Skip to main content
12 votes
Accepted

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture ...
Ricky's user avatar
  • 32.3k
9 votes

net-snmp Creating my own MIB: No Such Instance currently exists at this OID

I think your issue is coming from a simple misconception of how SNMP data (OIDs) is structured, and how snmpwalk, snmpget, and snmpgetnext interact with it. SNMP organizes the OIDs into related ...
Jordan Head's user avatar
  • 7,119
6 votes

how to find the right value of MTU Jumbo frame

Make sure there's a notable performance difference between jumbos and standard frames - without it, there's little reason to dive in. Hardware offloading tends to make jumbos obsolete unless you need ...
Zac67's user avatar
  • 85.5k
5 votes

What will happen at server side if it received 2 SYN packet from the same client application?

Basically, a TCP receiving duplicate SYNs will SYN,ACK them, but it will receive a RST for the duplicate. RFC 793, Transmission Control Protocol, Section 3.4. Establishing a connection explains ...
Ron Maupin's user avatar
  • 99.9k
5 votes

Forward Avahi mDNS packets from one network to another

Zeroconf Networking RFC 6272, RFC 6273 has the fundamental design constraint of being "local subnet only". Zeroconf's multicast packets have a TTL of 255, and if you try forward these ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

tcpdump output with bad length indicator present

The 1472 is the maximum payload length for the UDP datagram. The 1500 is the MTU (maximum packet size), from which you must subtract the IP header length (20 for IPv4) and the UDP header length (8), ...
Ron Maupin's user avatar
  • 99.9k
4 votes
Accepted

TCP Client-Server with mtu is set, Issue with fragmented packets

You are confusing MTU and MSS. The MTU 1500 is related to ethernet, so it includes the IP and TCP headers. Both have a minimum size of 20, so the MSS (maximum segment size) for TCP is in this case ...
JFL's user avatar
  • 19.7k
4 votes
Accepted

What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?

JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming. Recap of ...
neoakris's user avatar
  • 297
4 votes
Accepted

"ssh: connect to host myserver port 22: Invalid argument" (intermittent, ipv6, link-local address, dhcp hostname)

Whatever is doing hostname resolution is returning link-local IPv6 address(es) that aren't valid for the interface selected -- i.e. "any". Link-local addresses must specify the interface -- eg. fe80:.....
Ricky's user avatar
  • 32.3k
4 votes
Accepted

How do I find the IP of the DNS server that respond for a specific domain name?

The authoritative name server should be in the domain's NS record. In Windows, this can be looked up nslookup -type=ns somedomain.com In Linux, something like dig somedomain.com NS +noall +answer ...
Zac67's user avatar
  • 85.5k
4 votes

Inconsistent behavior of link aggregation

It depends on the LACP load balancing algorithm. The LACP load balancing algorithm is only locally significant (they don't have to match on Mellanox and Arista switch). Load balancing algorithms are ...
OlofL's user avatar
  • 108
4 votes
Accepted

Allow active connections in firewall on multiple BGP connected routers

As you figured out, doing stateful firewalling on external links doesn't work well if you're multihomed. Typically, you either do stateless firewalling on external links, or place the firewall behind ...
Teun Vink's user avatar
  • 17.4k
3 votes

Lower throughput with fixed TCP window size?

That's not a shock. These day we automatically tune the amount of RAM assigned to TCP buffers (aka the maximum TCP window size), and by specifying the window size you are turning off the automated ...
vk5tu's user avatar
  • 1,171
3 votes

Lower throughput with fixed TCP window size?

As Marco mentioned, Receive window sizes (rwin) will increase and decrease automatically during a TCP session depending on how lossy the connection ends up being. It is therefore possible that ...
OzNetNerd's user avatar
  • 2,337
3 votes

Lower throughput with fixed TCP window size?

