-1

I have runtime Linux running in a PLC. My development machine is running Ubuntu 14.04. The PLC and the development machine are connected through a five port switch. I ssh to PLC from my development machine to transfer executable of a networking application that I develop on my development machine.

I run tcpdump on PLC to debug the kind of packets my network application is receiving BUT as soon as I start tcpdump, there starts a flood of ssh sync and acks back and forth from my ubuntu machine to the PLC. The LED lights of ethernet controller of PLC as well on the switch start blinking rapidly. The flood overwhelms the PLC and it almost dies down while all other packets get dropped. It feels like a DOS attack whenever I run tcpdump but as soon as I stop tcpdump, everything calms down and gets back to the normal.

I would like know remedy on this problem and why it happens?

Any help would be appreciated.

awatan
  • 101
  • 1
  • 4
  • 3
    My guess is that you simply run tcpdump without any restrictions to port and that it therefore also captured the traffic of your SSH connection, leading to more output which then leads to more things to capture leading to even more output .... . Of course, this is only a theory since you don't specify the command line used for running tcpdump. – Steffen Ullrich Nov 12 '18 at 05:30
  • You are right. I am actually running tcpdump without any restrictions. My command is just > tcpdump -i eth0. but what I dont understans it why running tcpdump suddenly esclates to huge amount of traffic. – awatan Nov 12 '18 at 05:56

1 Answers1

8

My command is just > tcpdump -i eth0. but what I dont understans it why running tcpdump suddenly esclates to huge amount of traffic.

Try facing a mirror at a mirror, you'll get the idea. If not, try facing a mirror and a mirror and preventing the mirror from seeing itself.

Because your SSH traffic is also part of the capture that is being captured and reported via the your SSH session. Sure, because it is encrypted means you can't see anything inside the SSH packet, but when tcpdump prints out the headers for a packet to your terminal, those changes to your terminal are being transmitted over the network. But those changes being transmitted over the network is going to cause more data over the network to be captured/displayed/etc.

Anyway, solution filter out ssh from your capture, or the client machine, or both. Also setting the -n option to prevent tcpdump from performing DNS lookups and also polluting your capture with DNS requests/replies that have nothing to do with actual activity.

tcpdump -ni eth0 not port 22
tcpdump -ni eth0 not host ip.of.the.sshclient
tcpdump -ni eth0 not host ip.of.the.sshclient and not port 22
Zoredache
  • 130,897
  • 41
  • 276
  • 420