Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
14 votes
Accepted

Is there a way to capture only gratuitous ARP's using tcpdump?

In the usual tcpdump for Unix systems, only some fields are known by their name. Try specifying the opcode field by offset and size, and comparing with 2 ("reply") tcpdump -i eth99 arp and arp[6:2] =...
jonathanjo's user avatar
  • 16.3k
12 votes
Accepted

What does the output of this tcpdump mean?

The first two lines are the system with IP address 192.168.2.22 sending a bunch of mDNS multicast queries for PTR records of various services in the local network. PTR means the message is about a ...
telcoM's user avatar
  • 246
8 votes
Accepted

Why only after 3-duplicate ACK retransmission takes place in TCP?

You're referring to 'Fast Retransmit' in the TCP Reno implementation. It is basically an assumption. RFC 2001, TCP Slow Start, Congestion Avoidance, Fast Retransmit, and Fast Recovery Algorithms ...
moogzy's user avatar
  • 854
7 votes
Accepted

How to check if a NIC supports hardware timestamps

I guess you could run the command below, it will depict every capability your software and hardware networking has, sudo ethtool -T <interface> interface information such as names are ...
Alireza Sanaee's user avatar
6 votes

who determines whether should ping send a ARP request?

What happens is Ping builds a ping packet and passes it to the kernel. The kernel looks up the destination in the routing table. Based on the routing table it determines an interface and a "next hop ...
Peter Green's user avatar
  • 13.3k
6 votes
Accepted

tcpdump not capturing all TCP packets when capturing whole packets

Found the solution to my own question with the help and hint from @Guy Harris. The kernel was dropping packets due to that the buffer tcpdump uses got overfull when capturing whole TCP packets. From ...
Muff's user avatar
  • 183
5 votes
Accepted

Dump traffic on routing-instance with a Juniper SRX firewall

This works fine on the lower-end SRX models - try using the layer 3 interface bound to your VLAN eg: tcpdump -i vlan.10 My configuration looks like this: routing-instances { TCPDUMP-TEST { ...
Benjamin Dale's user avatar
5 votes
Accepted

tcpdump output with bad length indicator present

The 1472 is the maximum payload length for the UDP datagram. The 1500 is the MTU (maximum packet size), from which you must subtract the IP header length (20 for IPv4) and the UDP header length (8), ...
Ron Maupin's user avatar
  • 99.8k
4 votes

Circular tcpdump output

When you think about it, creating a circular buffer within an on-disk file is pretty complex, and not suited at all to typical disk I/O. The only way to make it even marginally feasible is to find a ...
Jeremy Gibbons's user avatar
4 votes

Analysing a HTTP request with tcpdump

But then the client sent an ack to the server with the value 1? Shouldn't it be 934031639? Your output shows relative instead of absolute sequence numbers. To get the absolute numbers use the ...
Steffen Ullrich's user avatar
4 votes

How can I filter out particular MAC addresses when running tshark on a pcap trace?

You can use not ether host 01:23:45:67:89:ab. To filter only source or destination address use not ether src or not ether dst. Check http://www.tcpdump.org/manpages/pcap-filter.7.html
Zac67's user avatar
  • 84.8k
4 votes

What more information can I get from filtering by MAC address rather than IP?

Is there an advantage to using a MAC address capture filter over a (static) IP address for the host? Depending on the purpose of the capture, certainly. If so, what? The advantage of capturing ...
YLearn's user avatar
  • 27.4k
3 votes

read filters from a text file with tcpdump

It's not specifically about tcpdump but you can do this with any command whatsoever with standard Unix shell "backtick" $ tcpdump -r input.pcap -w output.pcap `cat myfilter.txt` The -F file method ...
jonathanjo's user avatar
  • 16.3k
3 votes

read filters from a text file with tcpdump

From a five seconds web search and the TCPDUMP man page OPTIONS -F file Use file as input for the filter expression. An additional expression given on the command line is ignored.
JFL's user avatar
  • 19.7k
3 votes
Accepted

who determines whether should ping send a ARP request?

A host that needs to send something to another host on the LAN needs to resolve the layer-3 (e.g. IP) address to the layer-2 (e.g. ethernet) address. That is what ARP (Address Resolution Protocol) ...
Ron Maupin's user avatar
  • 99.8k
3 votes

What more information can I get from filtering by MAC address rather than IP?

If your 'device' is a single, simply-behaved, IP host then capturing specified by IP address is good. If however it's a router you might want to filter by ethernet address, as indicated in the first ...
jonathanjo's user avatar
  • 16.3k
3 votes
Accepted

why I didn't get three way handshake by tcpdump command?

Your system has defined localhost as both ::1 (ipv6) and 127.0.0.1 (ipv4), so telnet first tries ipv6 and if this fails it tries ipv4. The first packet is a SYN to ::1 but because no process is ...
hertitu's user avatar
  • 2,658
3 votes

TCP Flow-control questions that drives me mad

Assuming this is a client-side capture, you need to take into account that there is a round-trip delay between your client and server, so these timestamps show when the client sent/received packets, ...
hertitu's user avatar
  • 2,658
3 votes
Accepted

capturing specific BFD packets using tcpdump

Okay, so I found this link which had an interesting example of how to build a tcpdump filter to match SMTP packets beginning with the string 'MAIL' in the segment data. It looks like my biggest ...
Stuart Smith's user avatar
3 votes
Accepted

Wireshark - How to find cause of incomplete download

You can use source and destination filter in wireshark: ip.src==192.168.0.1 and ip.dst==192.168.0.2 if it's http you can add filter: tcp.port == 80 or tcp.port == 443 for ssl. When you find your ...
Datagram.Network's user avatar
3 votes
Accepted

Which tcpdump metrics reveal server connectivity problems vs client problems?

Welcome to Network Engineering. It's difficult to say where the problem lies based on the data you have. Data could be lost from the client to the server, or from the server to the client, and it ...
Ron Trunk's user avatar
  • 67.6k
3 votes

tcp connection and stream flow question

A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a ...
Ron Maupin's user avatar
  • 99.8k
3 votes
Accepted

tcp connection and stream flow question

The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the ...
Ron Trunk's user avatar
  • 67.6k
3 votes

Nmap differences between scanning with -Pn or without

Scan with -Pn it's ok, not include any ICMP packet, but the other scan, why it's trying to check the 120, 443 and 80 port when I'm say explicitly check just the 9000? First, there is no check of a ...
YLearn's user avatar
  • 27.4k
3 votes
Accepted

How to capture mixture of packets with and without VLAN tag over LACP with tcpdump?

The -e flag doesn't work this way. When you write tcpdump .... -e vlan it doesn't mean "show vlan tag if available". It means "show link-level header" and "show only packets ...
Mikko Rantalainen's user avatar
2 votes

TCPDump - Filter by MAC Address

You can also use the not argument in conjunction with YLearn's answer to filter out packets from a specific mac address. In my case I needed every packet except the ones from 00:11:22:33:44:55 and I ...
NanoNi's user avatar
  • 121
2 votes
Accepted

debugging arp requests over vlan

I was able to solve the problem. The issue was indeed on the outgoing port as suggested in the comments above. Whatever it's worth a few findings along the way of solving this problem: first ...
hansaplast's user avatar
2 votes
Accepted

Which terminal based tool can I use to display only the source and destination IPs of all packets

The very popular capture tool Wireshark includes a CLI tool named tshark which can do what you want: $ sudo tshark -T fields -e ip.addr Capturing on eth1 10.48.169.25,10.48.37.151 10.48.37.151,10.48....
hertitu's user avatar
  • 2,658
2 votes
Accepted

Is it possible to capture ieee802.11 management and control frames from the same phone using android APP or tcpdump on root device?

Without monitor mode, there will be no access to non-traffic frames. Use a 3rd device (PC) that does support monitor mode to record radio traffic.
Ricky's user avatar
  • 32.2k
2 votes
Accepted

Why does it show LAN address when NAT is enabled on cisco?

The traffic is surely the netflow export UDP packets you have configured. It would normally come from the inside interface, hence the inside address. Use ip flow-export source to change the source ...
jonathanjo's user avatar
  • 16.3k

Only top scored, non community-wiki answers of a minimum length are eligible