Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [tcpdump]

tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.

466 questions
0
votes
0 answers

connection is paused for long

a redis server is running in a different network namespace. I'm trying to connect a client to the redis server, it keeps waiting but is not getting response, its been hours. Client side code: int main(){ // ***** Pipeline ***** auto…
user14610638
  • 21
  • 3
0
votes
1 answer

Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump

Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet? The server was sending messages to the client At time 10,the server sent message 100 At time 20, the server sent…
PasanW
  • 133
  • 1
  • 6
0
votes
1 answer

Where does tcpdump get the source IP from for a TCP packet?

I've been trying to come up with a solution for a routing problem (multiple interfaces connected to a single Docker container, ensuring response packets go out the right interface), and have come across an interesting observation: while using TRACE…
Jumail Mundekkat
  • 1
  • 1
0
votes
0 answers

Identify Source / Trigger of / for Network Traffic locahost

I want to identify the application trat triggers network traffic like the one below. I have dissabled ethernet and wireless cards, and denied incoming traffic in firewall. $ sudo tcpdump -vv -e -A -i any 04:26:45.584729 in 00:00:00:00:00:00 (oui…
u20200411
  • 3
  • 2
0
votes
1 answer

openvpn dual install (client and server) routing problem

I have the following install: PROD net (10.88.88.0/24) OFFICE net (192.168.2.0/24) on PROD I have openvpn server (vpnprod), so OFFICE can connect. on OFFICE I have openvpn machine (vpnoffice) which runs both openvpn server to allow external users,…
Sunny
  • 5,834
  • 3
  • 22
  • 24
0
votes
2 answers

Packets dropped somewhere between network interface and iptables when forwarded from router

I have a server configured with multiple interfaces and multiple VLANs. It works perfectly fine for all the local networks, it drops packets forwarded through my router for some reason though. And it's not even consistent. Sometimes I can get it…
Bryan Austin
  • 107
  • 2
  • 9
0
votes
1 answer

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine or into port 12345 on the local machine. The…
intelfx
  • 134
  • 7
0
votes
0 answers

Wireshark TLS conversation for ldaps

I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark. Here is what I get from client side on a conversation with delays: I see the following problems: I see no ServerHello response (this happens for all…
trikelef
  • 518
  • 1
  • 7
  • 26
0
votes
1 answer

Trying to capture 3-way handshake in linux

I am trying to capture 3-way handshake using the following in linux, it does not seems to work... sudo tcpdump "tcp[tcpflags] & (tcp-syn) !=0" -w filename.pcap -i eth0 Could you someone suggest me an edit to it??
Chi
  • 11
  • 1
0
votes
1 answer

Proxy service only responding on some IP addresses (others suck on SYN_RECV)

I have a server using a proxy service (WAF etc) which forwards packets to my server. I can see established SSL conenctions from all proxy netstat -an and the rest stuck in SYN_RECV: tcp 0 0 192.168.102.11:443 185.93.230.20:64966 …
morleyc
  • 1,150
  • 13
  • 47
  • 89
0
votes
0 answers

Duplicate ACK and TCP Retransmissions

I'm doing some scp transfers between an AIX and a Linux in two separated LAN (I have a VPN between them). Sometimes the connection ends well, so I get 50MB/s. In many other cases, instead, the connections starts fast and then drops until it ends…
ubu389
  • 1
  • 1
0
votes
1 answer

Why is an interface ignored by -i any with tcpdump/wireshark?

Using tcpdump and wireshark, if I capture with -i enp1s0f0, no problem I can see the packets. If I capture with -i any, I don't see the enp1s0f0's packets. Why? Is there a NetworkManager option or something that discards that interface?
Alexis
  • 172
  • 1
  • 12
0
votes
1 answer

How do I capture packets on a Linux VM in a VMware environment?

I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the traffic generated by the server, and not the…
le_jawa
  • 113
  • 1
  • 7
-1
votes
1 answer

Traffic on port 80 although Http-Server is not running

Good'day Just out of curiosity I did a tcpdump port 80 on one of my remote virtual machines. I see a huge amount of requests to this http-port, 95% going to some AWS EC2 instance. Strange thing: The Web-Server was not on high load at all. The…
n.r.
  • 289
  • 1
  • 2
  • 10
-1
votes
1 answer

Running tcpdump starts ssh flood

I have runtime Linux running in a PLC. My development machine is running Ubuntu 14.04. The PLC and the development machine are connected through a five port switch. I ssh to PLC from my development machine to transfer executable of a networking…
awatan
  • 101
  • 1
  • 4
1 2 3
…
31 32