency measured by tcpdump increases

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
1
vote
0answers
24 views

Userspace Network Stack

I am writing a (very simple) userland IP network stack. For this purpose, I need to go "around" the OS network stack and obtain the raw Ethernet frames. The tap interface sounds like a way to go, but ...
1
vote
0answers
55 views

Is there a utility that allows to create structured data from tcpdump hexdumps?

Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse. Is there a utility that could read tcpdump packets in hex dump format and ...
1
vote
0answers
90 views

killall doesn't work if I call it from a script

I'm starting a tcpdump inside a script and I also kill it from the same script. So I'm currently using the killall command for this: The script gets executed from an udev rule: This is the section, ...
1
vote
0answers
56 views

Count all network requests to a specific host

I have a mock server running on my localhost that mocks out a back end service that I need for my app. One thing that I want to do is count the number of requests [GET, POST, PUT, DELETE,...] that my ...
1
vote
0answers
125 views

How can I log outgoing TCP traffic including the full path of URLs?

I use a program regularly on Linux that makes a TCP request when it starts up and updates a file with an access token before launching. I'd like to write a batch script that makes this request (using ...
1
vote
0answers
620 views

tcpdump - packets dropped by interface

The man for tcpdump states what can cause "packets dropped by kernel" but it doesn't state what can cause "packets dropped by interface". Can anyone shed some light as to why the interface may be ...
1
vote
0answers
192 views

TCPDump To Capture A Tracepath6 Datagram

I'm trying to use TCPDump to capture an IPv6 datagram using: tcpdump -c 1 -i eth1 -vvvs0 ip6 and dst host H2.net2 & tracepath6 H2.net2 I'm running this script on H1.net1; R12.net1 is the ...
1
vote
0answers
250 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
0answers
752 views

Packets not received by TUN device

I created a TUN device(nat64) and created a route so that all the required packets are forwarded to the TUN device from an eth device. But, I see that many packets are not received by the TUN device. ...
0
votes
0answers
42 views

tcpdump detect if and which IP is under DDoS

I have 20 IPs on my server. I wish to automatically detect with tcpdump which IP is ddosed and remove the specific IP from the server, so it does not affect the other IPs. Can it be done? Will it ...
0
votes
0answers
14 views

Do I get the exact same tcpdump output if I use bond or bridge?

I need to get the tcpdump output. I was unable to set up a bridge but I could set up a bond. Does it matter which one I use when looking at the output of a tcpdump?
0
votes
0answers
164 views

Sendmail - I/O error “Premature EOM” in maillogs

We're using sendmail as an MTA to send confirmation emails to customers that place orders on another server running IIS. Occasionally we see lines like this in the logs: SYSERR(root): collect: I/O ...
0
votes
0answers
41 views

Unable to capture trace with -w option

I am not able to capture trace with the -w option on my fedora machine. Please see the log below : [root@localhost home]# tcpdump -w /home/trace.cap -i eth2 -s 0 tcpdump: listening on eth2, link-type ...