Tag Info

Hot answers tagged

12

Tcpdump has the option -B to set the capture buffer size. The value is then passed to libpcap (library used by tcpdump to do the actual packet capturing) via pcap_set_buffer_size() function. Tcpdump manpage does not specify in what units the buffer size is specified with -B, but from the source it seems that it is KiB: ...


10

https://facebook.com redirects to https://www.facebook.com which has a different IP Address than facebook.com. There is also ssl.facebook.com but I am not sure what it is used for: $ host facebook.com facebook.com has address 69.171.229.11 facebook.com has address 69.171.224.37 facebook.com has address 66.220.158.11 facebook.com has address 66.220.149.11 ...


8

Yes. By putting network interfaces into promiscuous mode, tcpdump is able to see exactly what is going out (and in) the network interface. tcpdump operates at layer2 +. it can be used to look at Ethernet, FDDI, PPP & SLIP, Token Ring, and any other protocol supported by libpcap, which does all of tcpdump's heavy lifting. Have a look at the ...


8

Straight out of man tcpdump -l Make stdout line buffered. Useful if you want to see the data while capturing it. E.g.,``tcpdump -l | tee dat'' or ``tcpdump -l > dat & tail -f dat''.


6

You can parse the second part of that filter thusly not ( (src and dest) net localnet ) It's shorthand for not src net localnet and not dest net localnet


6

That's probably because a switch only sends traffic down a port if it believes the destination MAC address is attached to that port. On a managed switch, you'd set up monitor mode. On an unmanaged switch, you're left with a couple of options: ARP spoofing, to trick the rest of the network about which MAC address corresponds to the target IP address. You ...


5

No, I don't think so, from the manpage: -w Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Stan‐ dard output is used if file is ``-''. -- note "raw packets" -- -v When parsing and printing, produce (slightly more) verbose out‐ put. ...


5

Use Wireshark: tshark -f "udp port 53" -R "dns.qry.type == A and dns.flags.response == 0"


5

Unix signal delivery is asynchronous. When the kill system call returns, the signal has been delivered to the process, but the process may not have reacted to it yet. You were lucky with the scheduler under 11.04. If the killed process has a handler for the signal, it can spend an arbitrarily long time before dying, or choose not to die as a result of the ...


5

I quite like tcpdump for recording network connections. You actually can use it for what you want to achieve. Instead of using the READLINE endpoint in your socat connection, make it listen to some port. remote server with ssl ^ | (ssl-encrypted) socat | (not ssl-encrypted) v local port <-- run tcpdump here ^ ...


4

The tcpdump is apparently buffering output when it writes to a pipe. It's not flushing output for each write, so the system will write the output in about 4k byte chunks. Your filter is limiting out put so you won't see anything until that filter has written enough output. Once it collects enough it will be written out in a chunk and you should see several ...


4

The reason you're not seeing them is because you're on a switched network. Your network switch only forwards packets to interfaces to which they are destined. This is determined by the link-layer address listed in the packet. Your switch knows that computers A, B & C are on ports 1, 2 & 3 respectively. When a packet is received from computer A on ...


4

The saved portion of each captured packet is defined by the snaplen option. In some distributions, the default snaplen is set to around 68 bytes. The packets are then truncated to 68 bytes, hiding some of the payload. You can save the complete packets by setting the snaplen to 0 (i.e. maximum) as follows: tcpdump -s0 -w test.pcap -i eth0


4

You seem to want the count instead of the 'Start' output. Display count instead: tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X | awk '/Start/ {c++;print c} {}' Display count and line: tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X | awk '/Start/ {c++; print c, $0} {}' Display count on the ...


4

0x0030: 061c 0dd8 4745 5420 2f20 4854 5450 2f31 stands for in the line 0x0030: 061c 0dd8 4745 5420 2f20 4854 5450 2f31 This is a hexadecimal representation of data in the packet starting from byte number 0x0030 or 48. 06 is byte 48, 1c is byte 49 and so on. ....GET./.HTTP/1 is a text representation of the same payload string as above.


