Questions tagged [tcpdump]
a command line packet analyzer
253
questions
0
votes
1
answer
31
views
tcpdump in Kali Linux VM does not capture scp between two devices
Situation:
I'm learning how to develop tests for a hardened server my company is developing for a client. The test configuration will consist of the test target (the server we're developing) and an ...
0
votes
2
answers
44
views
Is possible to capture packets between two hosts from a third host in the same network?
I want to see traffic between two hosts from a third host, there are all on my network
I did this on the third host:
ip link set eth0 promisc on
tcpdump -vv -i eth0 -xX host 192.168.0.2 and host 192....
- 10.9k
7
votes
2
answers
646
views
Understanding of BPF
When I need to capture some packets using tcpdump, I use command like:
tcpdump -i eth0 "dst host 192.168.1.0"
I always think the dst host 192.168.1.0 part is something called BPF, Berkeley ...
- 793
0
votes
0
answers
40
views
Sniffing traffic and promiscuous mode
I've been playing with tcpdump lately and was surprised to see that traffic not sent to/from the host running tcpdump is not picked up. The default tcpdump mode is promiscuous.
I've also seen that the ...
- 7
0
votes
0
answers
16
views
How to log Source IPs of Incoming File Transfers above a Specific Size?
I am trying to create a filter with tcpdump that logs the source IPs of only incoming file transfers above a specific size irrespective of the protocol that is being used for the transfer.
For ...
- 1
0
votes
0
answers
18
views
-Y and read {src,dst} port and tshark
tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
- 10.2k
1
vote
1
answer
54
views
how to modify pcap file for Additional Information in packet
I have one Pcap File which consist of Some Information.
I need to modify the data in the file.
Example:
As you can see There are details of packets and in Additional Record section I have TXT value ...
0
votes
1
answer
21
views
Why can't assign permission for normal user?
Install tcpdump on my debian10:
sudo apt install -y tcpdump
which tcpdump
/usr/bin/tcpdump
groupadd pcap
usermod -a -G pcap $USER
sudo chgrp pcap /usr/bin/tcpdump
sudo chmod 750 /usr/bin/tcpdump
sudo ...
- 35
1
vote
2
answers
49
views
What does double n mean in tcpdump command?
The tcpdump manual shows:
-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.
I have seen double n in a tcpdump command:
https://danielmiessler.com/study/tcpdump/
...
- 35
1
vote
1
answer
28
views
Is it possible to regenerate a TCP request with the help of tcpdump
I'm developing a backend server and here is how the architecture of the backend looks like:
APP --> Server1 --> Server2 --> Server3 --> MyServer
APP sends a HTTP request to the Server1, ...
- 2,809
1
vote
1
answer
326
views
IPTables issue between proxmox and pfsense VM
I'm kind of desperate with an IPTables issue.
I started to setup my own dedicated server which is a proxmox server. I have a pfSense VM to which all traffic is routed. I secured the LAN access by ...
- 45
0
votes
1
answer
30
views
tcpdump isn't storing packets to file upon power loss
I'm working on a pi device that I can plug into the network and it will automatically start packet capturing to a rotating file. The idea behind the device is that when one of my clients is having a ...
1
vote
0
answers
75
views
Does writing tcpdump output to a file on ramdisk have effect on the number of packets dropped?
When running tcpdump, I see that sometimes number of packets dropped by kernel is greater than zero (0). I was told to write to a file on ramdisk instead of a file on harddisk. I am not expert on ...
- 111
0
votes
0
answers
39
views
What is exactly the timestamp measured by tcpdump?
We have a server that communicates over UDP with two clients (client1 and client2), via the same NIC through a switch. The server runs on debian 9 standard kernel (no real time patch). The system is ...
- 101
0
votes
0
answers
32
views
Snort not detecting 3306 traffic, but tcpdump on port 3306 DOES show traffic
My scenario is:
Server with Snort, mariadb, etc
Attacker (client)
I'm connected to the DB from the attacker, and whenever I execute regular SQL commands while in the server this tcpdump command is ...
- 321
0
votes
0
answers
56
views
How capture ping outoing from openwrt router with tcpdump
I'm trying learn more about network traffic etc.
I sucessfully installed and ran tcpdump on router.
It works and shows me traffic when I'm pinging router from PC,
but it doesn't show me traffic when I'...
- 101
0
votes
0
answers
26
views
Command line http analyzer
I would like to learn more about http(s) requests. Learning requires doing, not just reading. I tried inspecting tcpdump output when loading a simple page but the packets are too low-level and I am ...
