Questions tagged [tcp]

The Transport Control Protocol (TCP) is a low-level part of the protocol stack used by the Internet. It sits directly above the IP layer and is responsible for making sure that dropped packets are resent.

Filter by
Sorted by
Tagged with
6
votes
5answers
2k views

Linux 64-bit SSH port numbers?

While there is usually no need for more than the 64k available ports, I am interested in the PoC that having a port number on 64 bits would mitigate the regular attacks on the access ports (ssh, vpn......
1
vote
0answers
18 views

Network bandwidth aggregation

Lets say I have access to two different networks: A and B. My device has two different network interfaces N1 and N2. A has a bandwidth of 5 mbps B has a bandwidth of 3 mbps I want to combine these two ...
0
votes
0answers
7 views

Why TCP fast retransmit do not work with 3 duplicate packet?

There is a lot of ack '3762420' appears in log of tcpdump. But the retransmit of seq 3762420:3763880 appears so late. Actually, the earliest ack happened at 23:30:13.267439. Why didn't tcp fast ...
1
vote
1answer
22 views

How can we trace a TCP/IP packet in a server

I'm developing a backend service. The backend contains some processes, meaning that when a client sends a request to my server, the request will go through these processes. For example, a request will ...
0
votes
1answer
21 views

How does buffering for TCP packets work?

If I write a few times in a quick succession on a socket (with the POSIX function write), usually all the data I wrote gets sent in a single TCP packets. Unless I write too much or unless I wait too ...
0
votes
0answers
26 views

tun2socks - How to forward tcp and udp separately to 2 socks proxies

I have 2 socks proxies that first one does not support udp but has very good speed and second one supports both tcp and udp but with low speed. So what i want to do; I want to forward tun2socks' ...
0
votes
0answers
20 views

Increasing connection timeout for tcp connection in freebsd after 360sec has no effect

Test Setup Configured a firewall to drop connection from a remote address IP address : 'yy.yyyy.yyyy.yyy' IP port : 'zzzz' [root@mmmmm /path/to/log]# cat ipfw.today 00100 1438 86280 deny ip ...
0
votes
1answer
23 views

Ports not connecting, yet I still have Internet access

I'm currently working on a computer where I'm hosting a website as well as an SSH server. However, when connecting via SSH I receive: ssh: connect to host [ip] port 22: Connection refused In addition,...
0
votes
0answers
23 views

A lot of TCP retransmissions on virtual interfaces when sending large amounts of data

For some time I have strange network lags when using virtual NICs created by VPNs like ZeroTier and Hamachi, especially when sending large amounts of data. I use Ubuntu 20.04, kernel 5.4.0-67-generic. ...
12
votes
4answers
2k views

Can I have a single server listen on more than 65535 ports by attaching an IPv4 address

I have a number of servers to SSH into, and some of them, being behind different NATs, may require an SSH tunnel. Right now I'm using a single VPS for that purpose. When that number reaches 65535 - ...
2
votes
1answer
26 views

tcpdump: why ack number greater than sack number?

I use tcpdump to troubleshot network problem, and found one record that ack number is greater than sack number: Why ack number greater than sack number?
0
votes
1answer
80 views

Which thread receives SIGURG?

I recently wrote a "study note" about Unix, and I made following proposition about multi-threaded processes: it will be almost impossible for the kernel to identify the thread that should ...
0
votes
0answers
26 views

Is there a common linux command which connect to a TCP port with keep-alive enabled?

I would like to do a little test for verifying TCP keep-alive. I tried to use $ nc -l -k 9530 to listen on a 9530/tcp on server and use telnet <server IP> 9530 to create a TCP connection. ...
0
votes
0answers
27 views

How to LISTEN and alert on ESTABLISHED connection (low-interactive honeypot)

What is the most robust solution for a super-simple linux daemon that just LISTENS on some port(s) and every time a connection is ESTABLISHED, it immediately sends me an email alert? I'm building a ...
0
votes
1answer
49 views

Forward network packets from host machine to QEMU image

I have got a locally built Yocto image with me running inside QEMU. I need to forward a single port from the host machine to localhost inside the QEMU image. The TAP connection I am using assigns 192....
0
votes
0answers
101 views

UNIX socket via TCP with socat - reconnect issue

I have two applications, a web-frontend and a backend, which run different containers. They normally communicate via a UNIX socket. I have created a bridge over TCP between with the help of socat. ...
1
vote
1answer
32 views

