Questions tagged [tcpdump]

a command line packet analyzer

Filter by
Sorted by
Tagged with
2 votes
2 answers
82 views

tcpdump takes O(n²) time to parse filter

I run tcpdump with a filter like: not ( (host 1.165.155.169 and port 4444) or (host 1.168.68.116 and port 4444) or (host 1.173.192.253 and port 4444) or (host 1.174.97.43 and port 4444) :...
Ole Tange's user avatar
  • 35.6k
0 votes
0 answers
103 views

Is possible to "sniff" a socket? Socat doesn't work

This is the situation: I have two VM (virtual machines) via kvm-qemu connected via virtual-serial (a socket). I created the two vm's with this serial configuration: serial1 (slackware, uses port1 ...
elbarna's user avatar
  • 12.7k
0 votes
1 answer
55 views

tcpdump doesn't appear to call any libpcap's exported function

Digging into tcpdump implementation, I can see that it actually loads the libpcap.so dynamic library in userspace. However, by use of strace, I can't see any occurrence of calls to any function ...
Carlo C's user avatar
0 votes
1 answer
210 views

How to enable a host to reply to multicast ping

I'm experimenting with multicast traffic within my wireless network and tried to ping some pre-defined multicast address: $ ping 224.0.0.251 The ip address of the ping machine is 192.168.0.11. So I ...
Some Name's user avatar
  • 255
0 votes
0 answers
34 views

Identify service/script running on a port

System specs: Linux client 3.10.0-123.20.1.el7.x86_64 #1 SMP Centos 5 I am having some blockages on my DC. I have identified the machine that is making the requests. I also analyzed the outgoing ...
fah81's user avatar
  • 21
0 votes
0 answers
82 views

discreetly listen on nflog groups using tcpdump

I just discovered the tcpdump feature which allows you to listen to an nflog groups, (i.e. tcpdump -i nflog:1337). It does however seem to also break any application which relies on reading from this ...
Philippe's user avatar
  • 431
0 votes
0 answers
91 views

How do you mark both incoming and outgoing packets to a cgroup v1 net classifier?

I'm attempting to isolate and tcpdump all network traffic from a single process, following the instructions here:(How to mark packets by program): $ sudo bash # mkdir /sys/...
PFudd's user avatar
  • 173
0 votes
0 answers
146 views

Print entire 802.11 WiFi Ethernet frame header with tcpdump (or anything else)

I'm currently learning about WiFi Ethernet frames and want to sniff raw ethernet traffic from my laptop's WiFi adapter. Running sudo tcpdump -vvv -n -i wifi0 -e prints something like the following: ...
Some Name's user avatar
  • 255
0 votes
0 answers
47 views

Why doesn't my wi-fi router send STP frames?

I'm learning about Spanning Tree Protocol and was trying to capture STP frames sent from my wi-fi router by tcpdump. Here is the command: sudo tcpdump -vv -n -i en0 stp and for pretty large period ...
Some Name's user avatar
  • 255
0 votes
2 answers
30 views

Pinging two PCs and trying to capture ICMPs with third PC

I have a setup of three computers that are all on the same subnet and connected to a switch. All services are reachable. I'm pinging from PC(1) to PC(2). Opening tshark with PC(3) but cannot see ...
ptiza_v_nebe's user avatar
2 votes
1 answer
799 views

Why can I capture all incoming packet even the promiscuous mode is not enabled?

I use the command below to capture the bypass packet on interface ens160 : tcpdump -i ens160 -w test.pcap During this time, I use commands below to check if the promiscuous mode is enabled on ens160 :...
chenxinlong's user avatar
0 votes
0 answers
70 views

tcpdump: how to see source and destination of HE_MU packets?

I'm currently testing a router and trying to capture HE_MU packets. For this I have a setup with 5 end-user devices and a device that acts as a packet sniffer and also hosts iperf3 servers. I put ...
Shafigh's user avatar
1 vote
0 answers
33 views

Issues with BPF filters and 6to4 traffic

I have a pcap file captured with tcpdump: tcpdump -w out.pcap -ni eno1 host 192.88.99.1 I can view the pcap: rful011@secmonprd13:~$ tcpdump -nr out.pcap -tttt | head reading from file andy.tcpd, link-...
Russell Fulton's user avatar
1 vote
1 answer
92 views

I see only DHCP requests but not DHCP responses from "parallel" computer

I have two Raspberry Pies and one DHCP server connected to a switch. Raspi #2 is configured to do netboot. I am sitting on Raspi #1 and doing tcpdump 'ether host b8:27:eb:5d:4a:f6' -p -i eth0 -vv I ...
Dims's user avatar
  • 3,255
2 votes
1 answer
580 views

tcpdump display packets with high delay

I used tcpdump to capture packets from local rsyslog service to syslog server, however, when I tried different commands (with/without dst option) in tcpdump, the displayed result has a delay. Expected/...
ICYPOLE's user avatar
  • 23
1 vote
0 answers
47 views

TCPDUMP Missing response Code header in Back to back execution

I am running two TCPDUMP Commands back to back. Here is the sequence Run the below command root@open5Gs:/home/test# tcpdump -l -vvv -s0 -i any -B 4096 -nn -w /home/test/tc060.pcap -c 1500 Execute ...
Sayantan_Dell's user avatar
1 vote
1 answer
433 views

Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?

