Questions tagged [tcpdump]
For questions about traffic dumps from the packet analyzer tcpdump. This tag should only be used in relation to troubleshooting an issue with a network device. If the host that runs tcpdump has been converted to a network device (eg. firewall on Linux) then this tag is also on topic.
66 questions
1
vote
0
answers
81
views
tcpdump on wifi interface shows BSSID of the access point as source address/MAC
I am trying to understand traffic as shown by tcpdump on my wifi interface (MAC_PC) looking at my regular traffic coming from an access point (MAC_AP), linked by an Ethernet cable to my router (MAC_RT)...
- 11
0
votes
1
answer
55
views
OVS pop_mpls action returning invalid ethernet frames
I am currently running into walls when trying to pop an mpls label with ovs.
I currently have two interfaces on one ovs instance connected to ports eth0 and eth1. I define a flow on eth0 to pop an ...
- 111
0
votes
1
answer
220
views
How does a client end the TCP connection when SYN+ACK is not received after multiple retransmissions? [closed]
I am trying to establish a TCP connection with a server. I added a firewall rule in the server to drop the TCP packets in order to check how the TCP client terminates.
Client retransmits SYN multiple ...
1
vote
0
answers
1k
views
How I can filter only quic packets with `tcpdump` command?
I want to capture only QUIC UDP datagrams on 443 port.
With following command tcpdump reports all udp packets that arrive to the host on port 443.
tcpdump -n udp -SX -i any port 443
How I can set it ...
- 111
2
votes
1
answer
10k
views
tcpdump output with bad length indicator present
Could someone help me interpret this tcpdump udp packet output? We are getting out image so I'm wondering why we are seeing this message. Is the packet length indicated by "length 1500)" or ...
- 123
0
votes
2
answers
359
views
Detecting Ethernet over power by packets
If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
2
votes
1
answer
2k
views
How to capture mixture of packets with and without VLAN tag over LACP with tcpdump?
Given following configuration in Linux:
bond0 in LACP (802.3ad) mode with two VLAN networks running over it.
bond0.111 configured with static IP
bond0.222 configured with DHCP
How to capture packets ...
1
vote
1
answer
148
views
Does tcpdump work differently from Omnipeek?
I have been trying to analyze packets using tcpdump. I am trying to use a wireless card and capture packets through monitor mode, instead of promiscuous mode, since I want to see what kind of traffic ...
- 13
1
vote
2
answers
512
views
tcpdump find source ip with most bytes
some times we receive volumetric traffic from single source IP (out of our networks) towards one destination in our network,
is there anyway to find it with tcp dump ?
thank you.
- 785
1
vote
1
answer
23k
views
tcpdump: cksum incorrect [closed]
When I run tcpdump on my machine (here I use 1.2.3.4)
tcpdump -i eth0 -n dst host 1.2.3.4 -v
roughly 90% of incoming packets have incorrect checksum:
cksum 0xc25b (correct), seq 101134607:101136035
...
- 111
2
votes
1
answer
799
views
Nmap differences between scanning with -Pn or without
I'm trying to understand the difference in NMAP between put -Pn or not. I know that if I'm not mistaken -Pn skip ICMP (ping) scan. Ok.. so I try scan a random VM and intercept the packets with tcpdump....
- 21
1
vote
2
answers
2k
views
tcpdump filter for ERSPAN session ID value
I am using rcdcap to decapsulate ERSPAN on a Linux host. I would like to be able to split ERSPAN session IDs out to different logical capture interfaces. My current ERSPAN session IDs are 10 and 20. ...
- 33
1
vote
1
answer
101
views
Packet analyze on router does not match client and server
thank you for your time.
My (virtual) network has 3 objects : a client, a server and a router between them.
I'm sniffing the traffic on the 3 machine with the command
tcpdump -i any -s 0 -w [path]
...
- 13
0
votes
1
answer
104
views
Is it possible to re-transmit only the last packet at TCP flow?
I try to understand the TCP behavior, especially re-transmission.
I did a small experiment and find the curious thing.
The only last packet is re-transmitted. Why do this happen?
I think if the ...
- 125
0
votes
0
answers
229
views
Why wifi and ethernet use the same frame format from tcpdump -d output?
If I execute
tcpdump -i wlan0 tcp -d
or
tcpdump -i eth0 tcp -d
I get the same output
(000) ldh [12]
(001) jeq #0x86dd jt 2 jf 7
(002) ldb [20]
(003) jeq #0x6 ...
- 101