Questions tagged [packet]
The packet tag has no usage guidance.
83
questions
1
vote
1
answer
52
views
How to mark packets by program
How to mark all packets (inbound and outbound) for specific program/ cmd in Linux using iptables or any other firewall/ tool
Given that --cmd-owner option was deprecated ref:http://www.spinics.net/...
- 43
0
votes
0
answers
62
views
understand different UDP packet loss results: iperf3 vs nuttcp
I try to measure UDP [%packet loss] between two machines.
I'm getting different results while using two different tools:
iperf3:
machine 1: iperf3 -s
machine 2: iperf3 -c <machine_1_ip> -u -...
- 161
0
votes
1
answer
104
views
How to retrieve raw bytes of DNS response?
I want to retrieve raw bytes of DNS response for debugging reason, for example:
dig -t https clickhouse.com
;; ANSWER SECTION:
clickhouse.com. 242 IN HTTPS 1 . alpn="h3,h3-29,...
- 9,005
0
votes
1
answer
136
views
Dummy interface is not reachable from other system through ping
I connected two Debian 10 systems with a direct link.
On one of them I defined a dummy interface and on the other I gave a static route to access it. I see the traffic from the sender on the interface,...
0
votes
0
answers
69
views
NAPI and Interrupt disable
I have been reading NAPI and I have some confusions around the interrupts and DMA buffers. I understand that when packet is arrived, NIC copies the packets to the DMA buffer. When the buffer is full, ...
- 219
1
vote
1
answer
45
views
Why does adding a counter queue to my Netfilter chain break my VM?
I'm configuring Netfilter Tables to queue packets to and from the userspace, and the table configuration I have so far looks like:
table inet filter {
# protocols to allow
set ...
- 23
1
vote
0
answers
28
views
Why 802.1q protocal packet auto dropped by interface?
I transfer a series of test packet with IEC61850_SV protocal in my host as follows:
01 0C CD 04 00 03 00 0C CD 04 00 00 81 00 80 01 88 BA 40 03 01 24 00 00 00 00 60 82 01 18 80 01 01 A2 82 01 11 30 ...
- 11
0
votes
0
answers
12
views
PF Ring along with ifconfig
I have PF_Ring zero copy running in an application which sniffs packets. When this application is running would it be possible to find out the amount of RX/TX traffic using ifconfig or is that correct ...
- 109
0
votes
0
answers
310
views
How do I configure Netfilter packet queues with NFTables?
Summary
I would appreciate some guidance in how to configure Netfilter packet filter queues in a Fedora/36-cloud-base virtual machine running in Vagrant, according to a (seemingly outdated) project ...
- 23
1
vote
1
answer
724
views
Error when trying to corrupt packets in linux terminal (netem)
The following rule corrupts 5% of the packets by introducing a single bit error at a random offset in the packet:
sudo tc qdisc change dev ens8 root netem corrupt 5%
But recently it gave me the ...
- 113
0
votes
0
answers
40
views
Packet dropping by raspberry Pi 2 in ethernet
I am sending small UDP packets over ethernet(from a linux machine) to raspberry pi 2, with 100Mbps link, from the program and ethtool can see that I am able to send 0.15M packets per second( 50 bytes ...
- 101
0
votes
1
answer
853
views
How to debug Linux TCP slows/packet loss
I'm trying to track down some particular network paths which are slowing down to about 200KByte/sec. I see this performance through various tests including with scp, rsync and iperf3:
$ iperf3 -c 157....
- 143
0
votes
0
answers
232
views
Why are packets being dropped (kfree_skb)?
I am currently sending ~9mpps, each packet is 72bytes large, and is a UDP DNS request. The packets are being sent to a Dell server I have using an intel i40e interface. The server is using all of its ...
- 494
1
vote
0
answers
92
views
How does libpcap read network packets, and why can it not operate in some VMs?
I'm interested to learn how libpcap reads network packets, as I am finding it is not possible when running on AWS Lambda
From what I can understand, you need either or both of the CAP_NET_ADMIN and ...
- 111
0
votes
0
answers
152
views
New install of Linux Mint 20.2 Cinnamon (5.0.4) has ~50% packet loss - Caused by router?
I have recently installed Linux Mint 20.2 Cinnamon (5.0.4) (Kernel 5.4.0-74-generic) on my desktop on a separate drive from a Windows 10 install. On Linux I noticed very inconsistent connections when ...
- 33
0
votes
2
answers
19
views
extract application name from rawpacket
Sounds dumb, but can you extract application name from a packet/pcap.