- 2,643
0
votes
0
answers
37
views
tcpdump, determine transport protocol
Is there a easy way to determine the transport protocol of a packet by looking at the output of a TCP dump trace?
I'd just like to be able to tell if a packet is UDP or TCP. I've tried using the -x ...
- 119
0
votes
0
answers
43
views
tcpdump to monitor snmp from subnet causing syntax error
I'm trying to monitor SNMP from 2 hosts on the same subnet; 10.52.17.31 and 10.52.17.32. They are on the only machines on that subnet.
Using the following commands I receive a syntax error:
tcpdump -...
- 119
1
vote
1
answer
62
views
Why tcpdump does not work with -w flag?
So I have a network that I want to scan with tcpdump and dump the captured traffic into a file.
Let's say I try:
sudo tcpdump net 192.168.0.0/24
tcpdump will start and will show the traffic in the ...
1
vote
0
answers
27
views
How does tcpdump choose the default NIC to listen on?
From TCPDUMP(1)
-i interface
--interface=interface
Listen on interface. If unspecified, tcpdump searches the system interface
list for the lowest numbered, configured up ...
- 1,781
0
votes
0
answers
36
views
Which tcpdump command to follow all traffic from client to VPN-server to destination?
I got a Wireguard server at home with TCPdump and Wireguard installed on it. The relevant interfaces I got is eth0 and wg0.
I can't seem to find the right combination of command, if I want to follow ...
0
votes
0
answers
216
views
tcpdump to perform wireless capture with advanced filters
I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
- 47
0
votes
0
answers
29
views
Tcp connection not seen on peer node
I got several nodes to run my software. After startup, I found tcp connection is abnormal between two nodes.
Assume A is the leader which is listening on port 1234, B should connect A.
On node B, use ...
- 101
0
votes
1
answer
167
views
Is tcpdump a client of rpcpad and implemented in pcap?
https://www.tcpdump.org/index.html#documentation has manpages for pcap, tcpdump, and rpcapd, but I don't find what relation is between the three.
Is pcap a C library for implementing a client of ...
- 1
1
vote
0
answers
844
views
How do I filter "BOOTP/DHCP, Request" out in tcpdump?
There are a lot of "BOOTP/DHCP, Request" in tcpdump and I would like to filter it out.
It's easy to filter arp out.
tcpdump -nni eth0 not arp
What about BOOTP/DHCP, Request?
I've tried the ...
- 1,221
2
votes
1
answer
93
views
tcpdump: why ack number greater than sack number?
I use tcpdump to troubleshot network problem, and found one record that ack number is greater than sack number:
Why ack number greater than sack number?
- 223
0
votes
1
answer
60
views
What is Fedora doing in this TCPdump?
So I decided to have tcpdump listen on port 80 because I use HTTPS whenever possible, and thought there shouldn't be anything there. Well, there was. I can see that one of these connections is the ...
- 135
1
vote
1
answer
716
views
How to use tcpdump safely (-Z option vs file capabilities / setcap)?
I am evaluating, how tcpdump can be used in a safer manner with as few as possible privileges. Two possibilities:
1. -Z option
If tcpdump is running as root, after opening the capture device or input ...
- 145
0
votes
1
answer
362
views
tcpdump -G option for rotation
I would like to rotate the tcp dump saving every 100mS.
Hence I am trying the following option:
tcpdump -i eth0 -G 0.1 -w '.pcap'
This dumps all the incoming data into file and do not rotate every ...
-1
votes
1
answer
218
views
tcpdump displaying no output
I'm currently learning tcpdump and having trouble understanding it. When I type:
sudo tcpdump
It has all traffic going in and out of my machine. How would I apply this to listening to everything on my ...
- 141
0
votes
1
answer
446
views
What is the filter expression to only sniff ICMP packets?
What is the filter expression to only sniff ICMP packets given the source IP address is 18.23.54.78 and the destination IP address is 12.67.24.89? The filter order must start with the protocol name ...
0
votes
2
answers
224
views
Filter tcpdump output (PCAP)
The following is the output from my PCAP file.
20:02:52.306161 192.162.70.150.58078 > 192.179.91.61.1194: P 635362993:635363048(55) ack 2046024708 win 4373 <nop,nop,timestamp 52993632 1059054949&...