I'm trying to filter traffic by src ether host to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24 to see OUI's matching aa:...
KJ7LNW's user avatar
  • 485
0 votes
1 answer
81 views

Decoding wireless captures / filters on Linux

I am trying to filter a capture file that was captured by a remote AP. If i pull the file to my laptop i can open in Wireshark decode as peekremote and create the display filter EAPOL to get the ...
DevilWAH's user avatar
  • 111
1 vote
0 answers
465 views

tcpdump -i any and slave interfaces

The core requirement can be expressed as "filtering out slave interfaces from -i any". In this case, packets leaving on a vlan for bond0 should not also be retrieved for bond0, or the ...
Jaco Kroon's user avatar
1 vote
1 answer
865 views

how can I parse tcpdump stream live?

I have a debian installation, where the OEM has a bunch of processes I dont recognize running, and I want to figure out if any of these things are dialing home. I ran sudo tcpdump | grep ^e <ssh_ip&...
j0h's user avatar
  • 3,617
1 vote
1 answer
202 views

How to get aggregate packet information using a tool like tcpdump

I'd like to analyze packets in one of my VMs to see where how the network traffic is flowing. I found tcpdump which seems to be able to capture the packets. However, I'd like to find a way to ...
Paymahn Moghadasian's user avatar
0 votes
1 answer
135 views

How can record all ip address visited from my pc with tcpdump?

I want to record all ip address requested from my local pc ,how can record all ip address with tcpdump?
newview's user avatar
  • 205
0 votes
1 answer
975 views

Why does tcpdump capture packets that are blocked by iptables? How to filter those packets out?

I am using this command to debug my SIP traffic tcpdump -i eth0 -nt port 5060 -v and that outputs something like this: IP (tos 0x0, ttl 113, id 6082, offset 0, flags [none], proto UDP (17), length 504)...
Tono Nam's user avatar
  • 298
0 votes
0 answers
82 views

No results from TCPDUMP

I have a solar panel inverter which is wifi connected. When I run tcpdump I get zero output. I know it's using the wifi because when the broadband went down for several hours there was nothing ...
user667522's user avatar
1 vote
0 answers
55 views

Why 802.1q protocal packet auto dropped by interface?

I transfer a series of test packet with IEC61850_SV protocal in my host as follows: 01 0C CD 04 00 03 00 0C CD 04 00 00 81 00 80 01 88 BA 40 03 01 24 00 00 00 00 60 82 01 18 80 01 01 A2 82 01 11 30 ...
Sun Caelus's user avatar
0 votes
0 answers
143 views

Is there an optimized solution for tcpdump pulling a specific IP?

I made a script that runs tcpdump in the background: nohup tcpdump -i $INTERFACENAME dst $IPC >> text.txt And I made another script that pulls any IP address other than $IP from text.txt, but ...
Mohamed Khalil Rouissi's user avatar
1 vote
2 answers
3k views

associate IP with hostname without editing /etc/hosts

I know I can associate hostname with my IP address in /etc/hosts: 1.2.3.4 foo and then, for example in tcpdump output, I will see foo instead of my IP address (if -n was not used) Anyways, can I ...
Martin Vegter's user avatar
1 vote
1 answer
893 views

tcpdump: always show numerical port numbers

The option -n in tcpdump is useful. Sometimes I prefer to see IP addresses, and sometimes I prefer to have the IP addresses resolved into hostnames. But never do I want to have port numbers translated ...
Martin Vegter's user avatar
4 votes
2 answers
8k views

System clock not synchronized with NTP server using systemd-timesyncd

I followed this answer here, but it seems that my system clock doesn't synchronize with NTP server: $ cat /etc/debian_version 10.9 $ egrep -v "^$|^#" /etc/systemd/timesyncd.conf [Time] NTP=x....
SebMa's user avatar
  • 2,169
1 vote
1 answer
336 views

TCPDUMP IP UNKNOWN

I am seeing this in the tcpdump output 21:32:51.580969 IP UNKNOWN.9998 > 255.255.255.255.9998: UDP, length 12 What does 'IP UNKNOWN' mean? Is something hiding the ip address? Thanks
user667522's user avatar
1 vote
1 answer
334 views

tcpdump in Kali Linux VM does not capture scp between two devices

Situation: I'm learning how to develop tests for a hardened server my company is developing for a client. The test configuration will consist of the test target (the server we're developing) and an ...
placebo_me_please's user avatar
1 vote
2 answers
3k views

Is possible to capture packets between two hosts from a third host in the same network?

