Questions tagged [tcpdump]

a command line packet analyzer

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

Kill tcpdump process spawned by ssh when ssh dies

We are doing a remote capturing of tcpdump in unix, Whenever the ssh is killed (any interrupt i.e. by ctrl c or any other) we need the tcpdump on the other end to be stopped/killed. We tried most ...
2
votes
1answer
974 views

Processing timestamps of tcpdump output in realtime

I would like to maintain a file which contains the number of seconds since a packet matching a tcpdump filter has been seen. The aim is to work out when a chatty client is no longer on the network. ...
1
vote
0answers
1k views

tcpdump: Show even invalid ethernet packets

I'm attempting to debug a hardware issue where an embedded board transmits seemingly faulty ethernet packets. I connected the embedded board to a debugging machine's ethernet port to listen to the ...
1
vote
1answer
1k views

How to capture traffic from an entire website (including external servers) using tcpdump

I was wondering if its possible to capture all network traffic coming from a single website using tcpdump. I am interested in capturing the sizes of all incoming and outgoing packets from and to a ...
2
votes
0answers
2k views

How to capture http requests headers and body

I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body. I have found that tcpdump captures all the requests, but big ones end up being ...
1
vote
1answer
2k views

the meaning of tcpdump output for request/reply to DNS

following is part of the output of tcpdump: 18:34:15.429373 IP (tos 0x0, ttl 64, id 56078, offset 0, flags [DF], proto UDP (17), length 92) 172.31.8.42.47412 > 172.31.0.2.53: 3383+ [1au] A? www....
7
votes
1answer
940 views

MTU (IPv4) tests in Linux

I noticed I have several networks with all ICMP messages blocked at the firewall level, except for ICMP echo and reply. I know that there is a need at least ICMP messages type 3 in IPv4 have to be ...
8
votes
1answer
13k views

tcpdump time based circular rotation

Despite reading the man page and searching StackExchange and the wider internet, I have failed to figure out a way to make a time based, rotating, limited count, tcpdump. I want for example to have ...
3
votes
2answers
2k views

Sudo - DNS Lookup ( tcpdump )

I noticed that when I type sudo SomeCommand it hangs for a little. I started trying to figure out what was going on found one very strange thing: when I type tcpdump -i wlan0 and then do sudo, I get ...
1
vote
0answers
517 views

Tap interface is not receiving packets

I'm configuring a tap interface and trying to send and receive packets through it, i configure it like this: ip tuntap add name tap0 mode tap multi_queue ip link set tap0 up i'm using scapy to send ...
1
vote
0answers
81 views

How to open a changing file with wireshark?

Given a pcap file that is being created in the background, e.g tshark -w out.pcap > /dev/null & How can I open the changing file with wireshark wireshark -r out.pcap Does nont work
16
votes
2answers
469 views

Ghost NTP server on Debian 8.6

So the university IT security team and I have been going around and around on this with no breaks... anyone have any thoughts on this: I recently set up a small file server for my lab running Debian ...
1
vote
1answer
501 views

How to remove tcpdump first and last lines?

I'm coding a script based on tcpdump, but I want to get rid of the first lines that indicates the verbose parameters and the last lines with the number of captured packets: I just need the output ...
0
votes
1answer
6k views

How to capture SQUID proxy traffic via tcpdump with actual information?

I am using squid as proxy in a small setup having one internal NIC and one external NIC. Now using tcp, I can capture traffic on either side but there is some problem that I am facing. If I capture ...
2
votes
2answers
9k views

Tcpdump - counting outgoing and incoming UDP packets

Is it possible with tcpdump to count (for some set up time) the number of outgoing and incoming UDP packets? I don't have much experience in tcpdump, so an advice how to do that would be very helpful....
6
votes
1answer
5k views

Iptables FORWARD chain traffic not seen by tcpdump

I have a bare metal running Ubuntu server 16.04 with KVM and 3 NIC's that are connected by bridges br1, br2 and br3 to a guest VM running also Ubuntu server 16.04. The first NIC - br1 - is connected ...
1
vote
1answer
1k views

Filtering output of tcpdump and running script when string is found in realtime

I've got this command which displays packets received and sent on port 1700. tcpdump -AUq port 1700 In the packet there is the string rxpk, but most of the packets don't have it. When the output ...
1
vote
1answer
1k views

How to capture Network traces containing only a specific string?

