1,046
questions
0
votes
0
answers
24
views
OCI VTAP traffic mirroring
I am running tcpdump to capture mirrored traffic on compute node behind the target NLB of VTAP. When I use the Max Packet Size on the VTAP to be 1000, my pcaps when viewed in wireshark show for almost ...
-1
votes
0
answers
29
views
HikariPool-1 - Connection is not available, request timed out after 30001ms And tcpdump got no packets
I'm using springboot 2.3.12 with HikariCP 3.4.5 and my databse is postgresql.
The project started well but after some hours the HikariCP will throw Exception: HikariPool-1 - Connection is not ...
0
votes
0
answers
45
views
Does Azure firewall drop packets with SYN+ECE_CWR flags set
There are tcp retransmissions after SYN+ECE+CWR transmission. I want to know whether you have experienced a behavior where azure firewall silently dropping packets like this intermittently.
Unable to ...
1
vote
1
answer
69
views
tcpdump does not capture all packets at high packet frequency
Let’s say, there is some TCP (unencrypted) traffic you would like to eavesdrop packets and send them somewhere else. You don’t want to interrupt the traffic or interfere to its parts, just eavesdrop ...
0
votes
0
answers
22
views
TCPDUMP file for a ping command execution
Guys,
We have here in TCPDUMP file displayed by Wireshark. It corresponds to a ping from 192.168.30.18 to 192.168.0.100, eg
ping 192.168.0.100
How to understand that ping result is 0% packets loss, ...
0
votes
0
answers
17
views
Slow localhost response time when connected to wifi
We have a React/Django app with docker-compose at work. Any request to localhost takes 8 seconds: ab -n1 http://localhost:8080/
This is ApacheBench, Version 2.3 <$Revision: 1879490 $>
Copyright ...
0
votes
1
answer
26
views
Problem with using IPPROTO_RAW with source address filled in when zero
https://man7.org/linux/man-pages/man7/raw.7.html
I am using IPPROTO_RAW to send my tcp packet
I spefic 0.0.0.0 to source address, so linux kernel will auto fill, and ip checksum auto filled in.
I can'...
1
vote
0
answers
56
views
tcpdump is not available when extracting packet features in windows
I have been trying to extract statistical features from a packet(pcap) using pyflowmeter but I keep on getting traceback error that :'scapy.error.Scapy_Exception: tcpdump is not available', I know ...
0
votes
0
answers
20
views
Requesting showing correct on TCPDump but application not responding
I have nginx running on port 80
when i check tcpdump it show requesting reaching the server but nginx page on port 80 does not get open on browser.
What could be the issue?
0
votes
0
answers
21
views
TCP dump ESP8266
greetings from Cuba. I am having problems dumping tcp packets using an ESP8266, all I am getting are the SSID of the wifi networks that are close to my actual location. I give the complete code if ...
0
votes
0
answers
98
views
nginx 1.24.0 w/tls termination pcap
Running nginx 1.24.0 as a container on alpine. It's performing TLS termination for our backend endpoints on a single network interface. Performing a tcpdump to produce a PCAP to troubleshoot an ...
0
votes
1
answer
31
views
how to include wlan_logs in bugreport
I need tcpdump pcap files, but found that not all devices have this, is there any switcher in developer config ? I have tried setting log level to verbose, but still not work, what can I do next, thx! ...
0
votes
0
answers
160
views
Understanding the PCAPng file format
So i was trying to write a parser for the PCAPNG file format as a project and looked at its format from the following link:- https://pcapng.com/. If we move on to the section describing the packet ...
0
votes
0
answers
61
views
How to Pipe `tcpdump` and the `until statement` into a Single and Working Shell Script?
I have composed the following script:
sudo tcpdump -vv -n -s 0 -k NP | grep xx.xxx.xx.xx | until [[ '! xx.xxx.xx.xx' ]] do sleep 1 done killall -9 'Pages',
where xx.xxx.xx.xx is a particular IP ...
-2
votes
1
answer
47
views
Troubleshooting network connectivity issues in a local network environment after adding dummy interface to the local subnet
As part of studying the network stack, I am conducting various experiments in a local network. Here's a question about one of them.
In the local network, I have two devices, with addresses 192.168.1....
0
votes
0
answers
78
views
tcpdump -z flag problem for run a bash script file
I have executed the following command to run tcpdump:
# tcpdump -r pcap.pcap -z ./bash.sh -C 1
My goal is to run the commands inside the bash.sh file when 1M of the file is read. But this is not ...
1
vote
0
answers
79
views
Unable to preserve HTTP/2 headers list when extracting frame using editcap. Hex Dump Matches
When I used editcap to extract a HTTP/2 Frame from a Captured PCAP using tcpdump, the HTTP/2 headers don't show up in extracted frame, but the Hex dump matches.
I am using the below editcap command to ...
0
votes
1
answer
40
views
tcpcopy [warn] slide win:too many packs:50849,p:47872
when I used tcpcopy to replay tcp packets, I met the problem '[warn] slide win:too many packs:50849,p:47872'. And client connections are closed by tcpcopy.
Command is listed below
/opt/tcpcopy/sbin/...
0
votes
0
answers
146
views
Tcpdump captured traffic for GRE reassembled packets
Suppose there is a GRE tunnel logical interface (e.g. gre0) configured on Linux 4.6 kernel.
sudo ip tunnel add gre0 mode gre remote 10.10.10.1 local 172.168.1.1
Execute tcpdump as follows tcpdump -i ...
0
votes
1
answer
55
views
how to close a tcpdump via paramiko
Using python, I'm making an SSH connection using paramiko and I'm sending a command which starts a tcpdump acquisition.
command="tcpdump -i enp8s0f2 -w test_tcpdump.pcap"
ssh = paramiko....
0
votes
1
answer
398
views
Filtering for Quic Client Hello packets with tcpdump
I am able to filter for Client Hello messages for TLS on TCP with the following:
(tcp[((tcp[12] & 0xf0) >> 2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >> 2) + 5] = 0x01)
https://...
0
votes
0
answers
104
views
Windows 2019 WMI RPC communication ISystemActivator-RemoteCreateInstace response not reaching source
In the project we do WMI queries for monitoring Windows nodes, these queries are failing as the RemoteCreateInstace response not reaching source
WMI Client -
CentOS 7(aiowmi) (Firewall disabled)
WMI ...
0
votes
0
answers
254
views
Delay in sending TCP ACK
I have a TCP client application which connect to the TCP server and just process the data without sending any application layer data.
In one of the issue I have received from my client, I found in the ...
0
votes
1
answer
315
views
is it possible to filter pcap files with tcpdump by relative sequence number ? want read pcap files of only first 10Mbyte per session
I must filter pcap files by the first xxx Bytes per session - using sequence number could be the method for it - but only if I can filter on relative numbers - eg. first 10KB of each session - filter ...
0
votes
0
answers
95
views
What is the relationship between TCP Connection and TCP Stream?
Gone through the couple of already discussed similar questions here but still not clear on the relationship between a "TCP Connection" & A Stream (Data) or May be TCP Sequence (which ...
0
votes
0
answers
50
views
Netty client sends TCP RST
I see strange behaviour in Netty HTTP Client.
It establishes connection to server fine, has some traffic but then sends RST out of blue.
What could cause such behaviour?
22:20:03.954242 IP 10.15.12....
0
votes
0
answers
41
views
Php script running shell_exec to run sh scripts with tshark
I need to perform a packet capture operation during a process performed with wget
If I run thark or tcpdump from the console everything works perfectly. However, if I call the sh script with ...
0
votes
1
answer
352
views
tcpkeep alive msg not seen in tcpdump
I am running below client server program which are communicating via local loopack address and try to capture the tcpdump output. Though program has specifically set for sending keep alive msg ...
-2
votes
1
answer
365
views
python run tcpdump in remote server
(My purpose is to run tcpdump from python than exit the python script)
I have to run tcpdump in remote server if i run tcp dump in generic syntax then my python program get stuck, if i run it in ...
1
vote
1
answer
553
views
Zabbix can't make connection to some zabbix-agents
Currently I'm creating new Zabbix installation (version 6.4.0). Zabbix server is up and running. Everything goes well, but for some host I wish to monitor I can't establish connection to Zabbix server....
0
votes
1
answer
948
views
How to measure time taken to send and receive a message between two devices via a server on Wireshark
I am trying to use Wireshark to determine the amount of time it takes to send a message from one device and receive it from another device.
I have Wireshark running for both, and I start Wireshark ...
1
vote
0
answers
63
views
Tracing network traffic from Parallels in Fiddler
My Setup
Host: MacOS Sonoma
Guest: Windows, running in Parallels
Tracing: Fiddler Everywhere / tcpdump, running on host MacOS
I'm trying to capture traffic from games running in my guest Windows ...
0
votes
1
answer
57
views
How does TCP combine data when sending a big data packet which is over MSS?
Here is a tcpdump demo.
seq 1 - 52001 is big data, over my loopback MSS (16384).
seq 52001 - 52013 is small data.
