Questions tagged [tcpdump]
a command line packet analyzer
266
questions
1
vote
1
answer
23
views
I see only DHCP requests but not DHCP responses from "parallel" computer
I have two Raspberry Pies and one DHCP server connected to a switch. Raspi #2 is configured to do netboot.
I am sitting on Raspi #1 and doing
tcpdump 'ether host b8:27:eb:5d:4a:f6' -p -i eth0 -vv
I ...
- 2,877
2
votes
1
answer
22
views
tcpdump display packets with high delay
I used tcpdump to capture packets from local rsyslog service to syslog server, however, when I tried different commands (with/without dst option) in tcpdump, the displayed result has a delay.
Expected/...
- 21
0
votes
0
answers
20
views
TCPDUMP Missing response Code header in Back to back execution
I am running two TCPDUMP Commands back to back. Here is the sequence
Run the below command
root@open5Gs:/home/test# tcpdump -l -vvv -s0 -i any -B 4096 -nn -w /home/test/tc060.pcap -c 1500
Execute ...
1
vote
1
answer
30
views
Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?
I'm trying to filter traffic by src ether host to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24 to see OUI's matching aa:...
- 293
0
votes
1
answer
12
views
Decoding wireless captures / filters on Linux
I am trying to filter a capture file that was captured by a remote AP. If i pull the file to my laptop i can open in Wireshark decode as peekremote and create the display filter EAPOL to get the ...
- 111
1
vote
0
answers
55
views
tcpdump -i any and slave interfaces
The core requirement can be expressed as "filtering out slave interfaces from -i any".
In this case, packets leaving on a vlan for bond0 should not also be retrieved for bond0, or the ...
- 13
1
vote
1
answer
98
views
how can I parse tcpdump stream live?
I have a debian installation, where the OEM has a bunch of processes I dont recognize running, and I want to figure out if any of these things are dialing home.
I ran sudo tcpdump | grep ^e <ssh_ip&...
- 3,387
0
votes
1
answer
50
views
How to get aggregate packet information using a tool like tcpdump
I'd like to analyze packets in one of my VMs to see where how the network traffic is flowing. I found tcpdump which seems to be able to capture the packets. However, I'd like to find a way to ...
0
votes
1
answer
37
views
How can record all ip address visited from my pc with tcpdump?
I want to record all ip address requested from my local pc ,how can record all ip address with tcpdump?
- 205
0
votes
1
answer
235
views
Why does tcpdump capture packets that are blocked by iptables? How to filter those packets out?
I am using this command to debug my SIP traffic tcpdump -i eth0 -nt port 5060 -v
and that outputs something like this:
IP (tos 0x0, ttl 113, id 6082, offset 0, flags [none], proto UDP (17), length 504)...
- 208
0
votes
0
answers
32
views
No results from TCPDUMP
I have a solar panel inverter which is wifi connected. When I run tcpdump I get zero output. I know it's using the wifi because when the broadband went down for several hours there was nothing ...
- 19
0
votes
0
answers
17
views
Why 802.1q protocal packet auto dropped by interface?
I transfer a series of test packet with IEC61850_SV protocal in my host as follows:
01 0C CD 04 00 03 00 0C CD 04 00 00 81 00 80 01 88 BA 40 03 01 24 00 00 00 00 60 82 01 18 80 01 01 A2 82 01 11 30 ...
0
votes
0
answers
59
views
Is there an optimized solution for tcpdump pulling a specific IP?
I made a script that runs tcpdump in the background:
nohup tcpdump -i $INTERFACENAME dst $IPC >> text.txt
And I made another script that pulls any IP address other than $IP from text.txt, but ...
0
votes
2
answers
923
views
associate IP with hostname without editing /etc/hosts
I know I can associate hostname with my IP address in /etc/hosts:
1.2.3.4 foo
and then, for example in tcpdump output, I will see foo instead of my IP address (if -n was not used)
Anyways, can I ...
- 241
1
vote
1
answer
184
views
tcpdump: always show numerical port numbers
The option -n in tcpdump is useful. Sometimes I prefer to see IP addresses, and sometimes I prefer to have the IP addresses resolved into hostnames.
But never do I want to have port numbers translated ...
- 241
2
votes
1
answer
2k
views
System clock not synchronized with NTP server using systemd-timesyncd
I followed this answer here, but it seems that my system clock doesn't synchronize with NTP server:
$ cat /etc/debian_version
10.9
$ egrep -v "^$|^#" /etc/systemd/timesyncd.conf
[Time]
NTP=x....