For eg: If a packet destination is to chrome process, can you extract that information from packet?
0
votes
0
answers
433
views
Can't find kutil after installation of krb5-usr
I need to merge keytab files and all tutorials mention kutil. But I can't find it:
root@nfsserver:/etc# kutil
bash: kutil: command not found
But krb5-usr is already installed:
krb5-user is already ...
- 151
1
vote
0
answers
53
views
Consistent missing packet only when flood pinging
I've been having one packet consistently dropping when initiating a flood ping in ubuntu
I'll toss out that one with 2 dropped packets as randomness, is there something going on here within the ...
- 111
3
votes
1
answer
3k
views
Package pre-installation script subprocess returned error exit status 1
I have question similar to this one
dpkg: new pre-installation script returned error exit status 1
I'm getting error same as above when trying to install PacketTracer 7.3.1. I think I declined EULA. I ...
- 33
0
votes
2
answers
316
views
Limit SSH to a range of IP
I work with OpenBSD and I want to limit the port 22 for all user who have an IP between 192.168.42.40 - 192.168.42.60. But I don't know how to do this.
I need to modify the packet filter ?
(SSH is on ...
1
vote
1
answer
361
views
Why is it that TCP packets can be modified to block invalid packets, but not UDP packets
On a random day I was googling iptables rules to harden my desktop, and came across this post[1]. At some point the guide mentions blocking invalid TCP packets using tcp-modules with these rules;
...
- 256
0
votes
2
answers
85
views
Counting bytes on all connections traversing a Linux router
I have a Linux box which works as a router.
How can I measure which connections send and receive how much data?
For each hour, I would like something like:
src_addr src_port dst_addr ...
- 743
1
vote
1
answer
405
views
ncat stops listening after 100 UDP packets
I'm continuously sending packets to a UDP server after 1 second. To listen for UDP packets:
ncat -klup 1234 --sh-exec "cat > /proc/$$/fd/1"
However, after printing 100 packets, nothing else ...
- 113
1
vote
1
answer
392
views
View packet data of ping
Is there a flag or other utility (perhaps tcpdump?) that can be used to see the outgoing packets that are sent via the ping utility? For example:
$ ping -c 5 google.com
PING google.com (172.217.14.78)...
- 339
0
votes
1
answer
1k
views
Why specify packet size during ping test?
Does it make a difference to specify packet size during ping tests (RedHat)?
Engineers in my company asked for ping checks with packet size of 2000 bytes (-s 2000). On certain systems, this fails, ...
0
votes
1
answer
199
views
possible packet loss
I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
- 101
1
vote
2
answers
3k
views
How to check if a packet reached an interface in a multi-interface context?
Consider the following topology:
I am sending ICMP (ping) packets from host B to 10.0.1.1. They reach the target and the target answers with a reply. The connectivity works fine.
When running, on ...
- 1,435
2
votes
1
answer
2k
views
Why linux drop packets in netif_receive_skb?
I have a linux box where we see a lot of (30%) TCP retransmission in tcpdump when receiving (downloading) files from outside. Using the dropwatch utility we see many packet drops in kernel function ...
- 171
1
vote
1
answer
468
views
How to avoid forwarding ports?
I am doing UDP socket programming in C. In order to listen to a port, I need to forward ports in my router. My question is how to avoid doing that and still being able to communicate over the internet,...
- 33
2
votes
1
answer
12k
views
How does MTR (run with TCP protocol) calculate the loss rate?
I thought TCP protocol itself will guarantee not to loose any bytes while connecting. About this viewpoint, please refer to
https://stackoverflow.com/questions/23841896/will-tcp-connection-lose-...
- 23
1
vote
2
answers
442
views
Maintain destination port of TCP packets after leaving through another local port
problem:
I have an application sitting on a host (let's call it host1) that sends TLS-encrypted TCP packets to another host's port 5015 (let's call it host2). Due to network restrictions, the host1 ...
- 123
2
votes
2
answers
263
views
Holding a Packet
I am trying to alter a stream of packets by temporarily holding a specific packet.
For example, if the packet are numbered 1,2,3,4,5, and so on, I want to temporarily store packet 2 so that I can ...
- 21
1
vote
1
answer
3k
views
iptables: transparent tcp traffic proxy
problem:
I have a TCP server and client that each listen on port 9000. I have the server and client deployed on two different hosts where traffic can only pass through port 80 between them. I want the ...
- 123
11
votes
2
answers
9k
views
What does iptables -j REDIRECT *actually* do to packet headers?
