Skip to main content
Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

OCI VTAP traffic mirroring

I am running tcpdump to capture mirrored traffic on compute node behind the target NLB of VTAP. When I use the Max Packet Size on the VTAP to be 1000, my pcaps when viewed in wireshark show for almost ...
Libertarian's user avatar
-1 votes
0 answers
29 views

HikariPool-1 - Connection is not available, request timed out after 30001ms And tcpdump got no packets

I'm using springboot 2.3.12 with HikariCP 3.4.5 and my databse is postgresql. The project started well but after some hours the HikariCP will throw Exception: HikariPool-1 - Connection is not ...
Joveth's user avatar
  • 71
0 votes
0 answers
45 views

Does Azure firewall drop packets with SYN+ECE_CWR flags set

There are tcp retransmissions after SYN+ECE+CWR transmission. I want to know whether you have experienced a behavior where azure firewall silently dropping packets like this intermittently. Unable to ...
TeeeeJ's user avatar
  • 1
1 vote
1 answer
69 views

tcpdump does not capture all packets at high packet frequency

Let’s say, there is some TCP (unencrypted) traffic you would like to eavesdrop packets and send them somewhere else. You don’t want to interrupt the traffic or interfere to its parts, just eavesdrop ...
Captain Sabertooth's user avatar
0 votes
0 answers
22 views

TCPDUMP file for a ping command execution

Guys, We have here in TCPDUMP file displayed by Wireshark. It corresponds to a ping from 192.168.30.18 to 192.168.0.100, eg ping 192.168.0.100 How to understand that ping result is 0% packets loss, ...
DKay's user avatar
  • 21
0 votes
0 answers
17 views

Slow localhost response time when connected to wifi

We have a React/Django app with docker-compose at work. Any request to localhost takes 8 seconds: ab -n1 http://localhost:8080/ This is ApacheBench, Version 2.3 <$Revision: 1879490 $> Copyright ...
Earendil's user avatar
0 votes
1 answer
26 views

Problem with using IPPROTO_RAW with source address filled in when zero

https://man7.org/linux/man-pages/man7/raw.7.html I am using IPPROTO_RAW to send my tcp packet I spefic 0.0.0.0 to source address, so linux kernel will auto fill, and ip checksum auto filled in. I can'...
Long's user avatar
  • 155
1 vote
0 answers
56 views

tcpdump is not available when extracting packet features in windows

I have been trying to extract statistical features from a packet(pcap) using pyflowmeter but I keep on getting traceback error that :'scapy.error.Scapy_Exception: tcpdump is not available', I know ...
Nehal Ahmed's user avatar
0 votes
0 answers
20 views

Requesting showing correct on TCPDump but application not responding

I have nginx running on port 80 when i check tcpdump it show requesting reaching the server but nginx page on port 80 does not get open on browser. What could be the issue?
shashank verma's user avatar
0 votes
0 answers
21 views

TCP dump ESP8266

greetings from Cuba. I am having problems dumping tcp packets using an ESP8266, all I am getting are the SSID of the wifi networks that are close to my actual location. I give the complete code if ...
Allan Ayes's user avatar
0 votes
0 answers
98 views

nginx 1.24.0 w/tls termination pcap

Running nginx 1.24.0 as a container on alpine. It's performing TLS termination for our backend endpoints on a single network interface. Performing a tcpdump to produce a PCAP to troubleshoot an ...
thepip3r's user avatar
  • 2,911
0 votes
1 answer
31 views

how to include wlan_logs in bugreport

I need tcpdump pcap files, but found that not all devices have this, is there any switcher in developer config ? I have tried setting log level to verbose, but still not work, what can I do next, thx! ...
Zen's user avatar
  • 1
0 votes
0 answers
160 views

Understanding the PCAPng file format

So i was trying to write a parser for the PCAPNG file format as a project and looked at its format from the following link:- https://pcapng.com/. If we move on to the section describing the packet ...
koiboi's user avatar
  • 133
0 votes
0 answers
61 views

How to Pipe `tcpdump` and the `until statement` into a Single and Working Shell Script?

I have composed the following script: sudo tcpdump -vv -n -s 0 -k NP | grep xx.xxx.xx.xx | until [[ '! xx.xxx.xx.xx' ]] do sleep 1 done killall -9 'Pages', where xx.xxx.xx.xx is a particular IP ...
viper_88's user avatar
-2 votes
1 answer
47 views

Troubleshooting network connectivity issues in a local network environment after adding dummy interface to the local subnet

As part of studying the network stack, I am conducting various experiments in a local network. Here's a question about one of them. In the local network, I have two devices, with addresses 192.168.1....
vglv's user avatar
  • 37
0 votes
0 answers
78 views

tcpdump -z flag problem for run a bash script file

I have executed the following command to run tcpdump: # tcpdump -r pcap.pcap -z ./bash.sh -C 1 My goal is to run the commands inside the bash.sh file when 1M of the file is read. But this is not ...
majidmc2's user avatar
1 vote
0 answers
79 views

Unable to preserve HTTP/2 headers list when extracting frame using editcap. Hex Dump Matches

