Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [packet]

The tag has no usage guidance.

0
votes
1answer
63 views

Why specify packet size during ping test?

Does it make a difference to specify packet size during ping tests (RedHat)? Engineers in my company asked for ping checks with packet size of 2000 bytes (-s 2000). On certain systems, this fails, ...
0
votes
0answers
20 views

Packet capture with iptables/rsyslogd?

The usual way I know of capturing packets is with iptables/NFLOG/nflog-group and ulogd with libpcap.so built in. It's a simple matter to enable packet capture in the ulogd.conf file and all rules that ...
0
votes
1answer
44 views

possible packet loss

I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
1
vote
2answers
41 views

How to check if a packet reached an interface in a multi-interface context?

Consider the following topology: I am sending ICMP (ping) packets from host B to 10.0.1.1. They reach the target and the target answers with a reply. The connectivity works fine. When running, on ...
1
vote
0answers
242 views

Why linux drop packets in netif_receive_skb?

I have a linux box where we see a lot of (30%) TCP retransmission in tcpdump when receiving (downloading) files from outside. Using the dropwatch utility we see many packet drops in kernel function ...
1
vote
1answer
27 views

How to avoid forwarding ports?

I am doing UDP socket programming in C. In order to listen to a port, I need to forward ports in my router. My question is how to avoid doing that and still being able to communicate over the internet,...
1
vote
1answer
902 views

How does MTR (run with TCP protocol) calculate the loss rate?

I thought TCP protocol itself will guarantee not to loose any bytes while connecting. About this viewpoint, please refer to https://stackoverflow.com/questions/23841896/will-tcp-connection-lose-...
1
vote
0answers
26 views

Packet injection does not work on 12.04 [closed]

Im trying to test my OpenWrt network but after putting interface wlx3c3300200748 to monitor mode $ sudo Desktop/startWlan.sh wlx3c3300200748 and issuing command this command: $ aireplay -9 ...
1
vote
2answers
72 views

Maintain destination port of TCP packets after leaving through another local port

problem: I have an application sitting on a host (let's call it host1) that sends TLS-encrypted TCP packets to another host's port 5015 (let's call it host2). Due to network restrictions, the host1 ...
2
votes
2answers
87 views

Holding a Packet

I am trying to alter a stream of packets by temporarily holding a specific packet. For example, if the packet are numbered 1,2,3,4,5, and so on, I want to temporarily store packet 2 so that I can ...
1
vote
1answer
1k views

iptables: transparent tcp traffic proxy

problem: I have a TCP server and client that each listen on port 9000. I have the server and client deployed on two different hosts where traffic can only pass through port 80 between them. I want ...
5
votes
1answer
2k views

What does iptables -j REDIRECT *actually* do to packet headers?

Out of curiosity I'm reading some tutorials about transparent TOR proxies as it's quite interesting topic from a networking standpoint. As opposed to VPN gateways which just use tun/tap interfaces and ...
2
votes
1answer
3k views

How to get metrics about dropped traffic via iptables?

We are using iptables firewall. It is logging and dropping various packages depending on its defined rules. Iptables log file entries look like: 2017-08-08T19:42:38.237311-07:00 compute-nodeXXXXX ...
0
votes
1answer
58 views

Network monitoring across my lan

I would like to monitor the network usage of all my deivces connected to same LAN network from raspberry pi 3. Since Pi3 is not a switch , it is also connected to the same network. Is it possible to ...
0
votes
2answers
78 views

How does FreeBSD handle installing 2 packages which share a common dependency?

