Questions tagged [tcpdump]
For questions about traffic dumps from the packet analyzer tcpdump. This tag should only be used in relation to troubleshooting an issue with a network device. If the host that runs tcpdump has been converted to a network device (eg. firewall on Linux) then this tag is also on topic.
66
questions
0
votes
0
answers
22
views
RPCAP active mode usage or deployment example
This is in reference to https://www.winpcap.org/docs/docs_40_2/html/group__remote.html, the RPCAP protocol. Wireshark (on Windows) has support for connecting to passive mode deployment. And the RPCAP ...
- 101
0
votes
1
answer
24
views
OVS pop_mpls action returning invalid ethernet frames
I am currently running into walls when trying to pop an mpls label with ovs.
I currently have two interfaces on one ovs instance connected to ports eth0 and eth1. I define a flow on eth0 to pop an ...
- 67.5k
0
votes
1
answer
133
views
How does a client end the TCP connection when SYN+ACK is not received after multiple retransmissions? [closed]
I am trying to establish a TCP connection with a server. I added a firewall rule in the server to drop the TCP packets in order to check how the TCP client terminates.
Client retransmits SYN multiple ...
- 2,388
3
votes
3
answers
4k
views
who determines whether should ping send a ARP request?
In my Fedora linux, My eno1's ip is 192.168.1.105 and my gateway's ip is 192.168.1.1, and netmask netmask 255.255.255.0
For monitoring ARP request, in one terminal, I used sudo tcpdump -i eno1 -v "...
- 111
5
votes
2
answers
22k
views
Why only after 3-duplicate ACK retransmission takes place in TCP?
Is there any reason of choosing "3" only for retransmission. why not 2 or 4 or any other number?
- 111
1
vote
1
answer
798
views
What is "cflow" in ipfix？
I am learning ipfix and found a cmd like this:
tshark -r ipfix.cap -n -d udp.port==4379，cflow -O cflow
What does the cflow part mean here?
I was also told to filter cflow if I use Wireshark in ...
CommunityBot
- 1
1
vote
0
answers
740
views
How I can filter only quic packets with `tcpdump` command?
I want to capture only QUIC UDP datagrams on 443 port.
With following command tcpdump reports all udp packets that arrive to the host on port 443.
tcpdump -n udp -SX -i any port 443
How I can set it ...
- 111
8
votes
2
answers
12k
views
What does the output of this tcpdump mean?
Bellow I show the output of my tcpdump
What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)?
I am especially interested in the meaning of what ...
- 246
1
vote
2
answers
2k
views
tcpdump filter for ERSPAN session ID value
I am using rcdcap to decapsulate ERSPAN on a Linux host. I would like to be able to split ERSPAN session IDs out to different logical capture interfaces. My current ERSPAN session IDs are 10 and 20. ...
6
votes
2
answers
644
views
TCP Flow-control questions that drives me mad
This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
- 186
2
votes
1
answer
7k
views
tcpdump output with bad length indicator present
Could someone help me interpret this tcpdump udp packet output? We are getting out image so I'm wondering why we are seeing this message. Is the packet length indicated by "length 1500)" or ...
- 99.6k
0
votes
2
answers
234
views
Detecting Ethernet over power by packets
If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
2
votes
2
answers
501
views
Why does it show LAN address when NAT is enabled on cisco?
I have following network connections
LAN -> Cisco Router -> 16 port switch -> Server (netflow)
-> ISP
And i have following config on Cisco router
...
- 848
1
vote
1
answer
99
views
Does tcpdump work differently from Omnipeek?
I have been trying to analyze packets using tcpdump. I am trying to use a wireless card and capture packets through monitor mode, instead of promiscuous mode, since I want to see what kind of traffic ...
CommunityBot
- 1
1
vote
2
answers
335
views
tcpdump find source ip with most bytes
some times we receive volumetric traffic from single source IP (out of our networks) towards one destination in our network,
is there anyway to find it with tcp dump ?
thank you.
- 84.4k
2
votes
1
answer
1k
views
How to capture mixture of packets with and without VLAN tag over LACP with tcpdump?
Given following configuration in Linux:
bond0 in LACP (802.3ad) mode with two VLAN networks running over it.
bond0.111 configured with static IP
bond0.222 configured with DHCP
How to capture packets ...
