how to send a number of TCP packets and capture only those packets using tshark?

Question

I'm using iperf3 to send 1005 TCP packets with the commands:

iperf3 -s -i 1 -f m -p 5200 -D

iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200

In server, client respectively.

The output from the client command is:

Connecting to host 10.60.0.113, port 5200 Reverse mode, remote host
10.60.0.113 is sending [  5] local 10.60.0.2 port 33929 connected to 10.60.0.113 port 5200 protocol: TCP  num_streams: 1  blksize: 131072  omit: 2  duration: 0  bytes

[ ID] Interval           Transfer     Bitrate 
[  5]   0.00-1.00   sec 64.4 MBytes   540 Mbits/sec                  (omitted) 
[  5]   1.00-2.00   sec  73.1 MBytes   613 Mbits/sec                  (omitted)

 iperf test finished. [  5]   0.00-0.40   sec  28.7 MBytes   607 Mbits/sec                  
- - - - - - - - - - - - - - - - - - - - - - - - - 
[ ID] Interval           Transfer     Bitrate         Retr 
[  5]   0.00-0.40   sec  32.5 MBytes 688 Mbits/sec    0             sender 
[  5]   0.00-0.40   sec  28.7 MBytes   607 Mbits/sec                  receiver

iperf Done.

I start capturing with tshark a bit earlier than I run the iperf commands and finish a bit later, but I'm using the capture filter:

host 10.60.0.2 and tcp

In the pcap file there are 24418 packets. These are the complete statistics of the capture:

First Packet Time: 20-06-20 02:42:23 Last Packet Time: 20-06-20 02:42:25 Elapsed: 00:00:02

Packets: 24418 Between first and last: 2575.64 ms Avg. packets per sec: 9480.37 Avg. packet size: 7428 Bytes: 181382938 bytes Avg bytes per sec: 70422499.94

I also run this one in the client:

tcpdump -i 2 src 10.60.0.113

and get 1300 approximately packets

I don't really understand the relation between the traffic sent and the traffic captured. I hope you guys can guide me a bit! :)

Answer 1

When you set your capture to "host 10.60.0.2 and tcp" you will get all TCP packets where the host is either the source or the destination.

That means you will also get all the ACK packets sent by the destination host.

Possibly, if you are connected through SSH you will also get all the SSH traffic.

You should filter the taffic to capture more precisely.

Adding "and dst port 5200" or "and src port 5200" depending on where you perform the capture should give better results.