I'm working on FreeBSD 11 and already using programs with tcpdump as a dependency, which has libpcap and libsmi as dependencies. I want to also install tshark, the console version of wireshark. I'll ...
1
vote
0answers
133 views

RX and TX counts on various intermediate interfaces between two VMs

I am trying to figure out how the network stats are being reported when I send packets from within a VM to another VM on a different host. My network environment looks like the image below: Basically,...
5
votes
1answer
4k views

IPTABLES: process a packet locally and send a copy to another host

I have a trouble configuring iptables to do this: some clients send messages to a server. I want that the host server processes the messages locally (host A, as normal) but that additionally for each ...
1
vote
0answers
366 views

Why my Raspberry pi receive no packets using Ethernet?

I use a Raspberry pi 3b. The OS is Raspbian jessie. I don't understand why I can't connect with any RJ45 cable, and only wireless connection works. The cable rj45 is straight. The step I did to ...
0
votes
2answers
1k views

Packet sniffing with TL-WN722N

I've recently started to follow a lecture about wireless network, and I bought an external wifi card called TL-WN722N from TP-LINK to use it for packet sniffing. I tried to use it in a Kali Linux ...
0
votes
1answer
3k views

Sending UDP packets to a destination

On my Linux machine, I am receiving UDP packets from another machine. When I receive the UDP packets, I get the message "Listening on UDP port : 8999" This is triggered by the following command ...
13
votes
5answers
6k views

How to capture all incoming packets to NIC even those packets are not belonging to me

AFAIK, the NIC receives all packets from the wire in a Local Area Network but rejects those packets which their destination address is not equal to its ip. I want to develop an application that ...
1
vote
2answers
2k views

What can cause a large TX vs. RX average bytes/packet discrepancy?

According to a computation I did on the data from ifconfig, my ethernet connection between my router and computer averages 1298 bytes/packet for TX (close to the MTU of 1500) and only 131 bytes/packet ...
1
vote
1answer
272 views

How to capture traffic from an entire website (including external servers) using tcpdump

I was wondering if its possible to capture all network traffic coming from a single website using tcpdump. I am interested in capturing the sizes of all incoming and outgoing packets from and to a ...
2
votes
1answer
785 views

How do packets traverse tc/netfilter physical, VLAN and bridge interfaces?

Given the following setup on a router that performs NAT between two networks A and B: eth0 - physical interface - no ip address eth0.1 - VLAN interface for network A - no ip address eth0.2 - VLAN ...
3
votes
1answer
78 views

Remote control alarm

I want one of machine have a remote control alarm running that can be triggered by any remote machine. More precisely Machine A is running the service in the background Any remote machine B can send ...
0
votes
1answer
463 views

How does MTR work in detail? Shouldn't packet loss be observed to increase linearly?

If so, how come do we see packet loss be distributed unevenly among hops? That is, if there is 5 percent loss in the first hop, the following hops, should start out with 95 percent of the packets ...
1
vote
0answers
62 views

How to open a changing file with wireshark?

Given a pcap file that is being created in the background, e.g tshark -w out.pcap > /dev/null & How can I open the changing file with wireshark wireshark -r out.pcap Does nont work
1
vote
1answer
2k views

How can I limit Download bandwidth of an existing process? (iptables, tc, ?)

I am happily limiting upload speed by port - but really want to limit download by process. It seems iptables did have functionality for matching and marking packets by process in the form of --pid-...
1
vote
1answer
492 views

how to get list of sites/domains linked to in wireshark

I have been trying to figure out how many sites does firefox connect wth and for that have been using wireshark. What I have done is made a new profile and whenever I run firefox in the browser it is ...
3
votes
1answer
109 views

Cannot ping OUT of a Mac OS X server

I have just inherited a Mac OS X server that is using pf. The problem I am trying to solve is why I can't ping OUT of the server. I can ping to the machine no worries, but just get timeouts on pinging ...
2
votes
1answer
11k views

Create UDP to TCP bridge with socat/netcat to relay control commands for vlc media-player

