Questions tagged [tcpdump]

a command line packet analyzer

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Linux vlan int creation causes a loopback error

I have encountered a problem with configuring vlan tagged linux bridges, on a Cisco small businesses switches trunk interfaces. Our environment consists of 3 servers and one switch, that handles ...
0
votes
1answer
100 views

Determine program responsible for periodic short-lived network connections

I am interested in learning the proper procedure to determine which Linux program / process is responsible for a given short-lived network connection which repeats periodically. Without making any ...
0
votes
0answers
21 views

Why can't the UDP coming from nc command without -v be captured by tcpdump

Saying that I have two machines in my LAN, A and B. I execute tcpdump -i eth0 port 1234 at A to capture the packet coming from the port 1234. Then I execute nc -u -v -z -w2 IP_OF_A 1234 at B to scan ...
0
votes
1answer
36 views

Traffic into lo vs eth, why might I be seeing only half the traffic on lo compared to eth?

I am forwarding traffic to ports on eth0 and lo. For the same traffic at the same ports and different ports, when I do a tcpdump and count the packets, for time t, I only see about half the number of ...
0
votes
1answer
27 views

network behaviour with tcpdump

We are developing communication interface converter which is running Linux. The unit may receive unicast or multicast IP and converts it to some other physical layer. On the other hand, the unit ...
0
votes
1answer
147 views

How can I capture all the UDP packets using tcpdump?

I have to capture all the UDP packets sent from host A to any UDP port of host B. The following, if run on host B, doesn't work. $ sudo tcpdump -i eth0 -SX udp src <hostA> tcpdump: 'udp' ...
-1
votes
1answer
30 views

Supress TCPDump output and show only the unique entries

I am trying to execute a tcpdump command which to show me only the unique entries. This is my command and the output: $ sudo tcpdump -c 5 -q -i eno1 -nn -vvv tcp | sort | uniq tcpdump: listening on ...
1
vote
0answers
86 views

How to measure software + hardware latency using tcpdump? ( Hw Timestamp)

I have an low latency application.But it's performance is unstable. So i want to find the bottleneck if it's related to network or related to my server ( software , os etc.) So first i tried tcpdump ...
1
vote
1answer
31 views

What does it mean if requests from a blocked IP do not show up on tcpdump?

I have a VPS with Ubuntu 16.0.4 installed on it. Every time I connected to it through SSH, the next times I attempted to connect would end up in time out errors along with any other kind of connection ...
0
votes
0answers
58 views

capture phase 1 of IPSEC with tcpdump

I'm capturing the incoming/outgoing traffic from GW-A/GW-B on GW-A. The way I'm doing so is by using tcpdump with these options" tcpdump -i any port 500. This way it gives me the renegotiation ...
0
votes
0answers
105 views

Local Chrony server and client not syncing

I'm trying to demonstrate a simple Linux local network with some most used services on it. I have two virtual machines (Fedora Server 30): A, B. I have configured A to act as a router in the network ...
2
votes
1answer
50 views

How to know the interface from which we received a ping request

I know how to ping to a specific interface using the -I option. I want to know the interface through which I received the ping. I tried to use tcpdump for this but I cannot get any details. I can ...
2
votes
2answers
293 views

Tc qdisc delay not seen in tcpdump recording

I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
0
votes
1answer
578 views

tcpdump -z postrotate-command with shell script

I'm struggling to see where I am going wrong on trying to run a shell script with the -z flag for tcpdump. There does not seem to be a lot of/any examples of this flag being used. In the man page they ...
0
votes
1answer
1k views

How to record only the header info when using `tcpdump`

When running the following command tcpdump -i deviceName 'host 1.2.3.4' -q -w /mypath/dump.pcap the dump file contains a huge amount of data because there's a lot of traffic. However, I only need ...
2
votes
2answers
954 views

How to capture WOL packets?