- 1,777
1
vote
1
answer
128
views
TCPDUMP IP UNKNOWN
I am seeing this in the tcpdump output
21:32:51.580969 IP UNKNOWN.9998 > 255.255.255.255.9998: UDP, length 12
What does 'IP UNKNOWN' mean? Is something hiding the ip address?
Thanks
- 19
0
votes
0
answers
75
views
RTS and CTS packets filtered with 8814au
I try to sniff air with Realtek 8814AU.
I tried driver from:
https://github.com/aircrack-ng/rtl8814au.git
https://github.com/morrownr/8814au.git
I have compiled source code on Ubuntu 21.10 (5.13.0-...
- 101
0
votes
0
answers
145
views
netstat output does not match tcpdump output
I have a syslog server that is receiving data on port TCP/514 from a router
that has a main and an alternate interface. I have noticed something weird
where the output of netstat shows the IP address ...
- 351
0
votes
1
answer
170
views
tcpdump in Kali Linux VM does not capture scp between two devices
Situation:
I'm learning how to develop tests for a hardened server my company is developing for a client. The test configuration will consist of the test target (the server we're developing) and an ...
0
votes
2
answers
1k
views
Is possible to capture packets between two hosts from a third host in the same network?
I want to see traffic between two hosts from a third host, there are all on my network
I did this on the third host:
ip link set eth0 promisc on
tcpdump -vv -i eth0 -xX host 192.168.0.2 and host 192....
- 11.7k
8
votes
2
answers
1k
views
Understanding of BPF
When I need to capture some packets using tcpdump, I use command like:
tcpdump -i eth0 "dst host 192.168.1.0"
I always think the dst host 192.168.1.0 part is something called BPF, Berkeley ...
- 925
0
votes
0
answers
22
views
How to log Source IPs of Incoming File Transfers above a Specific Size?
I am trying to create a filter with tcpdump that logs the source IPs of only incoming file transfers above a specific size irrespective of the protocol that is being used for the transfer.
For ...
- 1
1
vote
1
answer
115
views
-Y and read {src,dst} port and tshark
tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
- 10.6k
1
vote
1
answer
523
views
how to modify pcap file for Additional Information in packet
I have one Pcap File which consist of Some Information.
I need to modify the data in the file.
Example:
As you can see There are details of packets and in Additional Record section I have TXT value ...
0
votes
1
answer
323
views
Why can't assign permission for normal user?
Install tcpdump on my debian10:
sudo apt install -y tcpdump
which tcpdump
/usr/bin/tcpdump
groupadd pcap
usermod -a -G pcap $USER
sudo chgrp pcap /usr/bin/tcpdump
sudo chmod 750 /usr/bin/tcpdump
sudo ...
- 285
1
vote
2
answers
142
views
What does double n mean in tcpdump command?
The tcpdump manual shows:
-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.
I have seen double n in a tcpdump command:
https://danielmiessler.com/study/tcpdump/
...
- 285
2
votes
1
answer
48
views
Is it possible to regenerate a TCP request with the help of tcpdump
I'm developing a backend server and here is how the architecture of the backend looks like:
APP --> Server1 --> Server2 --> Server3 --> MyServer
APP sends a HTTP request to the Server1, ...
- 3,009
1
vote
1
answer
759
views
IPTables issue between proxmox and pfsense VM
I'm kind of desperate with an IPTables issue.
I started to setup my own dedicated server which is a proxmox server. I have a pfSense VM to which all traffic is routed. I secured the LAN access by ...
- 55
0
votes
1
answer
53
views
tcpdump isn't storing packets to file upon power loss
I'm working on a pi device that I can plug into the network and it will automatically start packet capturing to a rotating file. The idea behind the device is that when one of my clients is having a ...
1
vote
0
answers
160
views
Does writing tcpdump output to a file on ramdisk have effect on the number of packets dropped?
When running tcpdump, I see that sometimes number of packets dropped by kernel is greater than zero (0). I was told to write to a file on ramdisk instead of a file on harddisk. I am not expert on ...
- 111
0
votes
0
answers
138
views
tcpdump, determine transport protocol
Is there a easy way to determine the transport protocol of a packet by looking at the output of a TCP dump trace?
I'd just like to be able to tell if a packet is UDP or TCP. I've tried using the -x ...
- 129
0
votes
0
answers
178
views
tcpdump to monitor snmp from subnet causing syntax error
I'm trying to monitor SNMP from 2 hosts on the same subnet; 10.52.17.31 and 10.52.17.32. They are on the only machines on that subnet.
