Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tcpdump]

For questions about traffic dumps from the packet analyzer tcpdump. This tag should only be used in relation to troubleshooting an issue with a network device. If the host that runs tcpdump has been converted to a network device (eg. firewall on Linux) then this tag is also on topic.

1
vote
0answers
33 views

Why do I observe a 4-way TCP handshake instead of an expected 3-way when establishing a connection? [duplicate]

I'm doing a simple HTTP GET query on a localhost from curl to a local webserver. After I did a tcpdump I noticed these packets to be sent each time a request is done: 11:11:27.537300 IP 127.0.0.1....
1
vote
1answer
37 views

Is there a way to capture only gratuitous ARP's using tcpdump?

I'm trying to set up tcpdump to filter only gratuitous ARP's. I know that I need to search for packets with a host set to ff:ff:ff:ff:ff:ff. And I found the arp.opcode parameter, but I can't seem to ...
0
votes
0answers
24 views

What do the multiple occurencies mean in a packet trace file?

I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command: tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack After some ...
4
votes
1answer
81 views

Dump traffic on routing-instance with a Juniper SRX firewall

A Juniper firewall can display data with the tcpdump command: % tcpdump -i ge-0/0/0 % tcpdump -i vlan10 However, if the interface or the VLAN is assigned to a routing instance, the traffic is not ...
0
votes
1answer
59 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
0
votes
1answer
51 views

tcpdump - bogus ethernet address

I'm trying to capture packets on an interface. The command is as follows tcpdump -ni any port 1812 or port 1813 or port 3799 or port 8080 or port 15001 -s 0 -w /var/tmp/lb01_trace_$( date +'%Y-%m-%d %...
1
vote
0answers
17 views

Remote monitoring using a non root user account with Sudo Privilege [closed]

I want to remotely take tcpdump on my server with a non root user account? I tried it but doesnt seems to be working? Can someone guide me on this? plink.exe -ssh -pw abc123 iamuser@192.168.1.1 "sudo ...
2
votes
2answers
231 views

tcp connection and stream flow question

Could anyone explain the main principe of tcp flow when making a session ? I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
3
votes
2answers
115 views

Which tcpdump metrics reveal server connectivity problems vs client problems?

I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
1
vote
2answers
465 views

What does the output of this tcpdump mean?

Bellow I show the output of my tcpdump What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)? I am especially intrested in the meaning of what ...
0
votes
1answer
308 views

Wireshark capture on LoopBack interface [closed]

We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
-1
votes
1answer
217 views

What is “cflow” in ipfix?

I am learning ipfix and found a cmd like this: tshark -r ipfix.cap -n -d udp.port==4379,cflow -O cflow What does the cflow part mean here? I was also told to filter cflow if I use Wireshark in ...
1
vote
1answer
176 views

TCP close 2-way handshake with tcpdump package

Well, I got a pcap package that uses the tcpdump command. In this pcap, the TCP closes in 2-way handshake! Questions: In this picture, can anyone determine who initiated the signal to close the ...
0
votes
1answer
202 views

tcpdump: out of memory when running big filter file

i am currently running tcpdump with the following command tcpdump -r input.pcap -w output.pcap -F /filter_file the problem is that tcpdump throws this error tcpdump: out of memory and i am ...
-1
votes
2answers
1k views

read filters from a text file with tcpdump

i would like to know as the title describes if there is a way read filters from a file in tcpdump currently i use tcpdump -r input.pcap -w output.pcap src host 1.1.1.1 and what i wan to do is make ...
2
votes
1answer
101 views

Analysing a HTTP request with tcpdump

I am trying to understand the acks from the sequence numbers in a TCP/IP packet. AFAIK, an ack from a transmitted package is calculated by the following [1]. In [2] I have an HTTP request to a site. ...
3
votes
1answer
2k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
2
votes
1answer
283 views

Why does it show LAN address when NAT is enabled on cisco?

I have following network connections LAN -> Cisco Router -> 16 port switch -> Server (netflow) -> ISP And i have following config on Cisco router ...
2
votes
3answers
353 views

What more information can I get from filtering by MAC address rather than IP?

I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for ...
1
vote
1answer
2k views

RST after an out of order packet

I've encountered an force termination by a host, even after a successful (at least it seems to be successful; correct me if I'm wrong) FIN ACK close of connection. Packet trace at the moment is ...
0
votes
1answer
416 views

Where in PCAP-NG does the Source/Destination IP address information reside?

I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
2
votes
2answers
910 views

who determines whether should ping send a ARP request?

In my Fedora linux, My eno1's ip is 192.168.1.105 and my gateway's ip is 192.168.1.1, and netmask netmask 255.255.255.0 For monitoring ARP request, in one terminal, I used sudo tcpdump -i eno1 -v "...
2
votes
1answer
209 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
2
votes
1answer
492 views

How to Capture packets generated from linux pktgen traffic generator? [closed]

I am testing an openflow switch for its performance. I am using "pktgen" kernel module available in linux to generate packets at different flow rates. I have a host with two interfaces eth1 and eth2. ...
1
vote
1answer
2k views

capturing specific BFD packets using tcpdump

I'm troubleshooting a problem with my site-to-site VPN at one location. I've narrowed it down to the link being up, but traffic dropping due to routing problems. I'm running ospf with over ipsec ...
2
votes
1answer
290 views

Wireshark - How to find cause of incomplete download

I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror transfer closed with 3304876121 bytes remaining to read (...
1
vote
1answer
1k views

debugging arp requests over vlan

We have a chain of switches configured for vlan 13, let's call them switch1, switch2 and switch3 No, somewhere on this chain the arp requests get lost. I can run tcpdump on these switches. Running ...
0
votes
1answer
36 views

Which terminal based tool can I use to display only the source and destination IPs of all packets [closed]

I am currently using ngrep or tcpdumpin conjunction to grep to display destinations and sources of all incoming and outgoing packets. Would you suggest a better way to achieve this?
0
votes
1answer
799 views

why I didn't get three way handshake by tcpdump command?