4

The tee command writes data to the output file as it receives it, but scp copies the file immediately and only copies it once. Since every command in the pipeline runs simultaneously (or nearly so), you only get a few (or no) packets output to the capture.txt file before the file gets copied by scp. There are a couple ways to do what you seem to want to do. ...


4

For this use case I would suggest capturing only the packets attempting to initiate connections rather than all traffic. That would be anything with only the SYN flag set. tcpdump -ni ${INTERFACE} -w ~/synconnections.pcap tcp[13] == 2 and src host ${MYIP} I cribbed this mostly from the tcpdump man page. The section labelled "Capturing TCP packets with ...


4

The traffic is going over the lo interface. When an IP is added to a box, a route for that address is added to the 'local' table. All the routes in this table route traffic over the loopback interface. You can view the contents of the 'local' table with the following: ip route show table local Which on my system looks like this: local 10.230.134.38 dev ...


4

Filter 'ip6 and icmp6' is all that works for me. According to the manpage, tcpdump doesn't support upper-layer filters on icmpv6; at least with my version. tcpdump version 4.5.1 libpcap version 1.5.3


4

You could copy (or stream) the pcap file to your desktop and use the Wireshark GUI for packet analysis. Besides the GUI, there is also the tshark command (included with Wireshark). Given a stream number, you can get its requests and responses combined in a single output with: $ tshark -q -r http.pcapng -z follow,tcp,ascii,1 ...


4

From the tcpdump's manual: packets ``dropped by kernel'' (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0). A bit of explanation: The tcpdump captures raw packets ...


3

I hope this sheds some light on the issue. From the manpage: When tcpdump finishes capturing packets, it will report counts of: packets captured (this is the number of packets that tcpdump has received and processed); packets received by filter (the meaning of this depends on the OS on which you're running tcpdump, and possibly on the way the ...


3

Host filtering in tcpdump works on MPLS-prefixed packets if you specify "mpls" before the "host" primitive. $ tcpdump 'mpls and host example.com' or $ tcpdump 'host example.com or (mpls and host example.com)' if you're dealing with packets with and without the MPLS prefix.


3

The only flag I'm aware of that affects how much detail you get in -w mode is -s. Historically, tcpdump was built to capture only 68 bytes per packet by default, in order to reduce the I/O load on the system. If you're snooping a web connection, this is enough to get the Ethernet, IP and TCP headers, but probably little to none of the HTTP headers. If ...


3

No. Once you're choosing -w FILENAME it saves the raw data packets as they come through the link. There literally isn't more detail it can save to file. -vvv is only relevant when you're displaying it for human review... And in almost all of the cases where you want humans to read the output, I recommend you use Wireshark.


3

portrange isn't there in OpenBSD's pcap-filter, but you can fake it. tcpdump -i em0 tcp[2:2] > 79 and tcp[2:2] < 85 You can address parts of the packets and compare against them. First number is offset in the packet (starting at zero) and the second number is how many bytes to use. So the above example matches any tcp packet with a destination ...


3

It is not guaranteed that tee finished writing capture.txt when scp reads it. What you could do is use the stdout of tee and pipe it through ssh like this: tcpdump -l -X -i eth1 -n tcp port <port> | tee capture.txt | \ ssh root@10.3.3.227 'cat > /home/checker/capture.txt'


2

If you don't have wireshark installed then tcpdumpdns=/tmp/tcpdumps tcpdump -lvi any "udp port 53" | tee $tcpdumpdns should work for you. As you wanted to limit the output to the second to last value then I would parse your log file with: grep -E 'A\?' $tcpdumpdns |sed -e 's/^.*A? //' -e 's/ .*//'|sort -u If you want it live then: tcpdump -lvi any ...


2

One idea would be to introduce some wait time between the pkill and the starting back up of the tcpdump (/home/ubuntu/log-sip-messages.sh &). This feels like a hack, and it is, but something like this: postrotate pkill tcpdump sleep 3 /home/ubuntu/log-sip-messages.sh & endscript


2

Apparently yes, from Wikipedia's OpenBSD entry (and this one): Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of the file system, prohibiting it from accessing areas that contain private or system ...



Only top voted, non community-wiki answers of a minimum length are eligible