6
votes
2
answers
15k
views
How to check if a NIC supports hardware timestamps [closed]
I want to capture packets using tcpdump and get as precise timestamps as possible. The latest version of tcpdump has the -j adapter command-line option, which can be used for this.
I tested the ...
- 103
43
votes
2
answers
175k
views
TCPDump - Filter by MAC Address
I would like to display all traffic for or from a specific MAC address.
For that I tried
sudo tcpdump host aa:bb:cc:11:22:33
It does not work and returns me an error
tcpdump: pktap_filter_packet: ...
- 121
1
vote
1
answer
19k
views
tcpdump: cksum incorrect [closed]
When I run tcpdump on my machine (here I use 1.2.3.4)
tcpdump -i eth0 -n dst host 1.2.3.4 -v
roughly 90% of incoming packets have incorrect checksum:
cksum 0xc25b (correct), seq 101134607:101136035
...
- 84.4k
2
votes
1
answer
615
views
Nmap differences between scanning with -Pn or without
I'm trying to understand the difference in NMAP between put -Pn or not. I know that if I'm not mistaken -Pn skip ICMP (ping) scan. Ok.. so I try scan a random VM and intercept the packets with tcpdump....
- 27.3k
1
vote
1
answer
63
views
Packet analyze on router does not match client and server
thank you for your time.
My (virtual) network has 3 objects : a client, a server and a router between them.
I'm sniffing the traffic on the 3 machine with the command
tcpdump -i any -s 0 -w [path]
...
- 2,193
0
votes
1
answer
73
views
Is it possible to re-transmit only the last packet at TCP flow?
I try to understand the TCP behavior, especially re-transmission.
I did a small experiment and find the curious thing.
The only last packet is re-transmitted. Why do this happen?
I think if the ...
- 125
0
votes
0
answers
191
views
Why wifi and ethernet use the same frame format from tcpdump -d output?
If I execute
tcpdump -i wlan0 tcp -d
or
tcpdump -i eth0 tcp -d
I get the same output
(000) ldh [12]
(001) jeq #0x86dd jt 2 jf 7
(002) ldb [20]
(003) jeq #0x6 ...
- 101
3
votes
2
answers
64k
views
How to send an ARP request manually? [closed]
I recently sniffed with Tcpdump a packet "ARP, Request who-has 192.168.2.3 tell 192.168.2.2, length 28".
I would like to reproduce this message, and to send an ARP request from my laptop to any IP I ...
- 159
11
votes
1
answer
33k
views
Is there a way to capture only gratuitous ARP's using tcpdump?
I'm trying to set up tcpdump to filter only gratuitous ARP's. I know that I need to search for packets with a host set to ff:ff:ff:ff:ff:ff. And I found the arp.opcode parameter, but I can't seem to ...
- 16.2k
4
votes
1
answer
749
views
Dump traffic on routing-instance with a Juniper SRX firewall
A Juniper firewall can display data with the tcpdump command:
% tcpdump -i ge-0/0/0
% tcpdump -i vlan10
However, if the interface or the VLAN is assigned to a routing instance, the traffic is not ...
- 9,431
0
votes
1
answer
423
views
tcpdump - bogus ethernet address
I'm trying to capture packets on an interface.
The command is as follows
tcpdump -ni any port 1812 or port 1813 or port 3799 or port 8080 or port 15001 -s 0 -w /var/tmp/lb01_trace_$( date +'%Y-%m-%d %...
- 84.4k
1
vote
0
answers
50
views
Remote monitoring using a non root user account with Sudo Privilege [closed]
I want to remotely take tcpdump on my server with a non root user account? I tried it but doesnt seems to be working? Can someone guide me on this?
plink.exe -ssh -pw abc123 [email protected] "sudo ...
- 1,412
2
votes
2
answers
387
views
tcp connection and stream flow question
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
- 99.6k
3
votes
2
answers
471
views
Which tcpdump metrics reveal server connectivity problems vs client problems?
I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
CommunityBot
- 1
6
votes
2
answers
39k
views
tcpdump (-i any) with vlan
I have a question regarding tcpdump (capturing all interfaces) and a strange capture I see.
Environment:
2 Linux devices connected and configured with VLAN TAG (802.1q). I am pinging between the 2 ...
- 11
0
votes
1
answer
1k
views
Wireshark capture on LoopBack interface [closed]
We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
- 425
0
votes
1
answer
603
views
tcpdump: out of memory when running big filter file
i am currently running tcpdump with the following command
tcpdump -r input.pcap -w output.pcap -F /filter_file
the problem is that tcpdump throws this error
tcpdump: out of memory
and i am ...