I have a Adapter installed and working on RHEL server which faces disconnection when a particular signal message is sent from the Source to which this adapter is connected. In order to capture the ...
4
votes
1answer
5k views

“tail -f” using “tcpdump -r”

To display content of pcap file , we use : tcpdump -r /Path/to/syscontection.pcap; However, this command line does not follow the pcap file on realtime , like tail -f which follows a plain text . ...
3
votes
2answers
757 views

run tcpdump not to interpert packet contents

What options should I run tcpdump with to have it just do a hex dump of packets without trying to interpret its contents? Running it astcpdump -e -v -x or similar attempts to interpret layers, however ...
0
votes
1answer
415 views

Why tcpdump captures many packets with “(tcp-syn) != 0” but not with “tcp[tcpflags] & (tcp-syn) != 0”

I want to capture the initial handshake of a UDP connection between my computer and a VPN server. For that I'm using tcpdump but I don't understand why : tcpdump dst port 1194 and "tcp[tcpflags] &...
0
votes
1answer
5k views

How to display all data using tcpdump?

I am capturing network traffic by using tcpdump. The problem is, I can't see all capture data when the package is too long. For example, when the tcp frame length more than 500,I just see 100-200 or ...
1
vote
1answer
1k views

How to print all MAC addresses of devices interacting with wifis in my area to stdout

How do I configure a tool like wireshark, kismet, tcpdump to passively listen to wifi traffic? How do I get one of these tools to print these MAC addresses to stdout? I want just one MAC address per ...
2
votes
1answer
3k views

Why don't I see packets when I listen on my ftp port with tcpdump on localhost?

I'm accessing my localhost ftp server by Iceweasel or by the terminal (with the command ftp) while listening on the ftp port with sudo tcpdump -vv -A 'port 20' or sudo tcpdump -vv -A port ftp ...
2
votes
1answer
2k views

Continuous log-rotated tcpdump - dealing with interface disconnections

I'm currently running a continuous tcpdump job with the following command: tcpdump -pni en4 -G 3600 -w 'data/trace_%Y-%m-%d_%H:%M:%S.pcap' It runs very well over long periods of time, creating one ...
1
vote
1answer
555 views

Userspace Network Stack

I am writing a (very simple) userland IP network stack. For this purpose, I need to go "around" the OS network stack and obtain the raw Ethernet frames. The tap interface sounds like a way to go, but ...
1
vote
0answers
233 views

Is there a utility that allows to create structured data from tcpdump hexdumps?

Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse. Is there a utility that could read tcpdump packets in hex dump format and ...
0
votes
2answers
2k views

Using Both Grep and Cut

I want to grep the output of tcpdump and cut some part of it but the command below is not working. tcpdump ... | grep -i --line-buffered "..." | cut -d'&' -f1,2 Do you know what is the problem? ...
0
votes
1answer
599 views

ssh authentication and remote command output's redirection

I need to run a remote capture on a host via ssh and to authenticate twice, but the second prompt is being redirected. ssh -t user@host "sudo tcpdump -s 0 -n -w - -U -i eth0 not port 22" > /tmp/...
3
votes
2answers
8k views

tcpdump : lost packets

Running, either in promiscuous mode or not : tcpdump -i "$INTERFACE" -vvv -n -XX -S -s0 -e I got a bunch of lines and this conclusion when I stopped it : 601 packets captured 938 packets received ...
2
votes
0answers
514 views

killall doesn't work if I call it from a script

I'm starting a tcpdump inside a script and I also kill it from the same script. So I'm currently using the killall command for this: The script gets executed from an udev rule: This is the section, ...
0
votes
1answer
262 views