I used sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9 but didn't see anything when WakeMeOnLan from NirSoft wakes the computer. The same with Wireshark
0
votes
0answers
196 views

tcpdump usbmon module output explained

Running the command: tcpdump -qAXni usbmon3 -s 0 I am getting this output: 02:32:04.781964 BULK SUBMIT to 3:16:4 What does the last number after the colon (4) represent? How can I identify it in ...
-1
votes
1answer
51 views

Tcpdump to usb drive

Packets are being generated at 750 packets/second and I am using tcpdump to capture these packets and write them to file stored in a usb drive. Due to write speed limitations, the overall process of ...
1
vote
1answer
248 views

Stop CTRL+C Exiting Local Script Which is Running tcpdump in Remote Machine

I have setup a simple script like the below: sshpass -p $password ssh -T $username@$ip_address -p 30007 <<- EOF > $save_file.pcap sh tcpdump -i eth5.1 -s 0 -n -v -U -w - EOF sed -i '...
0
votes
1answer
86 views

How to Pipe Segment of Heredoc Output to Local File

I am issuing a command to a remote device in order to run a tcpdump on one of it's interfaces, but capture the output to a local .pcap file on my Ubuntu VM. The command that I'm issuing is as follows: ...
0
votes
1answer
362 views

How to Pass Multiple Commands to Remote Device via SSHPass [duplicate]

I'm trying to setup a method in which I can run remote tcpdumps on some of my devices, and save the file to my local machine for analysis (I don't want to save the file on the remote device and then ...
2
votes
1answer
1k views

Capture http token with tcpdump

My server runs curl commands to some API using a token. For example: curl --header "Private-Token: aaaaaaaaaaaaaa" http://mysite.example.com/api/v4/any Can i capture with tcpdump all of the requests ...
5
votes
2answers
615 views

'ping' uses localhost instead of public IP address

Let's say my server has IP address 11.22.33.44 and hostname server1.mydomain.com. When I ping server1.mydomain.com, it looks as if ping is actually using the public IP address: # ping server1....
0
votes
1answer
360 views

Ping responses missing but can see them in tcpdump

Redhat 2.6.32-754.el6.x86_64 I have an FPGA card acting as a NIC with an associated driver. On my RH host, if I run ping through the FPGA NIC I see lots of missing responses. However, if I also run ...
3
votes
2answers
1k views

What and how length is determined in tcpdump

What my application does is read data from kafka and hit another service via HTTP. I was seeing outgoing traffic slower in one box compare to others. I analysed tcpdump to that outgoing IP, logs from ...
2
votes
1answer
1k views

tcpdump/tshark: view only outgoing TCP connections requests

I would like to view TCP requests (syn packets) initiated by my PC/server to other hosts. More specifically, I would like to view the outgoing connection requests. How can I accomplish this? Also, I ...
0
votes
1answer
89 views

Monitor Nextcloud connections with netstat

I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server. I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
3
votes
1answer
443 views

tcpdump with multiple subtypes specified?

I'm trying to create a bash script to detect deauthentication attacks (I am on Mac). Whilst I am aware that the command: $ tcpdump -l -I -i en0 -e -s 256 type mgt subtype deauth will detect ...
1
vote
1answer
2k views

How to find the cause of TCP RST on Linux (Ubuntu Server)

In my mail server I'm getting high TCP reset send between working hours, as shown in this grafic: This is a capture of the server traffic filter by tcp-rst: When I run "netstat -i" I get this: ...
0
votes
2answers
92 views

Can't sniff / initiate DHCP renew

I am running sudo tcpdump -i enp0s31f6 -n port 67 and port 68 on one terminal and running sudo dhclient -r on another. During this, I see nothing on first terminal. What I am doing wrong? ...
1
vote
1answer
262 views

Strange permission denied error message

Here is what I'm trying to do (CentOS 7): root@serv02 # /usr/sbin/tcpdump -nn -i eno16780032 -s 0 udp port 53 -w /var/opt/A.pcap -C 100 -W 30 tcpdump: /var/opt/A.pcap00: Permission denied I'm ...
1
vote
1answer
566 views

tcpdump - realtime dns logger with pipe

I want to get DNS A records in realtime with tcpdump on stdout. tcpdump -i any dst port 53 | awk '/ A\? / {u = NF - 1; print $u}' | sed 's/.$//g' There is no output coming from the above line. ...
1
vote
1answer
385 views

Get back to default login shell after running /bin/bash

When logging in the prompt is different than it is after executing /bin/bash -bash-4.2$ exec bash bash-4.2$ How do I get the - back in front of the bash. There are certain commands like tcp dump ...
0
votes
1answer
34 views

Non-logging REST API: How can I write all HTTP(s) requests and responses to a file?

