Questions tagged [tcpdump]
a command line packet analyzer
229
questions
-1
votes
0answers
10 views
tcpdump displaying no output
I'm currently learning tcpdump and having trouble understanding it. When I type:
sudo tcpdump
It has all traffic going in and out of my machine. How would I apply this to listening to everything on my ...
0
votes
1answer
37 views
What is the filter expression to only sniff ICMP packets?
What is the filter expression to only sniff ICMP packets given the source IP address is 18.23.54.78 and the destination IP address is 12.67.24.89? The filter order must start with the protocol name ...
0
votes
1answer
43 views
Filter tcpdump output (PCAP)
The following is the output from my PCAP file.
20:02:52.306161 192.162.70.150.58078 > 192.179.91.61.1194: P 635362993:635363048(55) ack 2046024708 win 4373 <nop,nop,timestamp 52993632 1059054949&...
0
votes
1answer
20 views
filter by incoming ip v4 packets with tcpdump
I want to filter with TCPDUMP only incoming and ip v4 packets.
tcpdump -i eth0 inbound and ip -w res.pcap give me incoming packets with ipv4 and ipv6
How can I filter by ipv4 only?
-3
votes
0answers
23 views
Extract tcpdump output (pcap files) using tcpslice and tcpparse
I am trying to extract contents of a PCAP file using the following command.
# tcpslice 1597984805 1597988405 testfile.pcap | tcpparse -
1 192.168.30.145 132 > 8.8.8.8 1544 98
1 8.8.8.8 0 > 192....
1
vote
1answer
88 views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
0
votes
0answers
24 views
Why do my Send-Q keep getting loaded but nothing come out of it?
I'm currently diagnosing a issue related to packet forwarding. I forward link layer packets to B network namespace and I found that B network namespace didn't reply to them, but I could curl and view ...
1
vote
1answer
50 views
How to extract domains related to “Client Hello” in a pcap file
I have a tcpdump (pcap) capture file and want to extract all domains. I do it with the following command:
strings capture_file | grep -oiE '([a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.){1,}(\.?[a-zA-Z]{2,}){1,}' |...
1
vote
0answers
28 views
non promiscuous option in tcpdump
Strangely, depending on the program in which it is included, the tcpdump command used with the -p option (which should say "don't use promiscuous mode") nevertheless switches it on during ...
0
votes
1answer
18 views
capturing and analyzing packages through Raspberry Pi 4
So I am a beginner to RP4.
I am trying to learn more about network security using the Raspberry Pi 4.
I managed to set up the raspberry pi 4 as an access point. I am able to connect my personal laptop ...
1
vote
2answers
33 views
How can I forward output from one terminal to another server where I can use grep?
I need to run tcpdump on some switch and pass it through grep with advanced regexp. That switch shell ist quite stupid and there is no grep with regexp but there is a tcpdump with the options I need.
...
0
votes
0answers
33 views
Diagnosing packets dropped by bond0 interface
I recently setup Netdata on my home server, and observed the following behaviour on bond0:
It would seem that, rather consistently, about 60 inbound packets are dropped every 10 minutes. This ...
1
vote
0answers
151 views
I installed tcpdump, but it is showing command not found while using it
Also I used whereis & which command to check if the package exists
and it does exist.
0
votes
1answer
47 views
Timed tcpdump: pipe is slow
What I actually want to do is measure tcpdump for 10s.
$ timeout 10s tcpdump > my.log
but I found there has only a short period actually being logged, instead of whole 10s.
therefore I did this ...
0
votes
0answers
27 views
Incoming packet was garbled on decryption
I'm using Mobaxterm (SSH to a local VM), and I'm always disconnected with the following error :
Incoming packet was garbled on decryption
How can I fix that ?
Note : It happened when I was using ...
0
votes
0answers
6 views
In tcpdump how do I know if I'm using a port-type or port-expression type?
I came across an example of using tcpdump see below:
tcpdump port 3398
tcpdump src port 1025
And I don't know how to tell if I'm using a port-type or a port-expression-type
I know what tcpdump does,...
0
votes
2answers
65 views
Why there are a lot of packets not related to my IP been captured with tcpdump ? (Centos 7)
Tcpdump running by :
/usr/sbin/tcpdump -U -n -i eth0 icmp or tcp dst port 22 or tcp dst port
When I review the captured data , it shows :
132.132.211.221.40372 > 89.31.125.17.ssh: Flags [S], ...
