All Questions

0
votes
0answers
24 views

What do the multiple occurencies mean in a packet trace file?

I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command: tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack After some ...
0
votes
1answer
76 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
3
votes
1answer
3k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
2
votes
1answer
217 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
2
votes
1answer
2k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
1
vote
1answer
5k views

tcpdump not capturing all TCP packets when capturing whole packets

I have a server and a client on different machines and on different locations. I'm trying to capture TCP packets with tcpdump on an interface of the server machine. I've injected an identifier in the ...
1
vote
1answer
445 views

Different types of ICMP [closed]

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
2
votes
2answers
3k views

TCPDUMP Output analysis

I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help: sudo tcpdump -i eth1 -n -p multicast I see a output like this - ...
-2
votes
1answer
1k views

Advertised Window Size

I have one sender and one receiver node, connected through one switch. I am collecting advertised window size from both tcpdump and kernel. I am running tcp dump on the receiver side, to watch for ...
3
votes
5answers
13k views

Packet sniffing promiscuously on MacBook Air [closed]

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...