Out of curiosity I'm reading some tutorials about transparent TOR proxies as it's quite interesting topic from a networking standpoint. As opposed to VPN gateways which just use tun/tap interfaces and ...
- 1,273
6
votes
1
answer
15k
views
How to get metrics about dropped traffic via iptables?
We are using iptables firewall. It is logging and dropping various packages depending on its defined rules.
Iptables log file entries look like:
2017-08-08T19:42:38.237311-07:00 compute-nodeXXXXX ...
- 759
0
votes
1
answer
77
views
Network monitoring across my lan
I would like to monitor the network usage of all my deivces connected to same LAN network from raspberry pi 3. Since Pi3 is not a switch , it is also connected to the same network. Is it possible to ...
- 21
0
votes
2
answers
108
views
How does FreeBSD handle installing 2 packages which share a common dependency?
I'm working on FreeBSD 11 and already using programs with tcpdump as a dependency, which has libpcap and libsmi as dependencies.
I want to also install tshark, the console version of wireshark. I'll ...
- 1,211
1
vote
0
answers
438
views
RX and TX counts on various intermediate interfaces between two VMs
I am trying to figure out how the network stats are being reported when I send packets from within a VM to another VM on a different host. My network environment looks like the image below:
Basically,...
- 471
5
votes
1
answer
11k
views
IPTABLES: process a packet locally and send a copy to another host
I have a trouble configuring iptables to do this: some clients send messages to a server. I want that the host server processes the messages locally (host A, as normal) but that additionally for each ...
1
vote
0
answers
1k
views
Why my Raspberry pi receive no packets using Ethernet?
I use a Raspberry pi 3b. The OS is Raspbian jessie.
I don't understand why I can't connect with any RJ45 cable, and only wireless connection works. The cable rj45 is straight.
The step I did to ...
- 11
0
votes
2
answers
2k
views
Packet sniffing with TL-WN722N
I've recently started to follow a lecture about wireless network, and I bought an external wifi card called TL-WN722N from TP-LINK to use it for packet sniffing.
I tried to use it in a Kali Linux ...
lapinousexy
-1
votes
1
answer
8k
views
Sending UDP packets to a destination
On my Linux machine, I am receiving UDP packets from another machine. When I receive the UDP packets, I get the message
"Listening on UDP port : 8999"
This is triggered by the following command ...
14
votes
4
answers
12k
views
How to capture all incoming packets to NIC even those packets are not belonging to me
AFAIK, the NIC receives all packets from the wire in a Local Area Network but rejects those packets which their destination address is not equal to its ip.
I want to develop an application that ...
- 243
2
votes
2
answers
7k
views
What can cause a large TX vs. RX average bytes/packet discrepancy?
According to a computation I did on the data from ifconfig, my ethernet connection between my router and computer averages 1298 bytes/packet for TX (close to the MTU of 1500) and only 131 bytes/packet ...
- 1,132
1
vote
1
answer
2k
views
How to capture traffic from an entire website (including external servers) using tcpdump
I was wondering if its possible to capture all network traffic coming from a single website using tcpdump. I am interested in capturing the sizes of all incoming and outgoing packets from and to a ...
- 133
2
votes
1
answer
3k
views
How do packets traverse tc/netfilter physical, VLAN and bridge interfaces?
Given the following setup on a router that performs NAT between two networks A and B:
eth0 - physical interface - no ip address
eth0.1 - VLAN interface for network A - no ip address
eth0.2 - VLAN ...
- 131
3
votes
1
answer
101
views
Remote control alarm
I want one of machine have a remote control alarm running that can be triggered by any remote machine. More precisely
Machine A is running the service in the background
Any remote machine B can send ...
- 4,708
1
vote
3
answers
1k
views
How does MTR work in detail? Shouldn't packet loss be observed to increase linearly?
If so, how come do we see packet loss be distributed unevenly among hops? That is, if there is 5 percent loss in the first hop, the following hops, should start out with 95 percent of the packets ...
user213162
1
vote
0
answers
101
views
How to open a changing file with wireshark?
Given a pcap file that is being created in the background, e.g
tshark -w out.pcap > /dev/null &
How can I open the changing file with wireshark
wireshark -r out.pcap
Does nont work
3
votes
1
answer
4k
views
How can I limit Download bandwidth of an existing process? (iptables, tc, ?)
I am happily limiting upload speed by port - but really want to limit download by process.
It seems iptables did have functionality for matching and marking packets by process in the form of --pid-...
- 121