1

When observing traffic with sudo tcpdump udp, it behaves like it should: I can see all traffic which is happening in the network, even when the machine which I am using is not involved.

However, when issuing the command sudo tcpdump tcp, I am merely seeing the traffic which I am not involved into: Packets which are being transferred between two other machines are not visible.

I've read about switched networks, but to my understanding I should not be able see UDP traffic either if this is the case.

I'm am using Ubuntu 14.04.1 LTS as my OS.

What prevents me from tracking TCP traffic?

Tracked UDP traffic:

00:35:58.813682 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:58.815133 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:58.998898 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:58.999134 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.201377 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.201968 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.370964 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.371582 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.553621 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.554164 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.717320 IP ubuntuserver.fritz.box.42149 > fritz.box.domain: 32553+ PTR? 255.178.168.192.in-addr.arpa. (46)
00:35:59.718072 IP fritz.box.domain > ubuntuserver.fritz.box.42149: 32553 NXDomain* 0/1/0 (106)
00:35:59.718241 IP ubuntuserver.fritz.box.49986 > fritz.box.domain: 41172+ PTR? 22.178.168.192.in-addr.arpa. (45)
00:35:59.719231 IP fritz.box.domain > ubuntuserver.fritz.box.49986: 41172* 1/1/3 PTR JanBerktold.fritz.box. (166)
00:35:59.719395 IP ubuntuserver.fritz.box.50904 > fritz.box.domain: 53292+ PTR? 21.178.168.192.in-addr.arpa. (45)
00:35:59.720181 IP fritz.box.domain > ubuntuserver.fritz.box.50904: 53292* 1/1/3 PTR JanBerktold.fritz.box. (166)
00:35:59.752634 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.752871 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.926701 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:35:59.926919 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.143513 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.144083 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.349315 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.365001 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.552357 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.552778 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.721407 IP ubuntuserver.fritz.box.38326 > fritz.box.domain: 11041+ PTR? 1.178.168.192.in-addr.arpa. (44)
00:36:00.722244 IP fritz.box.domain > ubuntuserver.fritz.box.38326: 11041* 1/1/3 PTR fritz.box. (153)
00:36:00.722371 IP ubuntuserver.fritz.box.43901 > fritz.box.domain: 36201+ PTR? 34.178.168.192.in-addr.arpa. (45)
00:36:00.723199 IP fritz.box.domain > ubuntuserver.fritz.box.43901: 36201* 1/1/3 PTR ubuntuserver.fritz.box. (167)
00:36:00.767687 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.768093 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.979263 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:00.979480 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:01.188186 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:01.188592 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
00:36:01.401442 IP JanBerktold.fritz.box.2008 > 192.168.178.255.2008: UDP, length 16
-- LOT MORE OF THESE --

Note: ubuntuserver is the tracking machine and Janberktold a Win8 desktop.

So far, I've thought that the 192.168.178.255 address is the router, however that appears to the the broadcast address. I guess that solves the case: I actually am on a switched network.

2 Answers 2

3

There are two possibilities for this.

  1. You're seeing UDP broadcast traffic.

  2. You're seeing UDP traffic between two remote systems. You are correct in that a Switch isolates traffic by MAC address. However, in order to do that it needs to know which segments target which MAC addresses. It does that by learning, based on traffic. When the Switch receives a packet it can learn the interface for the sender's MAC address. But when it receives a packet for which it has no knowledge of the receiver, it has to forward that packet to all its interfaces. This is (probably) the traffic that you're seeing on your machine.

You will see TCP traffic, too, but you would probably at best see only the initial SYN as from that point forward the Switch would have learned the interfaces for the sender and receiver.

2
  • 2
    You are not likely to see SYN packets either. Because before the SYN packet can be send the MAC address has to be looked up using ND or ARP. And the packets exchanged in order to look up the MAC address would cause the switch to learn which port the MAC address is on.
    – kasperd
    Apr 12, 2015 at 23:16
  • 3
    He is seeing broadcast traffic; 192.168.178.255 is a broadcast IP address (from the "255" at the end, with all bits 1), so that's probably being sent to the broadcast MAC address.
    – user44841
    Apr 13, 2015 at 0:57
1

It's likely that this traffic is broadcast traffic, what are the source and destinations of the traffic that you are seeing?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .