Hot answers tagged

12 votes
Accepted

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture ...
Ricky's user avatar
  • 32.1k
11 votes
Accepted

Difference between Linux Bridge and Open vSwitch

Open vSwitch has a section on that in their FAQ: Q: Why would I use Open vSwitch instead of the Linux bridge? A: Open vSwitch is specially designed to make it easier to manage VM network ...
RobinG's user avatar
  • 1,969
9 votes

net-snmp Creating my own MIB: No Such Instance currently exists at this OID

I think your issue is coming from a simple misconception of how SNMP data (OIDs) is structured, and how snmpwalk, snmpget, and snmpgetnext interact with it. SNMP organizes the OIDs into related ...
Jordan Head's user avatar
  • 7,044
6 votes

how to find the right value of MTU Jumbo frame

Make sure there's a notable performance difference between jumbos and standard frames - without it, there's little reason to dive in. Hardware offloading tends to make jumbos obsolete unless you need ...
Zac67's user avatar
  • 83.9k
5 votes

What will happen at server side if it received 2 SYN packet from the same client application?

Basically, a TCP receiving duplicate SYNs will SYN,ACK them, but it will receive a RST for the duplicate. RFC 793, Transmission Control Protocol, Section 3.4. Establishing a connection explains ...
Ron Maupin's user avatar
  • 99.4k
5 votes

Forward Avahi mDNS packets from one network to another

Zeroconf Networking RFC 6272, RFC 6273 has the fundamental design constraint of being "local subnet only". Zeroconf's multicast packets have a TTL of 255, and if you try forward these ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

tcpdump output with bad length indicator present

The 1472 is the maximum payload length for the UDP datagram. The 1500 is the MTU (maximum packet size), from which you must subtract the IP header length (20 for IPv4) and the UDP header length (8), ...
Ron Maupin's user avatar
  • 99.4k
4 votes
Accepted

Understanding Linux Bridging

The way switches (bridges) work is that a switch builds a MAC address table which relates MAC addresses to the port(s) where the MAC addresses are connected. When a frame comes into a switch port, the ...
Ron Maupin's user avatar
  • 99.4k
4 votes

What are entries in kernel IP table?

What route -n (or netstat -rn) is showing you needs a bit of interpretation - a "gateway" of 0.0.0.0 means that the next hop for any packet sent to this subnet is the actual destination host, not a ...
Nick Bastin's user avatar
4 votes

Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?

Can I use the same port numbers for both but binding one of them to 127.0.0.1:N and the other to 127.0.0.2:N ? Yes, you can use the same port number on two different 127.X.X.X addresses. Are ...
Everton's user avatar
  • 1,636
4 votes

Calculated window size in Wireshark

This post has a good explanation for what you're seeing. What you see is normal behavior. Both sides send a small window size and neither announce that they are able to use window scaling. So in ...
OzNetNerd's user avatar
  • 2,337
4 votes
Accepted

TCP Client-Server with mtu is set, Issue with fragmented packets

You are confusing MTU and MSS. The MTU 1500 is related to ethernet, so it includes the IP and TCP headers. Both have a minimum size of 20, so the MSS (maximum segment size) for TCP is in this case ...
JFL's user avatar
  • 19.6k
4 votes
Accepted

What could cause kvm virtualized pfsense to get 84mbps behind physical pfsense, but then drop to 1mbps when it replaces physical pfsense?

JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming. Recap of ...
neoakris's user avatar
  • 287
4 votes
Accepted

"ssh: connect to host myserver port 22: Invalid argument" (intermittent, ipv6, link-local address, dhcp hostname)

Whatever is doing hostname resolution is returning link-local IPv6 address(es) that aren't valid for the interface selected -- i.e. "any". Link-local addresses must specify the interface -- eg. fe80:.....
Ricky's user avatar
  • 32.1k
4 votes
Accepted

How do I find the IP of the DNS server that respond for a specific domain name?

The authoritative name server should be in the domain's NS record. In Windows, this can be looked up nslookup -type=ns somedomain.com In Linux, something like dig somedomain.com NS +noall +answer ...
Zac67's user avatar
  • 83.9k
4 votes

Inconsistent behavior of link aggregation

It depends on the LACP load balancing algorithm. The LACP load balancing algorithm is only locally significant (they don't have to match on Mellanox and Arista switch). Load balancing algorithms are ...
OlofL's user avatar
  • 108
4 votes
Accepted

Allow active connections in firewall on multiple BGP connected routers

As you figured out, doing stateful firewalling on external links doesn't work well if you're multihomed. Typically, you either do stateless firewalling on external links, or place the firewall behind ...
Teun Vink's user avatar
  • 17.1k
3 votes

Lower throughput with fixed TCP window size?

That's not a shock. These day we automatically tune the amount of RAM assigned to TCP buffers (aka the maximum TCP window size), and by specifying the window size you are turning off the automated ...
vk5tu's user avatar
  • 1,171
3 votes

Lower throughput with fixed TCP window size?

As Marco mentioned, Receive window sizes (rwin) will increase and decrease automatically during a TCP session depending on how lossy the connection ends up being. It is therefore possible that ...
OzNetNerd's user avatar
  • 2,337
3 votes

Lower throughput with fixed TCP window size?

Receive window sizes (rwin) will increase and decrease automatically during a TCP session depending on how lossy the connection ends up being. It is therefore possible that when you omit the -w flag ...
Mark Riddell's user avatar
3 votes
Accepted

Will Linux send the ARP gratuitous or ARP probe (defined in RFC 5227)

Manually configuring an IP address on a device doesn't require the device to check for address conflicts. It is only if the device configures its own IP address (DHCP, etc.) that it should check for ...
Ron Maupin's user avatar
  • 99.4k
3 votes
Accepted

ARP flush manual broadcast after IP change

E.g. Windows uses 30 seconds for ARP cache timeout. [1] You might be able to decrease the "dead" time by sending out a gratuitous ARP with the new MAC which the ASA should be doing by itself when ...
Zac67's user avatar
  • 83.9k
3 votes
Accepted

Linux TCP stack repeatedly sends "TCP window update" without acknowledging any data

Ok, after some investigation I learnt that 1) data in syn handshake is legal, and 2) the weird segments are duplicate acks and receive window updates rolled into one: the first chunk of 256 bytes of ...
Einheri's user avatar
  • 183
3 votes
Accepted

Can I force a higher TCP segment size with netcat?

I used the following configuration: Standard MTU on A and B; MTU lowered to 500 on the router (B side); /proc/sys/net/ipv4/ip_no_pmtu_disc set to 1 on the sender (A). And then the sender sticks to ...
Eusebius's user avatar
  • 150
3 votes

Daisy chaining IOT devices without switches?

Welcome to Network Engineering! Yes, you are duplicating addresses, so your idea will not work. Each link between devices is a separate network and needs its own IP subnet with unique addresses.
Ron Trunk's user avatar
  • 67.3k
3 votes
Accepted

Virtual IP failover issue with vmware exsi ip based hashing

The ESXi's vSwitch doesn't care about IP addresses, just MACs. The "IP hash-based routing" is about L2 load balancing - which egress port is used - and has no relevance for IP routing. You need to ...
Zac67's user avatar
  • 83.9k
3 votes

MTU 9000 and 1500 when machines with MTU 1500 send data to machines with MTU 9000

Generally, this should be avoided, but under some limited circumstances it may appear to work. The problem stems from there being no layer-2 mechanism to signal the mismatch, or negotiate a frame size....
Ricky's user avatar
  • 32.1k
3 votes
Accepted

How my neighbour machines in the same network knows my interface ip?

Simple answer: The machines don't know the route. The IP address that you use must be in the range of the so-called "subnet" the machine belongs to. This means that all machines that can be reached ...
Martin Rosenau's user avatar
3 votes
Accepted

Does a gateway always have to be on the same subnet as the host IP address?

The next-hop address must be reachable, which means you need a route to ("covering") it. In this case a simple ip route add 10.x.y.z/32 dev ens192 first would get you there. That says that ...
Ricky's user avatar
  • 32.1k

Only top scored, non community-wiki answers of a minimum length are eligible