Questions tagged [tcpdump]

tcpdump is a common packet analyzer that runs under the command line, utilizing BPF (Berkeley Packet Filter) language

tcpdump
Filter by
Sorted by
Tagged with
1 vote
2 answers
2k views

Permissions Issue with tcpdump in Ubuntu 20.04

I am creating a tcpdump file using "tcpdump tcp -w tcp1" but I can't use the -r function to read the file as it says "permissions denied". I used chmod to try and change ...
Andrew Harvey's user avatar
0 votes
1 answer
128 views

How to separate data from different files in a single TCP packet?

Say I have transmitted data of 2 files A.bin and B.bin, since a TCP packet can have data from more than one file starting at random position, after wireshark capture, how can I identify which part of ...
user9392307's user avatar
0 votes
1 answer
362 views

How to use tcpdump file to test syn flood attack?

I have a tcpdump file that will simulate a SYN flood attack. I have rules set up in SNORT that I would like to test on this tcpdump file. How would I go about running this on the command line? Or ...
user avatar
1 vote
1 answer
1k views

Latency debug for websocket communication

I'm working on a debug latency problem of websocket. I am trying to receive some price information from crypto-currency exchange with its websocket interface. The data packets we receive include the ...
BookSword's user avatar
  • 338
3 votes
2 answers
2k views

pcap_lookupdev() is deprecated l. How to resolve it

Since lookupdev has been deprecated in libcap >=1.9, I am facing an error on a code written in v1.8. I have not been able to resolve it. Suggestion is I use pcap_findalldevs but I am getting an ...
Volpone's user avatar
  • 51
0 votes
1 answer
645 views

tcpdump packets are captured before fragmentation

I have a setup as below. [ Host A ] <-> [Rtr-A] <-> [Rtr-M] <-> [Rtr-B] <-> [ Host B] ...
user2677279's user avatar
0 votes
1 answer
323 views

Does pcap_findalldevs() in WinPcap work for IPv6 in Windows10?

I'm checking whether pcap_findalldevs can find IPv6 devices in Windows10 I'm not sure because Windows 10 doesn't seem one of supported platforms according to the homepage (https://www.winpcap.org/...
hyuk myeong's user avatar
-1 votes
1 answer
432 views

Extract IP directly from Tcpdump Output

I wanted to extract IP on a Tcpdump Command output. tcpdump -nei eth0 and src 10.10.10.1 Sample Output of Above Command. As the output was very big I have posted it in below link. https://pastebin.pl/...
Am3Y's user avatar
  • 75
2 votes
0 answers
575 views

How to step by step build the circuit in TOR

I have this piece of code which is a simple code to create and/or extend a circuit in TOR using stem. import getpass import sys import argparse import stem import stem.connection from stem.control ...
Ehsan's user avatar
  • 711
1 vote
3 answers
4k views

Counting unique MAC addresses from a .pcap file

I'm trying to produce a shell command that will read a given .pcap file using tcpdump and would output the number of unique MAC addresses in the given .pcap file Can't wrap my head around it plus the &...
MOSARON's user avatar
  • 11
0 votes
1 answer
255 views

unauthorized users send multipart/data to server event after being rejected with 401 error

Im using Busboy with Express and Passport-JWT to upload file from my client , when the client is authorized with a valid JWT token everything works fine , but in cases that client is not authorized ...
ItsJay's user avatar
  • 188
7 votes
1 answer
26k views

TCP Server sends [ACK] followed by [PSH,ACK]

I am working on a high-performance TCP server, and I see the server not processing fast enough on and off when I pump high traffic using a TCP client. Upon close inspection, I see spikes in "...
user2548514's user avatar
1 vote
1 answer
5k views

How to stop writing to a capture file using tcpdump after it reaches a specific size

I am looking for some solution to stop capturing the tcpdump packet after it capture a specified size .I am using the below command to achieve this but it looks like the tcpdump is not writing all the ...
Prasad Roy's user avatar
1 vote
2 answers
6k views

How to filter MQTT traffic on base of topic name in tcpdump

I am capturing MQTT traffic for troubleshooting using below command tcpdump -i team0 -w mqtt-trace.pcap src 10.x.x.x But it results in very big file within minutes, Can i filter tcpdump on base of ...
ImranRazaKhan's user avatar
0 votes
0 answers
191 views

How to configure tcpdump to read udp from 4G not from Wi-fi

I want tcpdump to listen to a port to receive UDP packets so I use the classic tcpdump -i lo udp port 5353 -vv -X But the prompt ends the activity right after without any output. I think this has to ...
hellofriends's user avatar
1 vote
1 answer
259 views

why socket.recv() on python3 return value that lost the last byte?

So I have python code like this to send and receive UDP packet to a port s = socket(AF_INET, SOCK_DGRAM) UDP_IP = '1.0.0.45' UDP_PORT = 8100 s.connect((UDP_IP, UDP_PORT)) r = s.send(...
Weixu Pan's user avatar
0 votes
1 answer
157 views

Different semantics between tcp[tcpflags] & tcp-syn == tcp-syn, tcp[tcpflags] == tcp-syn, tcp[13] == tcp-syn, tcp[13] & tcp-syn != 0

I have some doubts about the usage of tcpdump to capture packet based on tcpflags. Are these examples interpreted correctly? 'tcp[tcpflags] & tcp-syn == tcp-syn' tcp-syn is set, but other flags ...
Maicake's user avatar
  • 1,096
0 votes
0 answers
172 views

Tcp connection with libnet C

For an assignment i have to create a tcp hijack attack and one of the first steps i have to take is sending a TCP packet to a server to get a response with a sequence number. The server responds to ...
killerspons's user avatar
1 vote
1 answer
131 views

How to recreate a file using tcpdump and c++? [closed]

I have the pcap file for duration when the text file was downloading. How can I recreate the original file from this pcap file using python or c++. I don't know much about network programming and am ...
alex's user avatar
  • 23
0 votes
0 answers
134 views

unable to inspect docker to postgres traffic in the same host

There's a docker web application installed in a linux host, and it works fine. I know this docker instance is connecting to postgres database with port 5432, and I'm trying to understand the traffic ...
Kate's user avatar
  • 1
1 vote
1 answer
588 views

SetPerTcpConnectionEStats and GetPerTcpConnectionEStats is returning error code 1214 (invalid NETNAME)

I am trying to get stats similar to the ones shown in "Resource Monitor" in windows in a my c++ service. For that I have used the example shown at https://learn.microsoft.com/en-gb/windows/...
Nishant Gupta's user avatar
0 votes
1 answer
2k views

rsyslogd client not closing the TCP connection when server rsyslogd goes down

I have configured rsyslogd on a remote server to send the logs from a client machine with rsyslogd using TCP protocol. After configuring and restarting the rsyslogd daemon on both client and server I ...
user3282305's user avatar
2 votes
1 answer
760 views

Packets getting dropped with Libpcap in C on 1 Gig Traffic

I'm writing a packets parser in C using libpcap library. Here is the simple code int main(int argc, char *argv[]) { pcap_t *pcap; const unsigned char *packet; char errbuf[PCAP_ERRBUF_SIZE]...
Alamgir Qazi's user avatar
1 vote
1 answer
1k views

Using socat to dump traffic to pcap

Hi everyone this is my first question on stackoverflow! I'm using this software (it's a NIDS); one of its features is using socat to create a proxy that saves the traffic to a pcap. That's the command ...
Pietro Mazzini's user avatar
1 vote
1 answer
2k views

inspect inner geneve packet using tcpdump

I want to put filters on inner packets encapsulated by geneve. If I put a filter like tcpdump -vnn udp -i eth0 It filters all geneve packets as the header above geneve is udp. How to filter the ...
blackdronzer's user avatar
0 votes
1 answer
195 views