That's what I do . 1、open tcpdump command sudo tcpdump -i lo0 tcp port 20009 2、start a sample server nc -l 20009 3、connect 20009 port telnet localhost 20009 4、tcpdump command got : ○ → sudo ...
6
votes
2answers
324 views

TCP Flow-control questions that drives me mad

This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
1
vote
0answers
58 views

How to trap message between two servers? [closed]

I have two server one of them sends message in xml format to another server. The number of message varies i.e from 10000/sec to 1 million per second. The other end receives and stores it as file. Both ...
1
vote
1answer
129 views

Is it possible to capture ieee802.11 management and control frames from the same phone using android APP or tcpdump on root device?

I am trying to study the traffic between the mobile and access points. So I have phone Galaxy Nexus which does not support monitoring mode but still support promiscuous mode. Unfortunately, I try many ...
3
votes
1answer
10k views

Why only after 3-duplicate ACK retransmission takes place in TCP?

Is there any reason of choosing "3" only for retransmission. why not 2 or 4 or any other number?
0
votes
1answer
410 views

Writing a WinDump filter

I am new to using Windump (TCPDump) and I need to write a filter and save it the output to a text file. I start the command as "Windump>Practice". (I named the output file Practice) Would I type the ...
2
votes
1answer
2k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
1
vote
1answer
4k views

tcpdump not capturing all TCP packets when capturing whole packets

I have a server and a client on different machines and on different locations. I'm trying to capture TCP packets with tcpdump on an interface of the server machine. I've injected an identifier in the ...
1
vote
2answers
261 views

Seeing traffic not addressed to me using tcpdump, how does that work?

I did a tcpdump capture, and when inspecting the reults, I saw some data I couldn't understand. Say the hostname of the box I did the capture on was box1.blah I saw traffic like this: box2.blah:...
1
vote
1answer
443 views

Different types of ICMP [closed]

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
6
votes
2answers
3k views

How to check if a NIC supports hardware timestamps [closed]

I want to capture packets using tcpdump and get as precise timestamps as possible. The latest version of tcpdump has the -j adapter command-line option, which can be used for this. I tested the ...
3
votes
2answers
1k views

How to interpret this `tcpdump` output

this tcpdump output is the result of sending a single ping package from host 1 to host 2 through a simple hub connection: root@mininet-vm:~# tcpdump -XX -n -i h2-eth0 tcpdump: verbose output ...
4
votes
2answers
965 views

Circular tcpdump output

I have external hardware that continuously sends UDP data segments over a specified port. I would like to continuously store the last few received packets in a file (could also be time-based). If I ...
2
votes
1answer
12k views

Find SSL version in TCP-packets in established TCP-connection

is it possible to see the used SSL-Version in a TCP-dump in an established TCP-connection without killing the connection and re-establishing it to capture the "Client Hello"? If yes, where can I find ...
2
votes
2answers
32k views

How to send an ARP request manually? [closed]

I recently sniffed with Tcpdump a packet "ARP, Request who-has 192.168.2.3 tell 192.168.2.2, length 28". I would like to reproduce this message, and to send an ARP request from my laptop to any IP I ...
2
votes
2answers
3k views

TCPDUMP Output analysis

I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help: sudo tcpdump -i eth1 -n -p multicast I see a output like this - ...
4
votes
2answers
5k views

Network discovery. How does Fing work? (a network tool)

You may or may not know the app "Fing". It is a bunch of network tools, available on Android and iOS at least and maybe on others devices but not sure. The main goal of this tool is to browse for ...
3
votes
1answer
10k views

TCPDump and listening to wifi traffic of others

This thread is to continue my previous one, where I was talking about the TCPDump command. There is still something I don't get. According to this website (and some others), and according to my ...
23
votes
1answer
110k views

TCPDump - Filter by MAC Address

I would like to display all traffic for or from a specific MAC address. For that I tried sudo tcpdump host aa:bb:cc:11:22:33 It does not work and returns me an error tcpdump: pktap_filter_packet: ...
1
vote
1answer
680 views

Request a PTR record for google DNS (8.8.8.8) [closed]

When I request a A record for a domain, eg: host google.com and display packets by tcpdump. I notice that my system also requested a PTR record for DNS nameserver (8.8.8.8 in this case). 09:53:42....
2
votes
1answer
425 views

Convert BFR to PCAP without loosing nano-second resolution

i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
-1
votes
1answer
876 views

Filter mobile devices MAC address

I am monitoring my network and I would like to know how many mobile devices are there. I am already filtering probe requests and matching MAC adresses with OUI identifier. However I have few doubts ...