How to establish tcp connection between host to vm using ssh or telnet

As a part of learning, I'm trying to establish a tcp connection between host and VM using telnet or ssh. I'm using linux-debian. After establishing connection, I'll try to analyse packets using ...
0
votes
0answers
11 views

How to measure the duration of packet from network to process

I want to measure the duration of a TCP/UDP packet from network to process. Let's say that I develop a Linux process, which provides a kind of web service. My process is listening on the port 8999 and ...
0
votes
0answers
123 views

ffmpeg connection to tcp://a.rtmp.youtube.com:1935 failed: connection timed out

I want to live stream using FFmpeg, when live on Facebook it runs normally, but when I live on YouTube there is an error, is there anything wrong with the command I entered? even though the command ...
0
votes
0answers
21 views

cURL some of requests are blocked. How to find where?

I have cloud hosting on Hostinger and use Wordpress. One of wp plugins uses cURL and after debugging I found that some of request from it stopped by timeout. So I connected directly to server by SSH ...
1
vote
0answers
19 views

Tunnelling TCP to database (ms-Sql) through corporate proxy

What I know. I have a ms sql in Internet, let say hostDB:1433 I have a corporate proxy ipProxy:8080 /bin/nc -z -v -w 1 -x ipProxy:8080 -X connect hostDB 1433 Connection to hostDB 1433 port [tcp/ms-...
1
vote
1answer
93 views

Calculate TCP memory usage (does not add up)

I am running a Debian GNU/Linux 9.5 (stretch) with kernel: 4.9.0-7-amd64. I have found the culprit of a memory consumption problem I am facing to be an in-app mechanism for sending logs to FluentD ...
0
votes
1answer
23 views

Rerouting incoming packets from server to local machine B instead of A

I'm trying to redirect a server's incoming TCP packets to local machine B. The application client on local machine A (192.168.0.7) is connected to the server (1.2.3.4), so every incoming TCP packet ...
1
vote
1answer
264 views

Setting TCP MSS on a bridge port

I have a VXLAN tunnel between two Linux hosts. This tunnel is carried over an Ethernet link with an MTU of 1500 bytes. At each end, the VXLAN interface is slaved to a bridge, along with another ...
0
votes
0answers
16 views

tcpserver won't connect over a port forward

I port forwarded a computer on port 1000: When I run tcpserver 0 1000 echo test on the computer and run nc lostxor.com 1000 on another computer, netcat hangs. If I run nc -l 1000 on the first one and ...
0
votes
0answers
58 views

What caused traffic on port 631?

After I turn on my computer, something triggers tcp packets from localhost with source port 631. I replicated the packets using the command ipptools. Assuming I got it right, is there a way for me to ...
0
votes
1answer
22 views

state of tcp/udp source ports when waiting for answer from target

i have a quick question about tcp port states: suppose i am establishing a tcp connection to a server: source address/port should be 44.44.44.44:33456 destination address/port is 55:55:55.55:443. in ...
1
vote
1answer
81 views

Why is it that TCP packets can be modified to block invalid packets, but not UDP packets

On a random day I was googling iptables rules to harden my desktop, and came across this post[1]. At some point the guide mentions blocking invalid TCP packets using tcp-modules with these rules; ...
0
votes
0answers
48 views

How to drop syn retransmissions in linux using iptables

I want to send a TCP connection attempt just once, i can't do this by setting net.ipv4.tcp_syn_retries to 0 because the minimal value is 1, so a re-transmission of the SYN will happen and i don't want ...
0
votes
1answer
96 views

ssh: connect to host Connection timed out

I am able to ssh into the centos 7 machine and httpd works well. After certain hours I ssh connection time out. Also http and https connections show ERR_CONNECTION_TIMED_OUT After rebooting the ...
4
votes
0answers
104 views

Does Linux kernel allocate free TCP port based on IP address?

This is a hypothetical question, just to help me understand more about how TCP ports work. Suppose I have multiple Ethernet cards on my machine and they are attached to different subnets. Now if I ...
0
votes
0answers
18 views

How does kernel handle previous incoming data packets after a timeout has occurred

During a TCP request hand-shake a socket at both the end of the request is created i.e. the sender creates it during the SYN and receiver creates it on ACK. This is required for connection ...
0
votes
0answers
54 views

Why do my Send-Q keep getting loaded but nothing come out of it?

