Skip to main content
Share Your Experience: Take the 2024 Developer Survey
28 votes
Accepted

How to capture all incoming packets to NIC even those packets are not belonging to me

AFAIK, the NIC receives all packets from the wire in a Local Area Network but rejects those packets which their destination address is not equal to its ip. Correction: it rejects those packets which ...
Celada's user avatar
  • 44.3k
8 votes
Accepted

How to get metrics about dropped traffic via iptables?

There are counters for each rule in iptables which can be shown with the -v option. Add -x to avoid the counters being abbreviated when they are very large (eg 1104K). For example, $ sudo iptables -L ...
meuh's user avatar
  • 51.7k
8 votes

How to capture all incoming packets to NIC even those packets are not belonging to me

In the early says of ethernet hubs (not switches), sent packets are available to all hosts on the subnet, but hosts that are not the intended recipient are supposed to ignore. Obviously, it didn't ...
Thomas Carlisle's user avatar
5 votes

How can I limit Download bandwidth of an existing process? (iptables, tc, ?)

Put the process into a net_cls cgroup, use the cgroup to set the class of the packets, and then use a classful filter in tc to rate limit packets in that class. For example: cgcreate -g net_cls:slow ...
Philip Kendall's user avatar
5 votes
Accepted

What can cause a large TX vs. RX average bytes/packet discrepancy?

One possibility is that if you are sending data out predominantly, most of the packets coming back to your system will be ACKs, and those are going to be much smaller than the PUSH you're sending.
Eric Renouf's user avatar
  • 18.5k
5 votes
Accepted

What does iptables -j REDIRECT *actually* do to packet headers?

Take a look at this answer: How does a transparent SOCKS proxy know which destination IP to use? Quotation: iptables overrites the original destination address but it remembers the old one. The ...
user280720's user avatar
4 votes

Why specify packet size during ping test?

Packet size is helpful to troubleshoot the network by saying this I mean that some network packets does not transit if there is MTU mismatch: Example: If router1 has mtu configured 1500 (default) ...
Vivek Kanadiya's user avatar
4 votes
Accepted

How to mark packets by program

A possible solution using cgroups net_cls subsystem to group certain processes group, mark the packets in this cgroup using the iptables rule with the match extension, and then use tcpdump to monitor ...
aviro's user avatar
  • 5,622
3 votes

View packet data of ping

First listen with tcpdump : $ sudo tcpdump -c 10 -vvv -XX -i any icmp -c 10 = Exit after receiving 10 packets (5 requests and 5 replies) = ping -c 5. -vvv = Even more verbose output. -XX = Print in ...
Gounou's user avatar
  • 549
3 votes

How to check if a packet reached an interface in a multi-interface context?

In Linux, an incoming packet is routed by checking whether a packet should be handled by the local machine or not. If it should, it is processed directly without first routing it through the "correct ...
Jonas Berlin's user avatar
  • 1,124
3 votes

IPTABLES: process a packet locally and send a copy to another host

A few notes: SNAT does not work the way you described it in the description, SNAT replaces the source IP, it won't change the destination IP. After a packet goes through your 2 rules, it will have: ...
Gohu's user avatar
  • 2,094
3 votes
Accepted

How to capture traffic from an entire website (including external servers) using tcpdump

This is not possible. Why ? Communication-Protocol http/https is the key here. tcpdump is "only" designated to capture lower level protocol. There is no filter on tcpdump to analyze traffic in-flight ...
0x0C4's user avatar
  • 365
2 votes

How do packets traverse tc/netfilter physical, VLAN and bridge interfaces?

After some experiments with tcpdump and iptables I've observed the following: If a packet sent from network A to network B then tcpdump shows : eth0: VLAN ID 1 tagged frame (4 bytes larger). eth0.1: ...
xnor's user avatar
  • 151
2 votes

How to capture all incoming packets to NIC even those packets are not belonging to me

First you need to switch your NIC to promiscuous mode. Let's assume that your NIC interface is eth0. root@linux#ifconfig eth0 promesc If you're on a switch network your sniffing is reduced to the ...
Ahmed chiboub's user avatar
2 votes
Accepted

How to avoid forwarding ports?