CommunityBot
- 1
1
vote
1
answer
810
views
TCP close 2-way handshake with tcpdump package
Well, I got a pcap package that uses the tcpdump command. In this pcap, the TCP closes in 2-way handshake!
Questions：
In this picture, can anyone determine who initiated the signal to
close the ...
CommunityBot
- 1
-1
votes
2
answers
4k
views
read filters from a text file with tcpdump
i would like to know as the title describes if there is a way read filters from a file in tcpdump
currently i use
tcpdump -r input.pcap -w output.pcap src host 1.1.1.1
and what i wan to do is make ...
- 16.2k
3
votes
2
answers
4k
views
TCPDUMP Output analysis
I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help:
sudo tcpdump -i eth1 -n -p multicast
I see a output like this - ...
- 99.6k
2
votes
1
answer
268
views
Analysing a HTTP request with tcpdump
I am trying to understand the acks from the sequence numbers in a TCP/IP packet. AFAIK, an ack from a transmitted package is calculated by the following [1].
In [2] I have an HTTP request to a site.
...
- 2,388
3
votes
1
answer
8k
views
How can I filter out particular MAC addresses when running tshark on a pcap trace?
I've tried a number of things, but none of them seem to do the trick. I want to run this command:
tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len
but to have it ignore any packets ...
CommunityBot
- 1
3
votes
1
answer
21k
views
Find SSL version in TCP-packets in established TCP-connection
is it possible to see the used SSL-Version in a TCP-dump in an established TCP-connection without killing the connection and re-establishing it to capture the "Client Hello"?
If yes, where can I find ...
CommunityBot
- 1
4
votes
5
answers
16k
views
Packet sniffing promiscuously on MacBook Air [closed]
I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
- 1
3
votes
3
answers
883
views
What more information can I get from filtering by MAC address rather than IP?
I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for ...
- 4,497
1
vote
1
answer
6k
views
RST after an out of order packet
I've encountered an force termination by a host, even after a successful (at least it seems to be successful; correct me if I'm wrong) FIN ACK close of connection. Packet trace at the moment is ...
CommunityBot
- 1
0
votes
1
answer
1k
views
Where in PCAP-NG does the Source/Destination IP address information reside?
I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
- 2,388
2
votes
1
answer
375
views
`tcpdump bootp.type == 2` tcpdump: syntax error
tcpdump -i eth0 'bootp.type == 2'
Results in a:
tcpdump: syntax error
However, bootp.type == 2 works fine in Wireshark.
Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
CommunityBot
- 1
2
votes
1
answer
1k
views
How to Capture packets generated from linux pktgen traffic generator? [closed]
I am testing an openflow switch for its performance. I am using "pktgen" kernel module available in linux to generate packets at different flow rates. I have a host with two interfaces eth1 and eth2. ...
- 83
1
vote
1
answer
5k
views
capturing specific BFD packets using tcpdump
I'm troubleshooting a problem with my site-to-site VPN at one location. I've narrowed it down to the link being up, but traffic dropping due to routing problems. I'm running ospf with over ipsec ...
- 462
2
votes
1
answer
804
views
Wireshark - How to find cause of incomplete download
I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror
transfer closed with 3304876121 bytes remaining to read
(...
- 1,299
1
vote
1
answer
2k
views
debugging arp requests over vlan
We have a chain of switches configured for vlan 13, let's call them switch1, switch2 and switch3
No, somewhere on this chain the arp requests get lost. I can run tcpdump on these switches. Running ...
- 131
0
votes
1
answer
40
views
Which terminal based tool can I use to display only the source and destination IPs of all packets [closed]
I am currently using ngrep or tcpdumpin conjunction to grep to display destinations and sources of all incoming and outgoing packets.
Would you suggest a better way to achieve this?
- 2,648
0
votes
1
answer
2k
views
why I didn't get three way handshake by tcpdump command?
That's what I do .
1、open tcpdump command sudo tcpdump -i lo0 tcp port 20009
2、start a sample server nc -l 20009
3、connect 20009 port telnet localhost 20009
4、tcpdump command got :
○ → sudo ...
- 103