Receive window sizes (rwin) will increase and decrease automatically during a TCP session depending on how lossy the connection ends up being. It is therefore possible that when you omit the -w flag ...
Mark Riddell's user avatar
3 votes
Accepted

ARP flush manual broadcast after IP change

E.g. Windows uses 30 seconds for ARP cache timeout. [1] You might be able to decrease the "dead" time by sending out a gratuitous ARP with the new MAC which the ASA should be doing by itself when ...
Zac67's user avatar
  • 85.5k
3 votes
Accepted

Linux TCP stack repeatedly sends "TCP window update" without acknowledging any data

Ok, after some investigation I learnt that 1) data in syn handshake is legal, and 2) the weird segments are duplicate acks and receive window updates rolled into one: the first chunk of 256 bytes of ...
Einheri's user avatar
  • 183
3 votes
Accepted

Can I force a higher TCP segment size with netcat?

I used the following configuration: Standard MTU on A and B; MTU lowered to 500 on the router (B side); /proc/sys/net/ipv4/ip_no_pmtu_disc set to 1 on the sender (A). And then the sender sticks to ...
Eusebius's user avatar
  • 150
3 votes

Daisy chaining IOT devices without switches?

Welcome to Network Engineering! Yes, you are duplicating addresses, so your idea will not work. Each link between devices is a separate network and needs its own IP subnet with unique addresses.
Ron Trunk's user avatar
  • 67.7k
3 votes
Accepted

Virtual IP failover issue with vmware exsi ip based hashing

The ESXi's vSwitch doesn't care about IP addresses, just MACs. The "IP hash-based routing" is about L2 load balancing - which egress port is used - and has no relevance for IP routing. You need to ...
Zac67's user avatar
  • 85.5k
3 votes

MTU 9000 and 1500 when machines with MTU 1500 send data to machines with MTU 9000

Generally, this should be avoided, but under some limited circumstances it may appear to work. The problem stems from there being no layer-2 mechanism to signal the mismatch, or negotiate a frame size....
Ricky's user avatar
  • 32.3k
3 votes
Accepted

How my neighbour machines in the same network knows my interface ip?

Simple answer: The machines don't know the route. The IP address that you use must be in the range of the so-called "subnet" the machine belongs to. This means that all machines that can be reached ...
Martin Rosenau's user avatar
3 votes
Accepted

Does a gateway always have to be on the same subnet as the host IP address?

The next-hop address must be reachable, which means you need a route to ("covering") it. In this case a simple ip route add 10.x.y.z/32 dev ens192 first would get you there. That says that ...
Ricky's user avatar
  • 32.3k
3 votes

Will the UDP packets reach its destination?

No. standard broadcast are limited to the local subnet only. So it will only reach hosts that are in the same subnet and each subnet is tied to its network mask. So if the subnet mask of the two hosts ...
JFL's user avatar
  • 19.7k
3 votes
Accepted

Why Linux answers ARP requests for IPs that belong to different network interfaces?

0 - (default) The kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but it usually makes sense, because it increases the chance of successful communication. ...
Ricky's user avatar
  • 32.3k
2 votes

Tuning TCP Reno parameters to reduce delay experienced by short flows of size 20KB ?

The above issue was resolved and I was able to reproduce the same figure. The authors specified that for TCP they were using 100 packets as the limit of buffer. And I was using 467 packets as buffer ...
akadam's user avatar
  • 83
2 votes
Accepted

Setting up an SNMP environment

Partially. The manager and agent don't really apply to this type of connection, but the switch is the SNMP server and the Linux box is the client. The SNMP daemon would need to run on the switch. ...
Theo's user avatar
  • 319
2 votes

Understanding Linux Bridging

How is the above table constructed? The table is constructed from the source MAC addresses of frames passing through the bridge. Question 2: But if a frame gets generated at veth1 with a ...
Peter Green's user avatar
  • 13.4k
2 votes
Accepted

When last was the OSI model layer updated

The OSI model is ISO/IEC 7498-1:1994. It was last updated in 1994, and it had corrections applied in 1996. The seven-layer model itself has not really changed since it was first described, but the ...
Ron Maupin's user avatar
  • 99.9k

Only top scored, non community-wiki answers of a minimum length are eligible