Usually, your ISP gives you a single IP address, and your home router does network address translation (NAT) to pretend to your ISP that all the devices in your home network are just a single device ...
dirkt's user avatar
  • 32.5k
2 votes
Accepted

iptables: transparent tcp traffic proxy

This is a translation of my comment into a response. The rules should be adjusted to rely on an outbound MASQUERADE of source port to handle return packets. Thus, outgoing packets should be DNAT-ed ...
Ralph Rönnquist's user avatar
2 votes
Accepted

Package pre-installation script subprocess returned error exit status 1

To fix the EULA selection, you can change the value stored in the debconf database directly: debconf-get-selections | grep PacketTracer_731_amd64/accept-eula | sed s/false/true/ | sudo debconf-set-...
Stephen Kitt's user avatar
2 votes
Accepted

Error when trying to corrupt packets in linux terminal (netem)

The initial default qdisc set by the kernel with special handle 0: can't be modified nor referenced. It can only be overridden by a new qdisc. Using change references the existing root qdisc, but as ...
A.B's user avatar
  • 36.9k
2 votes

Why does adding a counter queue to my Netfilter chain break my VM?

Try bypass so packets are accepted if your application not listen on queue nft add inet filter input counter queue num 0 bypass Read this https://wiki.nftables.org/wiki-nftables/index.php/...
gapsf's user avatar
  • 606
1 vote
Accepted

How to check if a packet reached an interface in a multi-interface context?

The subject you're talking about is weak/strong Host model and Linux uses weak one by default. Is there a way to check if a packet intended to interface eth1 did reach that interface? I'd say that ...
poige's user avatar
  • 6,250
1 vote

Limit SSH to a range of IP

Yes. That is a (good) job for the packet filter. It would be helpful if that range would match a subnetwork that could be written as an IP address + netmask. If you need at least 20 addresses I'd ...
Zé Loff's user avatar
  • 2,217
1 vote
Accepted

Why is it that TCP packets can be modified to block invalid packets, but not UDP packets

TCP is a stateful protocol, UDP is stateless, so you cannot use ctstate with it. Either you let traffic for a particular port for UDP or you don't. Also --udp-flags FIN,SYN,RST,ACK SYN is just pure ...
Artem S. Tashkinov's user avatar
1 vote
Accepted

ncat stops listening after 100 UDP packets

Stated in the ncat(1) man page -m numconns, --max-conns numconns (Specify maximum number of connections) The maximum number of simultaneous connections accepted by an Ncat instance. ...
Paulo Tomé's user avatar
  • 3,772
1 vote

Why linux drop packets in netif_receive_skb?

Maybe this excerpt from https://access.redhat.com/solutions/657483 helps explain the reasons for dropping there: The RT and RHEL7 kernels contains code that updates the rx_dropped counter for other ...
Marcel Waldvogel's user avatar
1 vote
Accepted

How does MTR (run with TCP protocol) calculate the loss rate?

Analysis From what I can gather looking over the docs & via Google it looks like mtr is tracking packet loss itself by sending traffic and then keeping track of any drops that occur due to ...
slm's user avatar
  • 371k
1 vote

Maintain destination port of TCP packets after leaving through another local port

First, NAT in linux is stateful. Meaning you don't need an outbound and an inbound rule. When traffic comes back in that was NATed outbound, linux will automatically un-NAT that return traffic. ...
phemmer's user avatar
  • 72k
1 vote

Holding a Packet

You may be interested in the package Linux Traffic Control (tc) which is part of iproute2, at least with it it is possible to randomly slow down (parameter delay), reorder and drop (parameter loss) ...
U880D's user avatar
  • 1,165
1 vote

How does FreeBSD handle installing 2 packages which share a common dependency?

Typically it will not be a problem. FreeBSD (and Unix-based operating systems in general) use dynamic linking, so multiple programs can use the same dependencies. The dependencies only need to be ...
dogoncouch's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible