13
votes
Accepted
What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?
Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture ...
- 32.6k
9
votes
net-snmp Creating my own MIB: No Such Instance currently exists at this OID
I think your issue is coming from a simple misconception of how SNMP data (OIDs) is structured, and how snmpwalk, snmpget, and snmpgetnext interact with it.
SNMP organizes the OIDs into related ...
- 7,213
6
votes
how to find the right value of MTU Jumbo frame
Make sure there's a notable performance difference between jumbos and standard frames - without it, there's little reason to dive in. Hardware offloading tends to make jumbos obsolete unless you need ...
- 88.1k
5
votes
Accepted
"ssh: connect to host myserver port 22: Invalid argument" (intermittent, ipv6, link-local address, dhcp hostname)
Whatever is doing hostname resolution is returning link-local IPv6 address(es) that aren't valid for the interface selected -- i.e. "any". Link-local addresses must specify the interface -- eg. fe80:.....
- 32.6k
5
votes
What will happen at server side if it received 2 SYN packet from the same client application?
Basically, a TCP receiving duplicate SYNs will SYN,ACK them, but it will receive a RST for the duplicate.
RFC 793, Transmission Control Protocol, Section 3.4. Establishing a connection explains ...
- 101k
5
votes
Forward Avahi mDNS packets from one network to another
Zeroconf Networking RFC 6272, RFC 6273 has the fundamental design constraint of being "local subnet only".
Zeroconf's multicast packets have a TTL of 255, and if you try forward these ...
- 8,876
5
votes
Accepted
tcpdump output with bad length indicator present
The 1472 is the maximum payload length for the UDP datagram. The 1500 is the MTU (maximum packet size), from which you must subtract the IP header length (20 for IPv4) and the UDP header length (8), ...
- 101k
4
votes
Accepted
What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?
JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming.
Recap of ...
- 297
4
votes
Accepted
How do I find the IP of the DNS server that respond for a specific domain name?
The authoritative name server should be in the domain's NS record.
In Windows, this can be looked up
nslookup -type=ns somedomain.com
In Linux, something like
dig somedomain.com NS +noall +answer
...
- 88.1k
4
votes
Inconsistent behavior of link aggregation
It depends on the LACP load balancing algorithm. The LACP load balancing algorithm is only locally significant (they don't have to match on Mellanox and Arista switch).
Load balancing algorithms are ...
- 108
4
votes
Accepted
Allow active connections in firewall on multiple BGP connected routers
As you figured out, doing stateful firewalling on external links doesn't work well if you're multihomed. Typically, you either do stateless firewalling on external links, or place the firewall behind ...
- 17.4k
3
votes
Accepted
Linux TCP stack repeatedly sends "TCP window update" without acknowledging any data
Ok, after some investigation I learnt that
1) data in syn handshake is legal, and
2) the weird segments are duplicate acks and receive window updates rolled into one: the first chunk of 256 bytes of ...
- 183
3
votes
Accepted
ARP flush manual broadcast after IP change
E.g. Windows uses 30 seconds for ARP cache timeout. [1]
You might be able to decrease the "dead" time by sending out a gratuitous ARP with the new MAC which the ASA should be doing by itself when ...
- 88.1k
3
votes
Accepted
Can I force a higher TCP segment size with netcat?
I used the following configuration:
Standard MTU on A and B;
MTU lowered to 500 on the router (B side);
/proc/sys/net/ipv4/ip_no_pmtu_disc set to 1 on the sender (A).
And then the sender sticks to ...
- 150
3
votes
Daisy chaining IOT devices without switches?
Welcome to Network Engineering! Yes, you are duplicating addresses, so your idea will not work. Each link between devices is a separate network and needs its own IP subnet with unique addresses.
- 68k
3
votes
Accepted
Virtual IP failover issue with vmware exsi ip based hashing
The ESXi's vSwitch doesn't care about IP addresses, just MACs. The "IP hash-based routing" is about L2 load balancing - which egress port is used - and has no relevance for IP routing.
You need to ...
- 88.1k
3
votes
MTU 9000 and 1500 when machines with MTU 1500 send data to machines with MTU 9000
Generally, this should be avoided, but under some limited circumstances it may appear to work. The problem stems from there being no layer-2 mechanism to signal the mismatch, or negotiate a frame size....
- 32.6k
3
votes
Accepted
How my neighbour machines in the same network knows my interface ip?
Simple answer: The machines don't know the route.
The IP address that you use must be in the range of the so-called "subnet" the machine belongs to.
This means that all machines that can be reached ...
- 2,356
3
votes
Accepted
Does a gateway always have to be on the same subnet as the host IP address?
The next-hop address must be reachable, which means you need a route to ("covering") it. In this case a simple ip route add 10.x.y.z/32 dev ens192 first would get you there. That says that ...
- 32.6k
3
votes
Will the UDP packets reach its destination?
No. standard broadcast are limited to the local subnet only. So it will only reach hosts that are in the same subnet and each subnet is tied to its network mask.
So if the subnet mask of the two hosts ...
- 19.8k
3
votes
Accepted
Why Linux answers ARP requests for IPs that belong to different network interfaces?
0 - (default) The kernel can respond to arp requests with addresses
from other interfaces. This may seem wrong but it usually makes sense,
because it increases the chance of successful communication. ...
- 32.6k
2
votes
Can i use an actual network management application and connect it to a router inside GNS3?
As long as you have connectivity between your GNS3 and your LAN, this is going to work just fine.
- 55
2
votes
Accepted
GNS3 v2 router to host connection
I've noticed this for quite awhile with GNS3. I imagine that while you can see the ARP's via wireshark on the host, the host isn't actually receiving them. They're being sent out the host interface as ...
- 993
2
votes
Understanding Linux Bridging
How is the above table constructed?
The table is constructed from the source MAC addresses of frames passing through the bridge.
Question 2: But if a frame gets generated at veth1 with a ...
- 13.8k
2
votes
SNMP agent on embedded device, No such object available on this agent at this OID
Whenever I face issues with an OID not being found, I always use the snmpwalk command, in order to see what the devices do respond to:
snmpwalk -v 2c -c public 10.x.x.x
- 480
2
votes
Accepted
Different results when same WireShark pcap file opened in Unbuntu17.04 and later Windows 10
Wireshark uses pieces of code it calls dissectors to analyze packets and provide the information given in the packet details. These get added to and updated regularly by the community and developers ...
- 27.4k
2
votes
Accepted
Cisco Nexus vPC LACP bonding with server issue
Solution
OMG! Problem was downdelay=1000 option from Linux BONDING_OPTS, As soon as i removed that everything started working, I reboot server 10 time and every single time vpc was up.
I don't know ...
- 4,389
2
votes
Interpreting TTL in ping results
TTL values are determined by the remote machine. For example, if you ping a Linux machine, its originating TTL value is 64. Depending on how many routers it crosses to get back to you, the TTL is ...
- 21
2
votes
Accepted
Understanding IP multicast in linux
How can we create a Multicast group?
A multicast group is not "created".
A multicast group is formed of all computers listening to a certain multicast address. Therefore a multicast group ...
- 2,356
Only top scored, non community-wiki answers of a minimum length are eligible