How does TCP know seq 1 - 52001 is a combined data block and seq 52001 - 52013 is ...
0
votes
1
answer
240
views
what is the meaning of 'P' in tcpdump outout?
I am using tcpdump -i eth0 udp cmd to sniff packets on an Ubuntu 22.04 system, and here is the output.
07:26:49.735591 eth_2_1 In IP 192.168.1.1.ntp > 10.0.3.2.ntp: NTPv6, symmetric active, length ...
1
vote
0
answers
273
views
How to write my TCPDump data from a pipeline in Linux to a pcap file?
So I am writing a program on a PLC where I need to constantly record network traffic with TCPdump into a Linux Pipeline. Every x minutes I need to write the data from the pipeline into a pcap file ...
2
votes
0
answers
347
views
Why can't we make tcpdump to not stop/exit when an interface on which it is capturing is brought down?
If tcpdump is started with -i <specific_interace_name> exits if that is brought down.
However, if it is started with "-i any" option, it doesn't stop if wlanX/ethX interfaces are ...
0
votes
1
answer
346
views
tcpdump or tshark interfaces output in different files for different interfaces
I want to capture few network interfaces traffic and save output in files. I can capture and redirect one interface packets in one file, but can't capture few interfaces and save output to separate ...
0
votes
0
answers
298
views
How to see all Request URLs the server do usage
I need to install a software into a server that is not connected to the internet. I'll be able to access a part of internet during one day to do the installation.
They are asking me the url/internet ...
0
votes
1
answer
173
views
Why is the HTTP responses inside my .pcap encrypted or unreadable? How do I fix this?
I am trying to troubleshoot a Python script and figure out what is happening with the HTTP requests and cookies and responses the script is getting. I used tcpdump -w to capture the data, and it ...
0
votes
0
answers
402
views
How to use tcpdump to capture a HTTP Post request filter by string match in response?
I'm trying to capture a HTTP request to debug my application. I'm not sure what tool can achieve that so I'm not sure where to start. I have used Wireshark, tcpdump in the past but to my knowledge ...
0
votes
0
answers
720
views
How can I obtain the name of the TLS fingerprint algorithm with tcpdump and tshark?
I have a web service and I want to get the tls fingerprint from the client hello package requested by the client. What should I do
I have tried using nginx-ssl-fingerprint(https://github.com/phuslu/...
0
votes
0
answers
872
views
How to filter out TCP retransmission packets using tcpdump
I have a pcap file which I am analyzing. Basically in this file there are some TCP Retransmission packets which I want to filter out and leave the others. I know how to do it in wireshark using:
not ...
0
votes
2
answers
796
views
capture network traffic and send to a remote machine
I am trying to capture network traffic with tcpdump from a machine in the network and send each packet over the network to another device. I cannot save the packets captured by tcpdump in a file, ...
4
votes
1
answer
2k
views
Is there a working solution to open pcap files in VS Code?
I am currently connected via VS Code ssh to a remote machine running some program. I want to open and view the produced pcap files on this machine through VS Code on my local machine and by that ...
0
votes
1
answer
453
views
How can I modify packets read from pcap file using Pyshark and save it in new pcap file?
I am trying to read packets from input.pcapng file and modified the packets as shown below. I want to save the list of these packets in new pcap file. Please let me know on how to proceed.
import ...
1
vote
1
answer
595
views
piping tcpdump from a docker container to local macOS Wireshark instance
I've attached a tcpdump sidecar to one of my containers and I'm trying feed the capture into a local instance of Wireshark on macOS.
This kicks back pretty much as soon as it starts, with the Frame 1 ...
0
votes
1
answer
656
views
How to identify what packet belongs to what TCP connection in tcpdump
I have a sample tcp dump. How do I identify which packets belongs to which TCP connection. I know in this case there are two connections (between the same source and destination), well separated by ...
0
votes
1
answer
659
views
Parsing .pcap file with rdpcap() takes long time
We used tftp protocol and ethernet cable to send a media file to our remote device.
At same time we used tcpdump tool at out remote device.So we saved the communication to a .pcap file.
tcpdump ...
0
votes
1
answer
197
views
program other than apache listen on 3000 for https (ProxyPassReverse)
I am trying to get fastify listen on port 3000 for https requests . Fastify is listening on port 3000 , but when I am trying to send a curl command curl -k https://example.com:3000/ -v , I am getting ...
0
votes
0
answers
592
views
Using bash to receive UDP packet payloads with source address and port?
I need to listen for UDP packets, which could come from any address and any port to my listening UDP ports.
In my bash script I need to take action based on, the source address, the source port and ...