a command line packet analyzer

learn more… | top users | synonyms

22
votes
3answers
24k views

Why would the kernel drop packets?

I interrupted tcpdump with Ctrl+C and got this total summary: 579204 packets captured 579346 packets received by filter 142 packets dropped by kernel What are the "packets dropped by kernel"? Why ...
13
votes
4answers
16k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or ...
13
votes
1answer
10k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
11
votes
1answer
4k views

what level of the network stack does tcpdump get its info from?

As I was trying in vain to fix a faulty ethernet controller here, one thing I tried was running tcpdump on the machine. I found it interesting that tcpdump was able to detect that some of the ICMP ...
8
votes
3answers
3k views

How does one capture traffic on virtual interfaces?

I would like to capture traffic on Linux virtual interfaces, for debugging purposes. I have been experimenting with veth, tun and dummy interface types; on all three, I am having trouble getting ...
5
votes
1answer
429 views

What does this tcpdump line means?

Reading the manpage of tcpdump I found this example tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet' but I don't understand it, especially the last part. The ...
5
votes
1answer
78 views

Can kernel drop an outgoing packet which has been captured by tcpdump?

When an outgoing packet is captured by tcpdump, will it 100% be sent out, and not be dropped by kernel? Does tcpdump intercept on packet delivering path before or after kernel does any/all filtering ...
4
votes
2answers
21k views

How to gather DNS A record requests?

I need to record all outgoing A records on a RedHat PC. I tried using tcpdump: tcpdumpdns=OUTPUT-FILENAME-HERE nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 & It makes ...
4
votes
1answer
2k views

what is “rfc3442-classless-static-routes” in /etc/dhcp/dhclient.conf

I am trying to debug DHCP on my laptop (I am using dhcping and dhcdump to see what the DHCP server sends back). Following is my /etc/dhcp/dhclient.conf. option rfc3442-classless-static-routes code ...
4
votes
2answers
903 views

Do not display ACK packets

I have the following tcpdump -i eth0 -n tcp port 5000 to filter every packet flowing between 2 hosts. However, one of the hosts always sends an ACK. How do I hide this ACK?
4
votes
1answer
527 views

tcpdump don't show src and dst address

I'm having a problem with a tcpdump. The output is: 21:53:53.877873 MPLS (label 266837, exp 0, [S], ttl 255), IP, length: 193 21:53:53.878037 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: ...
4
votes
4answers
2k views

How to capture images transferred via HTTP?

I have multiple browsers and I want save all images with size more than 30KB and save to specified address. What is best way? listen to tcpdump and read the content, and then save to a file, or use ...
4
votes
1answer
1k views

How to recover a file from a tcpdump?

I use tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap to monitor for ex.: my HTTP traffic. I upload a .zip file through HTTP. How can I retrieve the .zip file from the ...
4
votes
1answer
679 views

Tell tcpdump to skip custom header

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
4
votes
1answer
2k views

How can I run tcpdump from a Python script without AppArmor complaining?

For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just ...
4
votes
1answer
963 views

How to investigate a random reset on TCP client port connected via loopback interface to a server

I have a test suite which initializes a server on the localhost and then runs thousands of stress tests which include starting and stopping clients connecting to this local server on same machine. I ...
3
votes
3answers
2k views

How to record an interactice socat TCP/TLS session?

Socat is great for interactively testing line based human readable protocols like HTTP or IMAP. For example: $ socat -d -d READLINE,history=$HOME/s.hist openssl:host:port,crnl,cafile=some.ca For ...
3
votes
3answers
1k views

tcpdump syntax error when specifying portrange as documented

I am using tcpdump on OpenBSD and trying to learn it from a primer on it. I want to capture a range of ports, but it seems how this is done has changed. I can't even find portrange as a keyword in ...
3
votes
1answer
453 views

tcpdump command works only on local ip

I am trying to capture some IP packets in my personal LAN with tcpdump, through the command tcpdump -A -i eth0 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) ...
3
votes
2answers
12k views

tcp dump outgoing connection packets

What is the command syntax to log all tcp connection packets? I am trying to see what address and ports my computer is trying to connect to outgoing so that I may config my firewall.
3
votes
1answer
2k views

Is it possible to capture all network traffic using tcpdump?

I have 3 computers on the same sub-net. Computer A and B are communicating with each other (ping, telnet, etc.). I'd like to see the packets between A and B on computer C. Is it possible to do this ...
3
votes
2answers
172 views

tcpdump : lost packets

Running, either in promiscuous mode or not : tcpdump -i "$INTERFACE" -vvv -n -XX -S -s0 -e I got a bunch of lines and this conclusion when I stopped it : 601 packets captured 938 packets received ...
3
votes
2answers
3k views

Piping tcpdump traffic via SSH - but no root ssh access

The situation I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH ...
3
votes
2answers
6k views

Using tcpdump to extract NFS RPC contents

Fairly simple question... I'm running tcpdump and trying to analyze the contents of the TCP packets between server/client. I see the "GETATTR" RPC being received, which is great! However, I want to ...
3
votes
1answer
2k views

Count in real time the output lines from another output command

I think what I want to do is very easy, but I can not find a way to do that: If I put this command: [root@:Active] tmp # tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X | ...
3
votes
1answer
3k views

Sniffing VirtualBox machine behind NAT

I have a VirtualBox machine with a single interface connected to VB's NAT mode. What I would like to do is sniff all traffic coming from/to any machine behind that NAT. (I don't think I will need to ...
3
votes
1answer
281 views

sandbox tcpdump under OpenBSD?