I want to see traffic between two hosts from a third host, there are all on my network I did this on the third host: ip link set eth0 promisc on tcpdump -vv -i eth0 -xX host 192.168.0.2 and host 192....
elbarna's user avatar
  • 12.7k
9 votes
2 answers
3k views

Understanding of BPF

When I need to capture some packets using tcpdump, I use command like: tcpdump -i eth0 "dst host 192.168.1.0" I always think the dst host 192.168.1.0 part is something called BPF, Berkeley ...
Fajela Tajkiya's user avatar
1 vote
1 answer
313 views

-Y and read {src,dst} port and tshark

tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
PersianGulf's user avatar
  • 10.9k
1 vote
1 answer
1k views

how to modify pcap file for Additional Information in packet

I have one Pcap File which consist of Some Information. I need to modify the data in the file. Example: As you can see There are details of packets and in Additional Record section I have TXT value ...
Amogh Saxena - REXTER's user avatar
0 votes
1 answer
1k views

Why can't assign permission for normal user?

Install tcpdump on my debian10: sudo apt install -y tcpdump which tcpdump /usr/bin/tcpdump groupadd pcap usermod -a -G pcap $USER sudo chgrp pcap /usr/bin/tcpdump sudo chmod 750 /usr/bin/tcpdump sudo ...
showkey's user avatar
  • 333
1 vote
2 answers
311 views

What does double n mean in tcpdump command?

The tcpdump manual shows: -n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names. I have seen double n in a tcpdump command: https://danielmiessler.com/study/tcpdump/ ...
showkey's user avatar
  • 333
2 votes
1 answer
100 views

Is it possible to regenerate a TCP request with the help of tcpdump

I'm developing a backend server and here is how the architecture of the backend looks like: APP --> Server1 --> Server2 --> Server3 --> MyServer APP sends a HTTP request to the Server1, ...
Yves's user avatar
  • 3,291
1 vote
1 answer
995 views

IPTables issue between proxmox and pfsense VM

I'm kind of desperate with an IPTables issue. I started to setup my own dedicated server which is a proxmox server. I have a pfSense VM to which all traffic is routed. I secured the LAN access by ...
Darktortue's user avatar
0 votes
1 answer
82 views

tcpdump isn't storing packets to file upon power loss

I'm working on a pi device that I can plug into the network and it will automatically start packet capturing to a rotating file. The idea behind the device is that when one of my clients is having a ...
Stephen Remich's user avatar
1 vote
0 answers
300 views

Does writing tcpdump output to a file on ramdisk have effect on the number of packets dropped?

When running tcpdump, I see that sometimes number of packets dropped by kernel is greater than zero (0). I was told to write to a file on ramdisk instead of a file on harddisk. I am not expert on ...
ulubeyn's user avatar
  • 111
0 votes
0 answers
388 views

tcpdump, determine transport protocol

Is there a easy way to determine the transport protocol of a packet by looking at the output of a TCP dump trace? I'd just like to be able to tell if a packet is UDP or TCP. I've tried using the -x ...
Frank's user avatar
  • 129
0 votes
0 answers
345 views

tcpdump to monitor snmp from subnet causing syntax error

I'm trying to monitor SNMP from 2 hosts on the same subnet; 10.52.17.31 and 10.52.17.32. They are on the only machines on that subnet. Using the following commands I receive a syntax error: tcpdump -...
Frank's user avatar
  • 129
1 vote
1 answer
416 views

Why tcpdump does not work with -w flag?

So I have a network that I want to scan with tcpdump and dump the captured traffic into a file. Let's say I try: sudo tcpdump net 192.168.0.0/24 tcpdump will start and will show the traffic in the ...
Asparuh Gavrailov's user avatar
1 vote
0 answers
223 views

How does tcpdump choose the default NIC to listen on?

From TCPDUMP(1) -i interface --interface=interface Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up ...
basin's user avatar
  • 2,061
0 votes
0 answers
1k views

tcpdump to perform wireless capture with advanced filters

I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
wiwinut's user avatar
  • 67
0 votes
0 answers
72 views

Tcp connection not seen on peer node

I got several nodes to run my software. After startup, I found tcp connection is abnormal between two nodes. Assume A is the leader which is listening on port 1234, B should connect A. On node B, use ...
sel-fish's user avatar
  • 101
2 votes
1 answer
378 views

Is tcpdump a client of rpcpad and implemented in pcap?

https://www.tcpdump.org/index.html#documentation has manpages for pcap, tcpdump, and rpcapd, but I don't find what relation is between the three. Is pcap a C library for implementing a client of ...
Mary's user avatar
  • 1
3 votes
1 answer
5k views

How do I filter "BOOTP/DHCP, Request" out in tcpdump?

There are a lot of "BOOTP/DHCP, Request" in tcpdump and I would like to filter it out. It's easy to filter arp out. tcpdump -nni eth0 not arp What about BOOTP/DHCP, Request? I've tried the ...
Wolf's user avatar
  • 1,631
2 votes
1 answer
386 views

tcpdump: why ack number greater than sack number?

I use tcpdump to troubleshot network problem, and found one record that ack number is greater than sack number: Why ack number greater than sack number?
Ren's user avatar
  • 273

1
2 3 4 5 6