-1
votes
1answer
40 views
Can “dumb” ethernet hub device be used for breaking security on Ethernet cable connection? [closed]
Many people will still know about those old ethernet "hub"-devices - also called "dumb" device or "Ethernet signal concentrator". Did anyone ever try to "listen to ANY traffic" on such port through an ...
0
votes
1answer
107 views
Get the user-agent from tcpdump
I'm working on a monitoring application for my home gateway and I want to know the device type of all connected clients. For that purpose I'm using tcpdump to extract the user-agent of all devices
...
0
votes
1answer
58 views
tcpd, inetd/rinetd and iptables
What is the correlation between these programs?
tcpd and inted/rinetd are very old but despite this they are still present in many distributions ... why?
And there is also a correlation between hosts....
1
vote
1answer
390 views
tcpdump traffic in network namespaces in `net=host` dockercontainer
I am trying to capture a tcpdump of a set of processes running in the mininet network emulation framework.
Mininet works by putting each process/set of processes into its own network namespace and ...
1
vote
5answers
116 views
sed/awk: replace numbers in a line after last occurance of '.'
I have the following tcpdump stream:
Current:
07:36:03.848461 IP 172.17.3.41.33101 > 172.17.3.43.17408: UDP, length 44
07:36:03.848463 IP 172.17.3.42.33101 > 172.17.3.43.17409: UDP, length 44
...
0
votes
0answers
19 views
Linux vlan int creation causes a loopback error
I have encountered a problem with configuring vlan tagged linux bridges, on a Cisco small businesses switches trunk interfaces. Our environment consists of 3 servers and one switch, that handles ...
0
votes
1answer
110 views
Determine program responsible for periodic short-lived network connections
I am interested in learning the proper procedure to determine which Linux program / process is responsible for a given short-lived network connection which repeats periodically.
Without making any ...
0
votes
0answers
26 views
Why can't the UDP coming from nc command without -v be captured by tcpdump
Saying that I have two machines in my LAN, A and B.
I execute tcpdump -i eth0 port 1234 at A to capture the packet coming from the port 1234.
Then I execute nc -u -v -z -w2 IP_OF_A 1234 at B to scan ...
0
votes
1answer
53 views
Traffic into lo vs eth, why might I be seeing only half the traffic on lo compared to eth?
I am forwarding traffic to ports on eth0 and lo.
For the same traffic at the same ports and different ports, when I do a tcpdump and count the packets, for time t, I only see about half the number of ...
0
votes
1answer
47 views
network behaviour with tcpdump
We are developing communication interface converter which is running Linux.
The unit may receive unicast or multicast IP and converts it to some other physical layer. On the other hand, the unit ...
2
votes
1answer
7k views
How can I capture all the UDP packets using tcpdump?
I have to capture all the UDP packets sent from host A to any UDP port of host B. The following, if run on host B, doesn't work.
$ sudo tcpdump -i eth0 -SX udp src <hostA>
tcpdump: 'udp' ...
-1
votes
1answer
140 views
Supress TCPDump output and show only the unique entries
I am trying to execute a tcpdump command which to show me only the unique entries. This is my command and the output:
$ sudo tcpdump -c 5 -q -i eno1 -nn -vvv tcp | sort | uniq
tcpdump: listening on ...
1
vote
0answers
158 views
How to measure software + hardware latency using tcpdump? ( Hw Timestamp)
I have an low latency application.But it's performance is unstable. So i want to find the bottleneck if it's related to network or related to my server ( software , os etc.)
So first i tried tcpdump ...
1
vote
1answer
77 views
What does it mean if requests from a blocked IP do not show up on tcpdump?
I have a VPS with Ubuntu 16.0.4 installed on it. Every time I connected to it through SSH, the next times I attempted to connect would end up in time out errors along with any other kind of connection ...
2
votes
1answer
89 views
How to know the interface from which we received a ping request
I know how to ping to a specific interface using the -I option. I want to know the interface through which I received the ping. I tried to use tcpdump for this but I cannot get any details. I can ...