From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running: tcpdump -w output.pcap because it can be only used ...
3
votes
1answer
475 views

Huge packet loss on openwrt

I have a strange issue on mikrotik rb951-2hnd router. I built image a few years ago using revision 39392 and patch firmwared it and everything worked fine. Just a few months ago I decided to update ...
3
votes
0answers
6k views

Dumping multicast UDP stream with socat

I am setting up video streaming. In local network, there are two devices streaming video over UDP multicast. One is regular computer with Linux (streaming to 239.220.221.10, port 9200), second one is ...
3
votes
1answer
238 views

Using tcpdump to log blacklisted IPs

I am using tcpdump to log traffic outbound on a network. I would like to be able to log traffic on a host or IP-only basis but then I would like to be able to log large numbers of potentially ...
2
votes
1answer
1k views

tcpdump and https

Why following command doesnt grab the packets to faceebook site sudo tcpdump host facebook.com and dst port 443 but next grabs sudo tcpdump host java.com
2
votes
3answers
2k views

Running tcpdump, tee and scp

I'm trying to run the following: $ tcpdump -l -X -i eth1 -n tcp port <port> | tee capture.txt | \ scp capture.txt root@10.3.3.227:/home/checker/ tcpdump -l -X -i eth1 -n tcp port ...
2
votes
3answers
1k views

Rotating logs generated from tcpdump with logrotate

On one production linux box, I am capturing SIP packets using the following configuration: logrotate.conf: # Opensips SIP traces /var/log/sip.log { rotate 31 daily missingok ...
2
votes
1answer
1k views

Capture web traffic grouped by individual TCP streams

As far as I know a HTTP request and response constructs one TCP connection. To debug a web application on a GUI-less server, I'd like to be able to capture these TCP streams in a single ...
2
votes
1answer
16k views

tcpdump: “packets captured” vs “packets received by filter”

We have a script which calls tcpdump -v src host <IP address> and port <port number> >>out.txt 2>>err.txt -w capture.cap on multiple IP-s while the other parts of the script ...
2
votes
1answer
5k views

iptrace for linux: how can I trace full packet contents?

I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos. Does anyone know what the analog would be? ...
2
votes
3answers
490 views

Why is tcpdump output file empty?

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, ...
2
votes
1answer
2k views

tcpdump of SCCP or GSM MAP messages

Right now I'm using tcpdump -i <interface_name> -p <port> -s0 -w /tmp/file.cap and then filter the capture in wireshark. How can I take packet capture with tcpdump only on SCCP or GSM_MAP ...
2
votes
2answers
60 views

How to get different types of ICMP

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
2
votes
2answers
66 views

Ping and tcpdump at the same time

The situation is this - There is one script on the server which make ping to somewhere and I don't know to where. I want to see to which machine is this ping make and why is returning FAILED. What I ...
2
votes
1answer
69 views

tcpdump waits a second before displaying packets

On Linux Mint (either 17 or 17.1) I'm using tcpdump to capture some packets with this command: tcpdump -UnvXSs 4096 -B 1024 -i eth0 Despite the -U option, it doesn't actually output packets ...
2
votes
1answer
2k views

tcpdump won't capture entire packet

I'm using sudo tcpdump -A -s0 -ien0 port 80 | grep schemas-microsoft >> ~/Downloads/convert.txt to capture microsoft-schema xmls being sent throught the internet, when tcpdump is supposed to ...
2
votes
1answer
1k views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
2
votes
1answer
998 views

How to update tcpdump?

I would like to update tcpdump on my computer (CentOS 6.5) which is currently old. I download the zip file from TCPDUMP/LIBPCAP public repository already but I don't know how to update with this file. ...
2
votes
2answers
489 views

“tcpdump” to capture the last packets

I am monitoring a certain port, because my application uses that port, it seems that the connection drops at random times, I want to see what are the last packets passing through before the connection ...
2
votes
1answer
41 views

How to sniff download information of different pc's on a network(router)

Actually I am making an Log Analyzer for downloads on a network by different users.So i want to know who downloaded what in a same network.I know SSL packets cannot be sniffed but I want only ...
2
votes
1answer
852 views

How to read a hexdump byte by byte in bash or awk?

This is the hexadecimal output of an IPv6 TCP packet captured with tcpdump: 6000 0000 0018 0620 0000 0000 0000 0000 0000 0000 0000 0001 0000 0000 0000 0000 0000 0000 0000 0002 *0026 0026 0000 ...
2
votes
1answer
914 views

How to know the number of messages received in a message queue at a point of time

I have a implementation where the hardware dispatches 300 packets every second to a host application through DMA transfer and then to the host application's message queue. When packets are sent at ...
2
votes
0answers
167 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
2
votes
0answers
526 views

tcpdump not capturing http or tcp/ssl traffic

I have been trying to learn tcpdump and I am using this command to attempt to monitor my network: sudo tcpdump -I -i en1 But this gives me a bunch of stuff I don't want, so I used this version to ...