When I used editcap to extract a HTTP/2 Frame from a Captured PCAP using tcpdump, the HTTP/2 headers don't show up in extracted frame, but the Hex dump matches. I am using the below editcap command to ...
Devavrat Agnihotri's user avatar
0 votes
1 answer
40 views

tcpcopy [warn] slide win:too many packs:50849,p:47872

when I used tcpcopy to replay tcp packets, I met the problem '[warn] slide win:too many packs:50849,p:47872'. And client connections are closed by tcpcopy. Command is listed below /opt/tcpcopy/sbin/...
hundun's user avatar
  • 1
0 votes
0 answers
146 views

Tcpdump captured traffic for GRE reassembled packets

Suppose there is a GRE tunnel logical interface (e.g. gre0) configured on Linux 4.6 kernel. sudo ip tunnel add gre0 mode gre remote 10.10.10.1 local 172.168.1.1 Execute tcpdump as follows tcpdump -i ...
Carlo C's user avatar
  • 169
0 votes
1 answer
55 views

how to close a tcpdump via paramiko

Using python, I'm making an SSH connection using paramiko and I'm sending a command which starts a tcpdump acquisition. command="tcpdump -i enp8s0f2 -w test_tcpdump.pcap" ssh = paramiko....
martinmistere's user avatar
0 votes
1 answer
398 views

Filtering for Quic Client Hello packets with tcpdump

I am able to filter for Client Hello messages for TLS on TCP with the following: (tcp[((tcp[12] & 0xf0) >> 2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >> 2) + 5] = 0x01) https://...
Geeson's user avatar
  • 61
0 votes
0 answers
104 views

Windows 2019 WMI RPC communication ISystemActivator-RemoteCreateInstace response not reaching source

In the project we do WMI queries for monitoring Windows nodes, these queries are failing as the RemoteCreateInstace response not reaching source WMI Client - CentOS 7(aiowmi) (Firewall disabled) WMI ...
user2264738's user avatar
0 votes
0 answers
254 views

Delay in sending TCP ACK

I have a TCP client application which connect to the TCP server and just process the data without sending any application layer data. In one of the issue I have received from my client, I found in the ...
Tech Dreamer's user avatar
0 votes
1 answer
315 views

is it possible to filter pcap files with tcpdump by relative sequence number ? want read pcap files of only first 10Mbyte per session

I must filter pcap files by the first xxx Bytes per session - using sequence number could be the method for it - but only if I can filter on relative numbers - eg. first 10KB of each session - filter ...
Andreas's user avatar
0 votes
0 answers
95 views

What is the relationship between TCP Connection and TCP Stream?

Gone through the couple of already discussed similar questions here but still not clear on the relationship between a "TCP Connection" & A Stream (Data) or May be TCP Sequence (which ...
Satendra Negi's user avatar
0 votes
0 answers
50 views

Netty client sends TCP RST

I see strange behaviour in Netty HTTP Client. It establishes connection to server fine, has some traffic but then sends RST out of blue. What could cause such behaviour? 22:20:03.954242 IP 10.15.12....
yurybubnov's user avatar
0 votes
0 answers
41 views

Php script running shell_exec to run sh scripts with tshark

I need to perform a packet capture operation during a process performed with wget If I run thark or tcpdump from the console everything works perfectly. However, if I call the sh script with ...
gc75's user avatar
  • 1
0 votes
1 answer
352 views

tcpkeep alive msg not seen in tcpdump

I am running below client server program which are communicating via local loopack address and try to capture the tcpdump output. Though program has specifically set for sending keep alive msg ...
myquest9 sh's user avatar
-2 votes
1 answer
365 views

python run tcpdump in remote server

(My purpose is to run tcpdump from python than exit the python script) I have to run tcpdump in remote server if i run tcp dump in generic syntax then my python program get stuck, if i run it in ...
Milan Paliwal's user avatar
1 vote
1 answer
553 views

Zabbix can't make connection to some zabbix-agents

Currently I'm creating new Zabbix installation (version 6.4.0). Zabbix server is up and running. Everything goes well, but for some host I wish to monitor I can't establish connection to Zabbix server....
Mac J's user avatar
  • 11
0 votes
1 answer
948 views

How to measure time taken to send and receive a message between two devices via a server on Wireshark

I am trying to use Wireshark to determine the amount of time it takes to send a message from one device and receive it from another device. I have Wireshark running for both, and I start Wireshark ...
Lia's user avatar
  • 1
1 vote
0 answers
63 views

Tracing network traffic from Parallels in Fiddler

My Setup Host: MacOS Sonoma Guest: Windows, running in Parallels Tracing: Fiddler Everywhere / tcpdump, running on host MacOS I'm trying to capture traffic from games running in my guest Windows ...
MrDuk's user avatar
  • 17.9k
0 votes
1 answer
57 views

How does TCP combine data when sending a big data packet which is over MSS?

Here is a tcpdump demo. seq 1 - 52001 is big data, over my loopback MSS (16384). seq 52001 - 52013 is small data. How does TCP know seq 1 - 52001 is a combined data block and seq 52001 - 52013 is ...
zhouzzz's user avatar
0 votes
1 answer
240 views

what is the meaning of 'P' in tcpdump outout?