The UDP - must listen on port. The TCP - must connect to a server. I tried netcat and socat. nc -v -u -l -p 3333 | nc -v 127.0.0.1 50000 socat -v UDP-LISTEN:3333,fork TCP:localhost:50000 Both work ...
1
vote
1answer
72 views

ip_conntrack_max test not working

I am trying to do some ip_conntrack_max kernel parameter testing, but somehow its not working. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT I have set following value to see its filling ...
2
votes
2answers
602 views

How to get different types of ICMP

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
1
vote
2answers
5k views

date time as file name for dump file

I'm using Gulp to capture packets at 100Mbps to a folder. But I would like to name the files in format job_<'%Y_%m_%d_%H_%M_%S'>.pcap, but it gives files job.pcap0, job.pcap2 etc. The script I use ...
1
vote
1answer
685 views

Tracking Source IP of Dropped Packets

I have a server running CentOS 7 which is showing a considerable amount of RX dropped packets on ifconfig. I believe those may be caused by hardware problems such as faulty cables and connections. ...
0
votes
3answers
4k views

Python3.4 package for Debian Wheezy

I'm looking for a way to get python3.4 for debian wheezy. I've been looking on repos but all I could find is 3.2 version. Does anybody know where I can find 3.4 package? (Or maybe does anybody know ...
2
votes
1answer
134 views

Dig faster than speed of light, Possible?

I personally love to dig sites that I know. .Here's a wierd thing I saw up on my terminal after running dig www-contestwinners.com:- ; <<>> DiG 9.9.5-3ubuntu0.1-Ubuntu <<>> ...
6
votes
1answer
4k views

Block outgoing connections to certain IP using PF

Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?
1
vote
0answers
2k views

“avahi-daemon[1540]: server.c: Packet too short or invalid while reading response record. (Maybe a UTF-8 problem?)”

We are developing an application in Java for our internal project. Apache-Tomcat-7.0.57 is running on a Linux machine (Red Hat 4.4.6-4). But it throws an error avahi-daemon[1540]: server.c: Packet ...
0
votes
1answer
110 views

Is there any program to see sniffed HTTP packets like a web browser?

Programs like Wireshark are used to sniff packets and with them it's possible to see content of HTTP request and response including HTML codes and etc. But analyzing these contents are really hard and ...
2
votes
1answer
1k views

macos - local port redirection using pfctl and syntax errors

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: ...
2
votes
1answer
413 views

IPv4 goes offline several times per hour on headless remote server, IPv6 unaffected

On my Ubuntu 14.04.2 server IPv4 goes offline several times per hour (one to four times I've seen, but at no particular minute per hour or so). My hoster insists that the problem is on the server-...
1
vote
1answer
129 views

How does Linux prevent applications from sending more packets than the link can handle without dropping packets?

I couldn't make the question any clearer so here's an example scenario: Given a Linux machine connected to an IP network through a physical interface of bandwidth 10Mbps (or a higher speed interface ...
0
votes
1answer
900 views

Smallest packet sniffer for an embedded device?

Are there tiny packet sniffers out there? I'm looking for something that can be compiled for a embedded device with very limited space. I thought of tcpdump but a dynamically linked and stripped ...
4
votes
0answers
1k views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
2
votes
1answer
4k views

record contents of packets dropped in iptables

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables. At present, I have a rule to log these packets (with a ...
0
votes
1answer
3k views

Received DUP when using ping. What should I do?

I was pinging Google last night and one of them came back as DUP(!). I did some reading and I found this in the man pages on ping(8): Damaged packets are obviously serious cause for alarm and often ...
1
vote
2answers
2k views

How can I debug traffic on a switched network with Wireshark?

I have an IP phone on my home network that I am trying to call using SIP from outside of my home network. I have port forwarding setup, but the phone is responding with a SIP 404 message. All the ...
1
vote
3answers
167 views

Is it bad to select remember me option in the browsers of a compromised machine?

I was reading an article on how to sniff network packets. (of course for knowledge purposes only). I came across these particular lines. For instance, say I was sniffing traffic on the network, ...
0
votes
1answer
153 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...