Questions tagged [tcpdump]
a command line packet analyzer
0
votes
1answer
40 views
tcpdump -z postrotate-command with shell script
I'm struggling to see where I am going wrong on trying to run a shell script with the -z flag for tcpdump. There does not seem to be a lot of/any examples of this flag being used. In the man page they ...
0
votes
1answer
32 views
How to record only the header info when using `tcpdump`
When running the following command
tcpdump -i deviceName 'host 1.2.3.4' -q -w /mypath/dump.pcap
the dump file contains a huge amount of data because there's a lot of traffic. However, I only need ...
1
vote
1answer
56 views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
0
votes
0answers
59 views
tcpdump usbmon module output explained
Running the command:
tcpdump -qAXni usbmon3 -s 0
I am getting this output:
02:32:04.781964 BULK SUBMIT to 3:16:4
What does the last number after the colon (4) represent?
How can I identify it in ...
-1
votes
1answer
26 views
Tcpdump to usb drive
Packets are being generated at 750 packets/second and I am using tcpdump to capture these packets and write them to file stored in a usb drive. Due to write speed limitations, the overall process of ...
1
vote
1answer
66 views
Stop CTRL+C Exiting Local Script Which is Running tcpdump in Remote Machine
I have setup a simple script like the below:
sshpass -p $password ssh -T $username@$ip_address -p 30007 <<- EOF > $save_file.pcap
sh
tcpdump -i eth5.1 -s 0 -n -v -U -w -
EOF
sed -i '...
0
votes
1answer
52 views
How to Pipe Segment of Heredoc Output to Local File
I am issuing a command to a remote device in order to run a tcpdump on one of it's interfaces, but capture the output to a local .pcap file on my Ubuntu VM. The command that I'm issuing is as follows:
...
0
votes
1answer
79 views
How to Pass Multiple Commands to Remote Device via SSHPass [duplicate]
I'm trying to setup a method in which I can run remote tcpdumps on some of my devices, and save the file to my local machine for analysis (I don't want to save the file on the remote device and then ...
2
votes
1answer
191 views
Capture http token with tcpdump
My server runs curl commands to some API using a token. For example:
curl --header "Private-Token: aaaaaaaaaaaaaa" http://mysite.example.com/api/v4/any
Can i capture with tcpdump all of the requests ...
6
votes
2answers
395 views
'ping' uses localhost instead of public IP address
Let's say my server has IP address 11.22.33.44 and hostname server1.mydomain.com.
When I ping server1.mydomain.com, it looks as if ping is actually using the public IP address:
# ping server1....
0
votes
1answer
70 views
Ping responses missing but can see them in tcpdump
Redhat 2.6.32-754.el6.x86_64
I have an FPGA card acting as a NIC with an associated driver.
On my RH host, if I run ping through the FPGA NIC I see lots of missing responses. However, if I also run ...
1
vote
0answers
187 views
hping3: memlockall(): Operation not supported [closed]
I am trying to run the following hping command on Kali Linux :
sudo hping3 --setseq 2118917773 -s 42660 -p 5555 -c 1 -P 192.168.0.216
-E /root/task4test.txt -d 18
but for some reason I get the error ...
3
votes
2answers
493 views
What and how length is determined in tcpdump
What my application does is read data from kafka and hit another service via HTTP. I was seeing outgoing traffic slower in one box compare to others. I analysed tcpdump to that outgoing IP, logs from ...
1
vote
1answer
370 views
tcpdump/tshark: view only outgoing TCP connections requests
I would like to view TCP requests (syn packets) initiated by my PC/server to other hosts. More specifically, I would like to view the outgoing connection requests. How can I accomplish this?
Also, I ...
0
votes
1answer
60 views
Monitor Nextcloud connections with netstat
I'm not able to detect incoming connections from Nextcloud sync clients via netstat on my server.
I have a server in my LAN, running Nextcloud with MySQL in docker containers. I use multiple ...
3
votes
1answer
165 views
tcpdump with multiple subtypes specified?
I'm trying to create a bash script to detect deauthentication attacks (I am on Mac). Whilst I am aware that the command:
$ tcpdump -l -I -i en0 -e -s 256 type mgt subtype deauth
will detect ...
0
votes
1answer
620 views
How to find the cause of TCP RST on Linux (Ubuntu Server)
In my mail server I'm getting high TCP reset send between working hours, as shown in this grafic:
This is a capture of the server traffic filter by tcp-rst:
When I run "netstat -i" I get this:
...