0
votes
1
answer
3k
views
filter by incoming ip v4 packets with tcpdump
I want to filter with TCPDUMP only incoming and ip v4 packets.
tcpdump -i eth0 inbound and ip -w res.pcap give me incoming packets with ipv4 and ipv6
How can I filter by ipv4 only?
- 69
1
vote
1
answer
335
views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
- 244
0
votes
0
answers
107
views
Why do my Send-Q keep getting loaded but nothing come out of it?
I'm currently diagnosing a issue related to packet forwarding. I forward link layer packets to B network namespace and I found that B network namespace didn't reply to them, but I could curl and view ...
- 49
1
vote
1
answer
492
views
How to extract domains related to "Client Hello" in a pcap file
I have a tcpdump (pcap) capture file and want to extract all domains. I do it with the following command:
strings capture_file | grep -oiE '([a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.){1,}(\.?[a-zA-Z]{2,}){1,}' |...
- 781
1
vote
0
answers
336
views
non promiscuous option in tcpdump
Strangely, depending on the program in which it is included, the tcpdump command used with the -p option (which should say "don't use promiscuous mode") nevertheless switches it on during ...
- 11
0
votes
1
answer
30
views
capturing and analyzing packages through Raspberry Pi 4
So I am a beginner to RP4.
I am trying to learn more about network security using the Raspberry Pi 4.
I managed to set up the raspberry pi 4 as an access point. I am able to connect my personal laptop ...
- 1
1
vote
2
answers
56
views
How can I forward output from one terminal to another server where I can use grep?
I need to run tcpdump on some switch and pass it through grep with advanced regexp. That switch shell ist quite stupid and there is no grep with regexp but there is a tcpdump with the options I need.
...
- 11
3
votes
1
answer
4k
views
I installed tcpdump, but it is showing command not found while using it
Also I used whereis & which command to check if the package exists
and it does exist.
- 33
0
votes
1
answer
288
views
Timed tcpdump: pipe is slow
What I actually want to do is measure tcpdump for 10s.
$ timeout 10s tcpdump > my.log
but I found there has only a short period actually being logged, instead of whole 10s.
therefore I did this ...
- 11
0
votes
2
answers
261
views
Why there are a lot of packets not related to my IP been captured with tcpdump ? (Centos 7)
Tcpdump running by :
/usr/sbin/tcpdump -U -n -i eth0 icmp or tcp dst port 22 or tcp dst port
When I review the captured data , it shows :
132.132.211.221.40372 > 89.31.125.17.ssh: Flags [S], ...
- 1
-1
votes
1
answer
69
views
Can "dumb" ethernet hub device be used for breaking security on Ethernet cable connection? [closed]
Many people will still know about those old ethernet "hub"-devices - also called "dumb" device or "Ethernet signal concentrator". Did anyone ever try to "listen to ANY traffic" on such port through an ...
- 343
0
votes
1
answer
893
views
Get the user-agent from tcpdump
I'm working on a monitoring application for my home gateway and I want to know the device type of all connected clients. For that purpose I'm using tcpdump to extract the user-agent of all devices
...
- 1
0
votes
1
answer
196
views
tcpd, inetd/rinetd and iptables
What is the correlation between these programs?
tcpd and inted/rinetd are very old but despite this they are still present in many distributions ... why?
And there is also a correlation between hosts....
1
vote
1
answer
2k
views
tcpdump traffic in network namespaces in `net=host` dockercontainer
I am trying to capture a tcpdump of a set of processes running in the mininet network emulation framework.
Mininet works by putting each process/set of processes into its own network namespace and ...
- 177
1
vote
5
answers
202
views
sed/awk: replace numbers in a line after last occurance of '.'
I have the following tcpdump stream:
Current:
07:36:03.848461 IP 172.17.3.41.33101 > 172.17.3.43.17408: UDP, length 44
07:36:03.848463 IP 172.17.3.42.33101 > 172.17.3.43.17409: UDP, length 44
...
- 23
0
votes
1
answer
140
views
Determine program responsible for periodic short-lived network connections
I am interested in learning the proper procedure to determine which Linux program / process is responsible for a given short-lived network connection which repeats periodically.
Without making any ...
- 93
0
votes
1
answer
202
views
Traffic into lo vs eth, why might I be seeing only half the traffic on lo compared to eth?
I am forwarding traffic to ports on eth0 and lo.
For the same traffic at the same ports and different ports, when I do a tcpdump and count the packets, for time t, I only see about half the number of ...
- 101