TCP header value initialization

I need to be able to generate SIP packets over TCP layer, I am performing the following initialization for the TCP header values: //TCP layer //src dest port *(uint16_t*)(pkt + OFF_SRC_PORT) =...
Shriya Nagrath's user avatar
3 votes
0 answers
1k views

Fail to install tcpdump package in UBI8 (Read hat Universal Base Image)

I am building a docker image based on UBI8(Read hat Universal Base Image), Dockerfile looks like FROM registry.access.redhat.com/ubi8/ubi-minimal RUN microdnf install sudo zip tar bash procps openssl ...
Joe's user avatar
  • 365
1 vote
0 answers
504 views

VPC Flow Logs and Nat instance

I have the VPC with two subnets within it: Public subnet with Nat instance No incoming connections from the Internet are allowed. Private subnet with the Application server Route table for the ...
kolyaiks's user avatar
  • 157
-2 votes
1 answer
82 views

tcpdump -n 'tcp[13] & 16 !=0' | wc -l v.s. tcpdump -n 'tcp[tcpflags] = tcp-ack' | wc -l ==> different results?

I'm trying to understand the following; When trying tcpdump -n 'tcp[13] & 16 !=0' | wc -l on a file, I get a different result (27833) than when I try tcpdump -n 'tcp[tcpflags] == tcp-ack' | wc -l (...
Bart_S's user avatar
  • 17
1 vote
1 answer
40 views

Adding the values generated by multiple terminal commands in the terminal itself

Can we add the values generated by multiple commands? For example, I am analysing this pcap file using tcpdump, and by doing this - capinfos -s *.pcap, I am getting all the pcap files' size, line by ...
Suraj221b's user avatar
  • 102
0 votes
1 answer
632 views

TCPDUMP BPF Primitives and Port Exclusion

I am trying to create a filter in tcpdump that will allow me to examine tcp traffic on ports about 1024. I came up with:sudo tcpdump tcp portrange 1025-65535 but I'm not sure if there is a better way ...
Rubyredz's user avatar
1 vote
1 answer
2k views

How do save tcpdump monitoring container for later analysis

I am using below command to monitor a single container. How can I extend this so that I can save the the tcp dump for later analysis using WireShark. docker run -it --rm --net container:<...
kumar's user avatar
  • 8,915
0 votes
1 answer
156 views

Chinese tracker TCP frame decoding

So I have this pet tracker I got from China This model (not advertising at all). It includes an option to change the report server so I set it up to report to my server but now I'd like to ba able to &...
JeanneD4RK's user avatar
0 votes
1 answer
37 views

what is the functionality of below code in .pcapfile

`▒▒+Q4▒▒POST/nspversion=1.0&op=notify&sid=966ca56d500083a311eab9c8af564b1a` `HTTP/1.0^M` User-Agent: mealso/1.0 (I; en-US)^M Host: google.com:5001^M X-Tellme-FetchGUID: 870ee784-b9da-11ea-...
bhargav kumar's user avatar
6 votes
0 answers
1k views

How to debug the reason of an unclosed CLOSE_WAIT connections? (tcpdump etc.)

We have Java-application and Nginx as a reverse-proxy installed on the same host. Periodically, we got CLOSE_WAIT connections hanging long time: $ ss -n4t | head State Recv-Q Send-Q Local ...
Muravyev Maxim's user avatar
0 votes
1 answer
805 views

tcpdump on docker container gives error "invalid number of output files"

I'm trying to run a tcpdump command in docker container but I always get this error: "tcpdump: invalid number of output files =" I'm running docker in Ubuntu. This is my container run: sudo docker ...
Furin's user avatar
  • 562
0 votes
1 answer
5k views

capture telnet password tcpdump

I capture data from telnet using tcpdump. Command: tcpdump port http or port ftp or port smtp or port imap or port telnet -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|...
Monterisko's user avatar
1 vote
1 answer
6k views

How to capture password from tcpdump pcap result

I capture data from telnet using tcpdump. Command: tcpdump -qns 0 -X -r output.pcap Now I need to get plain password after capturing so i try command like this strings output.pcap but this command ...
wwilkowski's user avatar
4 votes
2 answers
3k views

How do I pipe live pcap records from a Kubernetes pod to Wireshark running locally?