1
vote
0answers
60 views
Weird issue with network tap [closed]
I have googled this to death and can not find an answer that works.
Basically, I am mirroring a port on a Nexus switch to a server. The server receives a bunch of packets, no big deal. The issue is ...
0
votes
2answers
42 views
Can't sniff / initiate DHCP renew
I am running
sudo tcpdump -i enp0s31f6 -n port 67 and port 68
on one terminal and running
sudo dhclient -r
on another.
During this, I see nothing on first terminal.
What I am doing wrong?
...
1
vote
1answer
82 views
Strange permission denied error message
Here is what I'm trying to do (CentOS 7):
root@serv02 # /usr/sbin/tcpdump -nn -i eno16780032 -s 0 udp port 53 -w /var/opt/A.pcap -C 100 -W 30
tcpdump: /var/opt/A.pcap00: Permission denied
I'm ...
1
vote
1answer
295 views
tcpdump - realtime dns logger with pipe
I want to get DNS A records in realtime with tcpdump on stdout.
tcpdump -i any dst port 53 | awk '/ A\? / {u = NF - 1; print $u}' | sed 's/.$//g'
There is no output coming from the above line. ...
1
vote
1answer
254 views
Get back to default login shell after running /bin/bash
When logging in the prompt is different than it is after executing /bin/bash
-bash-4.2$ exec bash
bash-4.2$
How do I get the - back in front of the bash. There are certain commands like tcp dump ...
0
votes
1answer
27 views
Non-logging REST API: How can I write all HTTP(s) requests and responses to a file?
I have a daemon, call it whatverd, running on TCP port 11111. It is basically an http server, but it does not do any kind of logging or debugging. It only returns query results via JSON in the http(s) ...
1
vote
1answer
111 views
Capturing lvsadm UDP traffic on the loopback interface [closed]
Problem
I am unable to capture lvsadm traffic on the loopback interface.
# tcpdump -i lo -n udp port 51444 -vv
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
...
0
votes
1answer
291 views
Syslog-ng not sending messages to localhost port 514 on centos 7.5
tcpdump -nnAs0 -i eth0 port 514
As I understand it this should display any logging msgs sent to syslog locally. However I send many via python syslog module, which I can tail via /var/log/messages ...
0
votes
0answers
60 views
udp packets are not recieving on interface in rhel 7
I have a problem with receiving UDP traffic on a RHEL7 server.
When capturing the traffic with tcpdump at the receiver side, the packets are not visible. However, I can capture the packets at the ...
2
votes
1answer
68 views
Can a port use multiple interfaces for communication?
My understanding of the following command:
tcpdump -i any -nn port X
tcpdump -> Start service to capture packets.
-i any -> On any/all interface(s).
-nn -> Don't convert host addresses to names ...
2
votes
0answers
146 views
What is “cooked mode” wifi monitoring?
The following is an excerpt from iw's help page:
dev <devname> set monitor *
Set monitor flags. Valid flags are:
none: no special flags
fcsfail: show frames with ...
1
vote
0answers
22 views
Strange behaviour of (D)NAT
I'm trying to forward all icmp requests from source ip 5.10.13.13 to new destination ip 5.10.11.11. IP of current local machine, where i'm applying iptables rule is 5.10.10.10. I apply this rule:
...
2
votes
0answers
112 views
internet access with ping has 100% loss
LAST BREAKTHROUGH -> see the tshark results below for some clue
Hi, at home I have the following setup:
Internet - NAS (Ubuntu 16.04.4 LTS) - LAN (Asus N56U WiFi) - family users. NAS connects ...
3
votes
0answers
86 views
Fast lossless, compressed streaming of packet capture between two servers?
Suppose I am capturing packets on a remote host with tcpdump (more precisely, I'm doing it with an Endace card, which exposes a tcpdump-like utility called dagsnap).
What would be a fast way to ...
0
votes
0answers
18 views
high delay of burst between tx_bytes and tcpdump captured flows?
I have a program monitoring and recording the burst in a network using both /sys/class/net/{device}/statistics/tx_bytes and tcpdump -i {device}. After some analysis on the captured data, I found that ...
0
votes
1answer
171 views
Tcpdump:malicious packets?
The packets captured with this command are packets whit the evil bit set?
Should i worry about?
sudo tcpdump 'ip[6] & 128 != 0'
tcpdump: verbose output suppressed, use -v or -vv for full protocol ...
3
votes
1answer
43 views
Map a port to another on same machine
I have all the traffic coming on port 22. I chose a random port 221 on which i want all of the traffic to be routed.