Using the following commands I receive a syntax error:
tcpdump -...
- 129
1
vote
1
answer
199
views
Why tcpdump does not work with -w flag?
So I have a network that I want to scan with tcpdump and dump the captured traffic into a file.
Let's say I try:
sudo tcpdump net 192.168.0.0/24
tcpdump will start and will show the traffic in the ...
1
vote
0
answers
49
views
How does tcpdump choose the default NIC to listen on?
From TCPDUMP(1)
-i interface
--interface=interface
Listen on interface. If unspecified, tcpdump searches the system interface
list for the lowest numbered, configured up ...
- 1,851
0
votes
0
answers
631
views
tcpdump to perform wireless capture with advanced filters
I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
- 47
0
votes
0
answers
46
views
Tcp connection not seen on peer node
I got several nodes to run my software. After startup, I found tcp connection is abnormal between two nodes.
Assume A is the leader which is listening on port 1234, B should connect A.
On node B, use ...
- 101
0
votes
1
answer
232
views
Is tcpdump a client of rpcpad and implemented in pcap?
https://www.tcpdump.org/index.html#documentation has manpages for pcap, tcpdump, and rpcapd, but I don't find what relation is between the three.
Is pcap a C library for implementing a client of ...
- 1
1
vote
0
answers
2k
views
How do I filter "BOOTP/DHCP, Request" out in tcpdump?
There are a lot of "BOOTP/DHCP, Request" in tcpdump and I would like to filter it out.
It's easy to filter arp out.
tcpdump -nni eth0 not arp
What about BOOTP/DHCP, Request?
I've tried the ...
- 1,371
2
votes
1
answer
221
views
tcpdump: why ack number greater than sack number?
I use tcpdump to troubleshot network problem, and found one record that ack number is greater than sack number:
Why ack number greater than sack number?
- 243
0
votes
1
answer
107
views
What is Fedora doing in this TCPdump?
So I decided to have tcpdump listen on port 80 because I use HTTPS whenever possible, and thought there shouldn't be anything there. Well, there was. I can see that one of these connections is the ...
- 135
1
vote
1
answer
2k
views
How to use tcpdump safely (-Z option vs file capabilities / setcap)?
I am evaluating, how tcpdump can be used in a safer manner with as few as possible privileges. Two possibilities:
1. -Z option
If tcpdump is running as root, after opening the capture device or input ...
- 155
0
votes
1
answer
677
views
tcpdump -G option for rotation
I would like to rotate the tcp dump saving every 100mS.
Hence I am trying the following option:
tcpdump -i eth0 -G 0.1 -w '.pcap'
This dumps all the incoming data into file and do not rotate every ...
-1
votes
1
answer
574
views
tcpdump displaying no output
I'm currently learning tcpdump and having trouble understanding it. When I type:
sudo tcpdump
It has all traffic going in and out of my machine. How would I apply this to listening to everything on my ...
- 141
2
votes
1
answer
4k
views
What is the filter expression to only sniff ICMP packets?
What is the filter expression to only sniff ICMP packets given the source IP address is 18.23.54.78 and the destination IP address is 12.67.24.89? The filter order must start with the protocol name ...
0
votes
2
answers
323
views
Filter tcpdump output (PCAP)
The following is the output from my PCAP file.
20:02:52.306161 192.162.70.150.58078 > 192.179.91.61.1194: P 635362993:635363048(55) ack 2046024708 win 4373 <nop,nop,timestamp 52993632 1059054949&...
1
vote
1
answer
6k
views
filter by incoming ip v4 packets with tcpdump
I want to filter with TCPDUMP only incoming and ip v4 packets.
tcpdump -i eth0 inbound and ip -w res.pcap give me incoming packets with ipv4 and ipv6
How can I filter by ipv4 only?
- 79
1
vote
1
answer
447
views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
- 256
0
votes
0
answers
225
views
Why do my Send-Q keep getting loaded but nothing come out of it?
I'm currently diagnosing a issue related to packet forwarding. I forward link layer packets to B network namespace and I found that B network namespace didn't reply to them, but I could curl and view ...
- 49
1
vote
1
answer
760
views
How to extract domains related to "Client Hello" in a pcap file
I have a tcpdump (pcap) capture file and want to extract all domains. I do it with the following command:
strings capture_file | grep -oiE '([a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.){1,}(\.?[a-zA-Z]{2,}){1,}' |...
- 851