How often does the tcpdump save into the file

I've got an question, concerning the tcpdumd. Does it save the data directly in the File you can give it with -w, or does it save when it's stopped? So if it was writing on a usbstick, can I just ...
1
vote
2answers
2k views

tcpdump multiple pcaps w/ xargs

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine. There are examples online, but the only one I ...
-1
votes
1answer
775 views

capture FTP traffic for both active and passive FTP sessions

I understand that the command tcpdump can be used to capture traffic. How would I use that to record all the active and passive FTP traffic on my machine?
1
vote
2answers
2k views

Capturing Traffic of Router

My machine is connected to a wireless router. Is it possible to analyse packets coming and going to the router? Can I use the bridged mode for achieving this? Actually I want the original packets ...
1
vote
2answers
157 views

tcpdump based datalogger

I am building a datalogger with raspberry pi. I have used a Shell script in rc.local, I am capturing the bytes using tcpdump. The Problem am facing is that the log file is getting replaced each and ...
1
vote
1answer
1k views

how to remove NFLOG interface?

I am trying to make a packet sniffing program in C but the codes am trying to run from various public sources are not returning traffic from my Ethernet pot 'em1' but always reading 'nflog interface'. ...
2
votes
2answers
870 views

How to get different types of ICMP

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
5
votes
1answer
673 views

Can kernel drop an outgoing packet which has been captured by tcpdump?

When an outgoing packet is captured by tcpdump, will it 100% be sent out, and not be dropped by kernel? Does tcpdump intercept on packet delivering path before or after kernel does any/all filtering ...
7
votes
1answer
11k views

What does 'TS val' mean in tcpdump's output?

I'm monitoring the network activities between two processes on compute:42967 and controller:5672(controller.amqp). It captured compute.42967 with three SYN(they have the same seq number) while the ...
9
votes
3answers
29k views

Ping and tcpdump at the same time

The situation is this - There is one script on the server which make ping to somewhere and I don't know to where. I want to see to which machine is this ping make and why is returning FAILED. What I ...
1
vote
1answer
2k views

Sniffing packets realtime

I've been using tcpdump and it's good, but it exhibits issues here. Other programs like hexinject, tcpflow, and tracedump all use pcap so they delay a bit before displaying the packets. I've also ...
0
votes
1answer
262 views

How does aircrack-ng suite view Clients on networks we are not connected to?

I noticed with the tool airodump-ng which is apart of the aircrack-ng suite we can view all networks around us along with Client MAC address's which are connected to these networks. How can I acheive ...
2
votes
4answers
8k views

Why is tcpdump output file empty?

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, ...
3
votes
1answer
893 views

tcpdump waits a second before displaying packets

On Linux Mint (either 17 or 17.1) I'm using tcpdump to capture some packets with this command: tcpdump -UnvXSs 4096 -B 1024 -i eth0 Despite the -U option, it doesn't actually output packets ...
2
votes
2answers
6k views

date time as file name for dump file

I'm using Gulp to capture packets at 100Mbps to a folder. But I would like to name the files in format job_<'%Y_%m_%d_%H_%M_%S'>.pcap, but it gives files job.pcap0, job.pcap2 etc. The script I use ...
1
vote
1answer
285 views

pcap file 20 times smaller than ifconfig TX/RX difference for same period

I run tcpdump on a usb modem in network card mode. [ 18.260000] cdc_ncm 1-1.1:1.1 wwan0: register 'cdc_ncm' at usb-ehci-platform-1.1, Mobile Broadband Network Device, 0c:5b:8f:27:9a:64 I run it ...
3
votes
1answer
3k views

Huge packet loss on openwrt

I have a strange issue on mikrotik rb951-2hnd router. I built image a few years ago using revision 39392 and patch firmwared it and everything worked fine. Just a few months ago I decided to update ...
1
vote
1answer
345 views

Use different filtering criteria with tcpdump packet size

When running tcpdump like this tcpdump -s96 -i eth0 ip -w output_filename is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?
1
vote
1answer
457 views

Adding the ip to the filter of tcpdump

I use this tcpdump command to HTTP GET filtering : tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' How can add IP address to this filter?