I'm currently diagnosing a issue related to packet forwarding. I forward link layer packets to B network namespace and I found that B network namespace didn't reply to them, but I could curl and view ...
0
votes
1answer
194 views

Permission denied opening socket / connection with rsync in OpenBSD

I recently was trying to retrieve a copy of UCE (spam) sender IPs from uceprotect.net with rsync, but I encountered the following errors: [user@host ucedata]$ rsync -rzv rsync-mirrors.uceprotect.net::...
0
votes
1answer
32 views

Dropping RSTs vs using NOTRACK

I'm in process building my own firewall. One can say I'm building user space TCP/IP stack. However, When Kernel receive packet that it can't identify, Kernel would send out RST + ACK (Not sure whether ...
0
votes
0answers
60 views

How to monitor TCP SYN queue (request queue)

I'm implementing a solution against TCP SYN flood attack in linux kernel 4.15. How can I monitor the size of TCP SYN queue for debugging purposes.
1
vote
1answer
76 views

Why did iperf3 show thunderbolt speed 3 Gbit in one direction, and just 500 Mbit in the other direction?

I connected two MBPs via thunderbolt, via thunderbolt bridge which should provide 10Gbit/s bidirectional connection on one of its channels. I have them connected over a thunderbolt 2 male male cable ...
0
votes
1answer
41 views

Do a TCP stream comprising SYNs and ACKs involve only one-time Ethernet packet?

I know this question sounds dumb but lately It's quite hard for my mind to visualize whole packet flow at Layer 2 level. I'm developing a firewall at Layer 2 and interested at inspecting TCP packets ...
0
votes
2answers
60 views

How can I confirm which process is connect to remote port?

My loacl server IP is 192.168.122.100, and remote server IP is 192.168.122.50. I need to kill all processes which connect to 192.168.122.50:56666. By executing ss comand, I found there are three TCP ...
0
votes
1answer
217 views

pf: difference between 'modulate state' and 'keep state'

What's the difference between "modulate state" and "keep state" in the packet filter (pf) firewall? I'm using MacOS X Catalina 10.15.5. I have no idea how to check what version of ...
1
vote
2answers
91 views

nftables preventing services from resolving on IPv6

I've got my server set up with long list of services, and everything is working great... on IPv4. But when I test them against IPv6 nothing is resolving. After disabling nftables everything started ...
1
vote
0answers
40 views

Receive data on a udp port and forward the same on a tcp port

I'm not sure whether this is even possible, but I want to receive some data over UDP port (say 14550) and forward it to a newly opened TCP port (say 50000). I have tried socat as of now but no success:...
0
votes
1answer
136 views

How to determine active/passive end of TCP connection

If I inspect information about established TCP connections as returned by sock_diag(7) (or in /proc/net/tcp), how can I determine whether a given connection originated with the local side owning the ...
0
votes
1answer
25 views

Is there a back-pressure mechanism from qdisc to TCP?

Is there a mechanism to stop TCP sending packets towards Qdisc if the queue length exceeds the limit? I know TSQ helps here for a small number of connections but what if I have 1000 connections or ...
0
votes
2answers
29 views

Counting bytes on all connections traversing a Linux router

I have a Linux box which works as a router. How can I measure which connections send and receive how much data? For each hour, I would like something like: src_addr src_port dst_addr ...
1
vote
0answers
46 views

Will delayed-ack acknowledge more than two packets at once time?

Delayed ack is used in Linux TCP implementation to reduce the number of pure ack packets by waiting for a while and aggregating the data received by receiver into a single ack packet. According to ...
2
votes
0answers
74 views

How many times is the data packet copied before finally reaching the NIC?

On a typical linux machine, how many times would packets be copied from the application layer to all the way in its journey to the network card. I am assuming the protocol being used here is TCP/IP ...
0
votes
1answer
534 views

When connecting via SSH, does the Diffie-Hellman key exchange take place over an unencrypted TCP session or does encryption occur before the exchange?

I'm a cybersecurity student and I'm eager to understand the basic processes of an SSH session. I wrote down the stages to the best of my ability but need help understanding what happens right after ...
1
vote
0answers
226 views

TCP Dup ACKs without packet loss

I have a sender on IP 192.168.2.250 running some embedded RTOS and a receiver running Linux 4.9.x on IP 192.168.2.1 The receiver is configured as a Wireless AccessPoint and the sender is directly ...
1
vote
1answer
910 views

How to set a local proxy for redirecting traffic to remote proxies?

I use proxies (with authentication) in various applications (not system proxy). Thus, I have to update all proxy settings when the proxies or the credentials are changed. I wish to set a fixed local ...

1
2 3 4 5
11