I am using tcpdump -i eth0 udp cmd to sniff packets on an Ubuntu 22.04 system, and here is the output. 07:26:49.735591 eth_2_1 In IP 192.168.1.1.ntp > 10.0.3.2.ntp: NTPv6, symmetric active, length ...
QY-Y's user avatar
  • 41
1 vote
0 answers
273 views

How to write my TCPDump data from a pipeline in Linux to a pcap file?

So I am writing a program on a PLC where I need to constantly record network traffic with TCPdump into a Linux Pipeline. Every x minutes I need to write the data from the pipeline into a pcap file ...
BrenDs's user avatar
  • 11
2 votes
0 answers
347 views

Why can't we make tcpdump to not stop/exit when an interface on which it is capturing is brought down?

If tcpdump is started with -i <specific_interace_name> exits if that is brought down. However, if it is started with "-i any" option, it doesn't stop if wlanX/ethX interfaces are ...
Vaibhav S's user avatar
  • 147
0 votes
1 answer
346 views

tcpdump or tshark interfaces output in different files for different interfaces

I want to capture few network interfaces traffic and save output in files. I can capture and redirect one interface packets in one file, but can't capture few interfaces and save output to separate ...
Belfast's user avatar
0 votes
0 answers
298 views

How to see all Request URLs the server do usage

I need to install a software into a server that is not connected to the internet. I'll be able to access a part of internet during one day to do the installation. They are asking me the url/internet ...
coyote's user avatar
  • 304
0 votes
1 answer
173 views

Why is the HTTP responses inside my .pcap encrypted or unreadable? How do I fix this?

I am trying to troubleshoot a Python script and figure out what is happening with the HTTP requests and cookies and responses the script is getting. I used tcpdump -w to capture the data, and it ...
espresso fan's user avatar
0 votes
0 answers
402 views

How to use tcpdump to capture a HTTP Post request filter by string match in response?

I'm trying to capture a HTTP request to debug my application. I'm not sure what tool can achieve that so I'm not sure where to start. I have used Wireshark, tcpdump in the past but to my knowledge ...
toy's user avatar
  • 12.1k
0 votes
0 answers
720 views

How can I obtain the name of the TLS fingerprint algorithm with tcpdump and tshark?

I have a web service and I want to get the tls fingerprint from the client hello package requested by the client. What should I do I have tried using nginx-ssl-fingerprint(https://github.com/phuslu/...
geekbyte's user avatar
0 votes
0 answers
872 views

How to filter out TCP retransmission packets using tcpdump

I have a pcap file which I am analyzing. Basically in this file there are some TCP Retransmission packets which I want to filter out and leave the others. I know how to do it in wireshark using: not ...
user14073111's user avatar
0 votes
2 answers
796 views

capture network traffic and send to a remote machine

I am trying to capture network traffic with tcpdump from a machine in the network and send each packet over the network to another device. I cannot save the packets captured by tcpdump in a file, ...
Firouziam's user avatar
  • 805
4 votes
1 answer
2k views

Is there a working solution to open pcap files in VS Code?

I am currently connected via VS Code ssh to a remote machine running some program. I want to open and view the produced pcap files on this machine through VS Code on my local machine and by that ...
Lars 's user avatar
  • 41
0 votes
1 answer
453 views

How can I modify packets read from pcap file using Pyshark and save it in new pcap file?

I am trying to read packets from input.pcapng file and modified the packets as shown below. I want to save the list of these packets in new pcap file. Please let me know on how to proceed. import ...
bhalachandra bhat's user avatar
1 vote
1 answer
595 views

piping tcpdump from a docker container to local macOS Wireshark instance

I've attached a tcpdump sidecar to one of my containers and I'm trying feed the capture into a local instance of Wireshark on macOS. This kicks back pretty much as soon as it starts, with the Frame 1 ...
Jason's user avatar
  • 462
0 votes
1 answer
656 views

How to identify what packet belongs to what TCP connection in tcpdump

I have a sample tcp dump. How do I identify which packets belongs to which TCP connection. I know in this case there are two connections (between the same source and destination), well separated by ...
Parth Singh's user avatar
0 votes
1 answer
659 views

Parsing .pcap file with rdpcap() takes long time

We used tftp protocol and ethernet cable to send a media file to our remote device. At same time we used tcpdump tool at out remote device.So we saved the communication to a .pcap file. tcpdump ...
Mert Gökhan Gönen's user avatar
0 votes
1 answer
197 views

program other than apache listen on 3000 for https (ProxyPassReverse)

I am trying to get fastify listen on port 3000 for https requests . Fastify is listening on port 3000 , but when I am trying to send a curl command curl -k https://example.com:3000/ -v , I am getting ...
user1207289's user avatar
  • 3,193
0 votes
0 answers
592 views

Using bash to receive UDP packet payloads with source address and port?

I need to listen for UDP packets, which could come from any address and any port to my listening UDP ports. In my bash script I need to take action based on, the source address, the source port and ...
Shodan's user avatar
  • 1,118

1
2 3 4 5
21