I have a daemon, call it whatverd, running on TCP port 11111. It is basically an http server, but it does not do any kind of logging or debugging. It only returns query results via JSON in the http(s) ...
1
vote
1answer
263 views

Capturing lvsadm UDP traffic on the loopback interface [closed]

Problem I am unable to capture lvsadm traffic on the loopback interface. # tcpdump -i lo -n udp port 51444 -vv tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes ...
0
votes
1answer
453 views

Syslog-ng not sending messages to localhost port 514 on centos 7.5

tcpdump -nnAs0 -i eth0 port 514 As I understand it this should display any logging msgs sent to syslog locally. However I send many via python syslog module, which I can tail via /var/log/messages ...
2
votes
1answer
405 views

Can a port use multiple interfaces for communication?

My understanding of the following command: tcpdump -i any -nn port X tcpdump -> Start service to capture packets. -i any -> On any/all interface(s). -nn -> Don't convert host addresses to names ...
2
votes
1answer
249 views

What is “cooked mode” wifi monitoring?

The following is an excerpt from iw's help page: dev <devname> set monitor * Set monitor flags. Valid flags are: none: no special flags fcsfail: show frames with ...
1
vote
0answers
22 views

Strange behaviour of (D)NAT

I'm trying to forward all icmp requests from source ip 5.10.13.13 to new destination ip 5.10.11.11. IP of current local machine, where i'm applying iptables rule is 5.10.10.10. I apply this rule: ...
2
votes
0answers
112 views

internet access with ping has 100% loss

LAST BREAKTHROUGH -> see the tshark results below for some clue Hi, at home I have the following setup: Internet - NAS (Ubuntu 16.04.4 LTS) - LAN (Asus N56U WiFi) - family users. NAS connects ...
3
votes
0answers
118 views

Fast lossless, compressed streaming of packet capture between two servers?

Suppose I am capturing packets on a remote host with tcpdump (more precisely, I'm doing it with an Endace card, which exposes a tcpdump-like utility called dagsnap). What would be a fast way to ...
0
votes
1answer
230 views

Tcpdump:malicious packets?

The packets captured with this command are packets whit the evil bit set? Should i worry about? sudo tcpdump 'ip[6] & 128 != 0' tcpdump: verbose output suppressed, use -v or -vv for full protocol ...
3
votes
1answer
60 views

Map a port to another on same machine

I have all the traffic coming on port 22. I chose a random port 221 on which i want all of the traffic to be routed. This is the rule i used iptables -t nat -A PREROUTING -p tcp --dport 22 -j ...
0
votes
1answer
2k views

tcpdump tracing UDP packets

On redhat linux box, I am trying to trace the snmp traps coming from IP a.b.c.d, as shown below: sudo /usr/sbin/tcpdump src host 142.125.248.36 and udp dst port 162 -w /home/user1/troubleshoot.pcap ...
2
votes
0answers
534 views

Use tcpdump to capture TCP transmitted data withouth the protocol's details (similar to tcpflow)

I use tcpflow a lot to capture data transmitted as part of TCP connections. It allows you to see the transmitted data without any of the TCP protocol details. Is there a way to accomplish the same ...
4
votes
1answer
2k views

tcpdump -i any doesn't work on FreeBSD

How to listen all interfaces on FreeBSD with tcpdump > tcpdump -i any tcpdump: any: No such device exists (BIOCSETIF failed: Device not configured) (I would like to listen ICMP)
1
vote
0answers
271 views

tcpdump packets length mismatch

I'm trying to find out why my application has a huge network traffic, particularly, the outbound traffic. Researching the issue, I found a number such packets where length mismatches the difference ...
0
votes
1answer
80 views

Monitor interface not showing TX packets

I have set up a monitor interface using: iw dev wlan0 interface add mon0 type monitor ifconfig mon0 up And I am using libpcap to capture and inspect 802.11 frames and radiotap headers. I was ...
1
vote
1answer
3k views

Can tcpdump filter by timestamp?

I have a file with packets captured by tcpdump over the span of a few days. From this file I would like to look at packets captured over a specific time duration spanning just a couple of hours. I ...
2
votes
1answer
964 views

bash script: capturing tcp traffic on a remote server sometimes works, sometimes fails. No errors

Background I am running BusyBox in the remote server. I have a bash script that does two things: 1. via ssh, starts a sub process to monitor tcp traffic using tcpdump command. Save results to a ...