I'm attempting to get a view in Wireshark of live network traffic in one of my Kubernetes pods. In plain old Docker, I was able to run this: docker run --rm --net=container:app_service_1 crccheck/...
Mark's user avatar
  • 5,290
2 votes
0 answers
1k views

How to filter tcpdump for the direct hostname of a website?

As mentioned in the title, I want to get the direct hostname when visiting a website using my PC. For example, visiting www.youtube.com, at the back it would go to many more domain like fonts.gstatic....
Elvis's user avatar
  • 31
0 votes
0 answers
1k views

Issues with Postgres connections pool on Payara/Glassfish

I run a JEE application on Payara 4.1 which uses PostgreSQL 9.5.8. The connection pool is configured in following way. <jdbc-resource poolName="<poolName>" jndiName="<jndiName>" ...
Marek Puchalski's user avatar
0 votes
1 answer
429 views

NodeJS not receiving full tcp packet when data comes in buffer format from iot devices

We have an IOT device for real-time communication (GPS location). The device is sending TCP packets to the Nodejs server. But when we receiving so it is in buffer format and stripped. We use tcpdump ...
Nazim Hasan's user avatar
2 votes
1 answer
434 views

Is it possible to capture AVTP packets with tcpdump?

I'm new to Automotive Network. I am trying to capture some AVTP (IEEE1722) protocol packets on an Android device. Is it possible to capture AVTP packets with tcpdump on Android? I heard someone said ...
Blackhill de Eagle's user avatar
2 votes
2 answers
6k views

Extract mysql query from tcpdump

I'm using tcpdump to capture TCP packet from port 3306 which is forwarded to MySQL server sudo tcpdump -X -i ens5 -s 0 -tttt dst port 3306 and executed SQL select * from user_trading_volume limit 1 ...
Namhoon Lee's user avatar
1 vote
2 answers
1k views

Can multiple threads sniff on same interface at same time?

Hi i am writing a program to sniff packets, using pcap of tcpdump. For each call from user,a thread is created. That thread will sniff on an interface(probably loopback) and write the captured ...
habi's user avatar
  • 143
0 votes
1 answer
864 views

FreeBSD - tcpdump - filtration of certain udp port [closed]

I'm using freebsd 10.4 what argument i can use in tcpdump to match only certain UDP port? is it -i parameter ? this is what i already reviewed https://www.freebsd.org/cgi/man.cgi?tcpdump(1)#end
Zarkos.Fina's user avatar
0 votes
1 answer
788 views

Is tcpdump 100% reliable on outgoing connection?

I'm working on a server. Its doing health check to another server, like a simple tcp open connection Basically my tcpdump says that the packet (the health check tcp sYn packet) is going out of my ...
khaled83's user avatar
1 vote
1 answer
2k views

Exporting interpreted frame information by Wireshark

I was wondering if there is a way to export specific information shown in Wireshark packet/frame information that are not readily visible in the frame bytes (interpreted information?). I am ...
p8me's user avatar
  • 1,850
3 votes
1 answer
350 views

Analogue of "any" pseudo-device in macos

Is there any possibility to capture packets by tcpdump from all devices in MacOS? In Linux I would use 'sudo tcpdump -i any'. In my MacOS when I execute 'sudo tcpdump -D', I don't see "any" pseudo-...
Maxim Proshin's user avatar
3 votes
3 answers
16k views

Why doesn't tcpdump run in background?

I logged in a virtual machine via ssh and I tried to run a script in background, the script is shown below: #!/bin/bash APP_NAME=`basename $0` CFG_FILE=$1 . $CFG_FILE #just some variables CMD=$2 ...
André Machoski's user avatar

1 2 3
4
5
21