2
votes
2answers
569 views
Tc qdisc delay not seen in tcpdump recording
I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
1
vote
1answer
1k views
tcpdump -z postrotate-command with shell script
I'm struggling to see where I am going wrong on trying to run a shell script with the -z flag for tcpdump. There does not seem to be a lot of/any examples of this flag being used. In the man page they ...
0
votes
1answer
3k views
How to record only the header info when using `tcpdump`
When running the following command
tcpdump -i deviceName 'host 1.2.3.4' -q -w /mypath/dump.pcap
the dump file contains a huge amount of data because there's a lot of traffic. However, I only need ...
2
votes
2answers
2k views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
0
votes
0answers
307 views
tcpdump usbmon module output explained
Running the command:
tcpdump -qAXni usbmon3 -s 0
I am getting this output:
02:32:04.781964 BULK SUBMIT to 3:16:4
What does the last number after the colon (4) represent?
How can I identify it in ...
-1
votes
1answer
90 views
Tcpdump to usb drive
Packets are being generated at 750 packets/second and I am using tcpdump to capture these packets and write them to file stored in a usb drive. Due to write speed limitations, the overall process of ...
2
votes
1answer
623 views
Stop CTRL+C Exiting Local Script Which is Running tcpdump in Remote Machine
I have setup a simple script like the below:
sshpass -p $password ssh -T $username@$ip_address -p 30007 <<- EOF > $save_file.pcap
sh
tcpdump -i eth5.1 -s 0 -n -v -U -w -
EOF
sed -i '...
0
votes
1answer
121 views
How to Pipe Segment of Heredoc Output to Local File
I am issuing a command to a remote device in order to run a tcpdump on one of it's interfaces, but capture the output to a local .pcap file on my Ubuntu VM. The command that I'm issuing is as follows:
...
0
votes
1answer
738 views
How to Pass Multiple Commands to Remote Device via SSHPass [duplicate]
I'm trying to setup a method in which I can run remote tcpdumps on some of my devices, and save the file to my local machine for analysis (I don't want to save the file on the remote device and then ...
2
votes
1answer
2k views
Capture http token with tcpdump
My server runs curl commands to some API using a token. For example:
curl --header "Private-Token: aaaaaaaaaaaaaa" http://mysite.example.com/api/v4/any
Can i capture with tcpdump all of the requests ...
5
votes
2answers
811 views
'ping' uses localhost instead of public IP address
Let's say my server has IP address 11.22.33.44 and hostname server1.mydomain.com.
When I ping server1.mydomain.com, it looks as if ping is actually using the public IP address:
# ping server1....
0
votes
1answer
666 views
Ping responses missing but can see them in tcpdump
Redhat 2.6.32-754.el6.x86_64
I have an FPGA card acting as a NIC with an associated driver.
On my RH host, if I run ping through the FPGA NIC I see lots of missing responses. However, if I also run ...
3
votes
2answers
2k views
What and how length is determined in tcpdump
What my application does is read data from kafka and hit another service via HTTP. I was seeing outgoing traffic slower in one box compare to others. I analysed tcpdump to that outgoing IP, logs from ...
2
votes
1answer
3k views
tcpdump/tshark: view only outgoing TCP connections requests
I would like to view TCP requests (syn packets) initiated by my PC/server to other hosts. More specifically, I would like to view the outgoing connection requests. How can I accomplish this?
Also, I ...
0
votes
1answer
108 views
Monitor Nextcloud connections with netstat
I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server.
I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
3
votes
1answer
621 views
tcpdump with multiple subtypes specified?
I'm trying to create a bash script to detect deauthentication attacks (I am on Mac). Whilst I am aware that the command:
$ tcpdump -l -I -i en0 -e -s 256 type mgt subtype deauth
will detect ...
1
vote
1answer
2k views
How to find the cause of TCP RST on Linux (Ubuntu Server)
In my mail server I'm getting high TCP reset send between working hours, as shown in this grafic:
This is a capture of the server traffic filter by tcp-rst:
When I run "netstat -i" I get this:
...
0
votes
2answers
114 views
Can't sniff / initiate DHCP renew
I am running
sudo tcpdump -i enp0s31f6 -n port 67 and port 68
on one terminal and running
sudo dhclient -r
on another.
During this, I see nothing on first terminal.
What I am doing wrong?
...