This is the rule i used
iptables -t nat -A PREROUTING -p tcp --dport 22 -j ...
0
votes
1answer
919 views
tcpdump tracing UDP packets
On redhat linux box, I am trying to trace the snmp traps coming from IP a.b.c.d, as shown below:
sudo /usr/sbin/tcpdump src host 142.125.248.36 and udp dst port 162 -w /home/user1/troubleshoot.pcap
...
2
votes
0answers
383 views
Use tcpdump to capture TCP transmitted data withouth the protocol's details (similar to tcpflow)
I use tcpflow a lot to capture data transmitted as part of TCP connections. It allows you to see the transmitted data without any of the TCP protocol details.
Is there a way to accomplish the same ...
1
vote
1answer
693 views
tcpdump -i any doesn't work on FreeBSD
How to listen all interfaces on FreeBSD with tcpdump
> tcpdump -i any
tcpdump: any: No such device exists
(BIOCSETIF failed: Device not configured)
(I would like to listen ICMP)
2
votes
0answers
195 views
tcpdump packets length mismatch
I'm trying to find out why my application has a huge network traffic, particularly, the outbound traffic.
Researching the issue, I found a number such packets where length mismatches the difference ...
0
votes
1answer
49 views
Monitor interface not showing TX packets
I have set up a monitor interface using:
iw dev wlan0 interface add mon0 type monitor
ifconfig mon0 up
And I am using libpcap to capture and inspect 802.11 frames and radiotap headers. I was ...
1
vote
1answer
2k views
Can tcpdump filter by timestamp?
I have a file with packets captured by tcpdump over the span of a few days. From this file I would like to look at packets captured over a specific time duration spanning just a couple of hours.
I ...
3
votes
1answer
591 views
bash script: capturing tcp traffic on a remote server sometimes works, sometimes fails. No errors
Background
I am running BusyBox in the remote server.
I have a bash script that does two things:
1. via ssh, starts a sub process to monitor tcp traffic using tcpdump command. Save results to a ...
1
vote
2answers
68 views
Capture internet traffic on single interface
I have been asked by a customer to provide a list of all URL's that my company's linux server connects to in order to complete a software update including individual TCP,UDP ports that these ...
0
votes
1answer
740 views
blocking YouTube not working for Google Chrome
I have some rules on the FILTER table of Netfilter, which block HTTPS access to some websites:
-A FORWARD -s 10.255.255.0/26 -p tcp -m tcp --dport 443 -m string --string "facebook.com" --algo bm -j ...
1
vote
0answers
192 views
Packets arriving on server not registered by iperf
This may have a bit to do with the internals of iperf.
I set up iperf -s -u -i 2 on server A (UDP server, supposed to print stats every 2 seconds), and am sending traffic to it from server B. As a ...
1
vote
1answer
2k views
Using tcpdump for logging all network activity going through a router server
I would like to collect logs of all network communications between my home devices (laptops, phones etc.) and the outside world in this format:
Timestamp / Device MAC Address / Source IP:Port / ...
-1
votes
1answer
35 views
WHat is the first long string optional argument for ssh and tcpdump that prints their version?
What is the first flag/option in the man pages of ssh and tcpdump?
ssh -1246AaCfgKkMNnqsTtVvXxYy
tcpdump -AdDefIKlLnNOpqRStuUvxX
How is it called, why is it there, what conventions are there ...
1
vote
2answers
2k views
tcpdump — capture packets to a non-rotating file
tcpdump -i eth0 -C 5 -W 1 -w <file name>&
I use the command above to capture packets to a 5MB pcap file on an Ubuntu machine. Once the pcap file reaches the maximum size (5MB), the file ...
1
vote
1answer
2k views
tcpdump returns packets dropped by interface
I am trying to capture packet coming from a switch (mirror data).
but no packet is capturing.
showing all packet is dropped by interface.
[root@localhost PacketReceiver]# tcpdump -i enp3s0f0 -vvv -w ...
1
vote
1answer
2k views
Executing command used in bash script
I'm trying to run a tcpdump command in a bash script, but I keep getting this error : tcpdump: illegal token: "
My script can be summarized by :
a='sudo tcpdump "icmp"'
echo $a
$a
When I run it the ...
1
vote
0answers
68 views
can only ssh unidirectional
I have two centos 7.2 server. One machine ip is
10.104.196.18, another machine is 10.240.197.21. I can successfully ssh from 10.104.196.18 to 10.240.197.21. But failed to ssh into 10.104.196.18 from ...
