Networking :: Tcpdump Not Writing Raw Packets With Write Switch?

Nov 21, 2010

I am trying dump some packets using tcpdump and it does not seem to be working.

System is fedora12
TCPDUMP v4.1
Libpcap v1.0
I even rolled my own,
TCPDUMP v4.1.1
libpcap v1.1.1

View 1 Replies


ADVERTISEMENT

Networking :: Tcpdump -w Not Writing Data?

Oct 18, 2010

I'm trying to capture packets to a file with the -w option but the file is empty yet if I use the '-w -' option to put data on stdout I see plenty of captured packets.I'm using CentOS 5.5 x86

Code:
[root@server ~]# tcpdump -v -i eth0 -w dump -s0
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

[code]....

View 2 Replies View Related

General :: Networking - Interface Stops Receiving Packets As Seen By Tcpdump

Mar 30, 2011

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN.

There is an IP configured on eth1.

eth0 is up but no IP is configured. This interface is used for sniffing with tcpdump.

The problem is that eth0 frequently stops receiving packets -- my tcpdump captures are empty, and if I look at the interface stats with ifconfig, I can see that no packets are received.

If I bounce the interface (ifconfig eth0 down; ifconfig eth0 up), it starts receiving packets again.

View 1 Replies View Related

Programming :: Write A Program In C That Can Sniff Packets From Ethernet And Distinguish RTP Packets From Non-RTP Packets?

Aug 30, 2010

i need to write a program in c that can sniff packets from Ethernet and distinguish RTP packets from Non-RTP packets, i have no idea what should i do

View 9 Replies View Related

General :: Tcpdump Decode Gzip Packets?

Mar 11, 2010

Does gzip have the capability to decode gzipped traffic? I have been beating my head against the wall with this issue. What I'm trying to do is capture traffic between a web server and clients, and I've got it set up where it's redirected to a file for ease of grepping, however it's seemingly incapable of decoding gzipped encoding. I know I can do this with tshark, I'm curious as to whether tcpdump has this capability (i.e. only using tcpdump, and not some additional tool like tcpshow or what-not).

I can't find much on this issue in the man page for tcpdump, but it is fairly lengthy, so it's possible that I missed something, but I don't see that as especially likely.

View 2 Replies View Related

General :: Capture Packets From Multiple Host Through Tcpdump?

Apr 27, 2010

What is the syntax to capture packets from multiple host through tcpdumptcpdump ip host host1|host2|host3|host3

View 3 Replies View Related

Ubuntu Security :: Tcpdump: Filtering For Packets From A Site With Mulitple Ip Addresses?

Aug 13, 2011

I want to capture all packets from site "www.examplesite.com" so I checked its ip address in an ip address look up and it was 123.456.abc.def.So I set my filter to "dst host 23.456.abc.def"However I then realised that multiple ip address point to ww.examplesite.com, for example say the following ips also go to987.654.321.000111.222.333.444So is there a filter that will automatically capture all traffic going to www.examplesite.com or do I have to go and manually find all it's ip addresses and pass them all to the filter?

View 2 Replies View Related

SUSE :: Sniffing With TCPDUMP Or Tshark - Get No Packets Back When Specify A Host To Watch

Nov 23, 2010

If I am sniffing with TCPDUMP or tshark, I have an issue. If I specify a host to watch, I get no packets back, but if I don't specify a host, I get all traffic, including the host traffic I was filtering for the first time. ?? IE: If I: tcpdump -vnnXs 1514 -i bond0 I see all traffic and traffic to x.x.x.x But if I: tcpdump -vnnXs 1514 -i bond0 host x.x.x.x I see no traffic.

View 1 Replies View Related

Networking :: Write Network Packets To Memory In Byte Format?

Feb 7, 2011

I'm sniffing network packets in ubuntu, I need to write these packets as raw bytes to memory but libpcap give packets in its special format. how can i save and recover packets in byte format?

View 2 Replies View Related

Networking :: Firewall - Allow Packets Coming From Internet After Authenticating And To By Pass Packets Generated From Internal LAN?

Feb 8, 2010

i have a linux server runnig oracle applications. i need to access this server from putty using ssh through internet. i did by registering my static ip with the dnydns.org and i am able to connect to the server. but now there is no security to authenticate any user as any one knowing the password can login to it.

i thought of configuring the firewall of linux server but the client ip`s are not static and they change continiously. so thought of keeping one more pc between the server and the router which will do the work of authenticating. but i am confuse as how to configure it to allow the packets coming from the internet after authenticating and to by pass the packets generated from internal LAN?

View 8 Replies View Related

Security :: Write A Specific Rule To Check For Spoofed Packets?

Apr 21, 2010

Just wanted input for this script i have cobbeled together. Its not done yet. I am trying to think of ways to close up my outgoing while maintaining full functionality of my laptop ( irc, web stuff, a torrent or two, etc.) . Anyways, I have done some myself; as well as, pulling bits and pieces from other stuff out on the web. I am starting to wonder why i have to write a specific rule to check for spoofed packets if my default input is set top drop. wouldnt it be caught?

Code:
#!/bin/bash
### Laptop + Desktop: No Forwarding firewall ip4 / ip6
### Distro > Debian / Ubuntu.
### oliverteasley@gmail.com

[Code]....

View 12 Replies View Related

Server :: Why Are 3 IOs Produced By Writing One Byte Via Write()

Jun 3, 2011

i play around with c for producing some io to a san-disk and struggle with basics here. :-(

if i'm using the write()-call to write 1 byte to a file on the disk iostat tells me i'm producing 3 writes. if i write 1 byte twice a second, it tells me i produce 6 writes (w/s).

View 8 Replies View Related

Debian Hardware :: Blu-ray Writing - Wheezy Can Read But Not Write CD / DVD / BR

Feb 18, 2014

I am trying to get Debian 7.4 to burn 50Gb Blueray disks for backups using K3b. The GUI based program is important.

The reason I am using Linux Kernel 3.12-0.bpo.1-amd64 is that I am running an i7-4770K CPU and the motherboard a Supermicro c7-z87-oce (NO overclocking) and 32G RAM. I have had no other problems since using the backported kernel and turning off the onboard graphics and using an nvidia G210 graphics card.

The Pioneer BDR-209M CD/DVD/Blueray burner reads CDs and DVDs to the extent I am able to install Wheezy, and then use a backported kernel. However, it will not write CD's, DVD's and it won't recognize Blueray disks.

I have spent some time weeding through conflicting information and I wanted to verify there is not a work around. I have downloaded and installed the current version of cdrecord to no avail. I have completely removed everything CD/DVD/Blueray related and reinstalled, also to no avail.

Then I came across this statement from: [URL] ....

In all programs of the fork that send SCSI commands, you may be unable to access any of the CD/DVD/Blu-Ray drives at all if you are on Linux-2.6.8.1 or later. This is due to a missing workaround for the Linux kernel interface change that happened with Linux-2.6.8.1.

View 14 Replies View Related

General :: Make Iptables To Write Only To Log Without Writing To Console?

Aug 25, 2010

when I use LOG action in some chane of iptables rules, I get the output both in STDOUT or STDERR of the xm console and in /var/log/messages.

Is there way to make iptables to write only to log without writing to console?

View 3 Replies View Related

Programming :: Perl - Writing To File - Keep Open Or Only During Write?

May 24, 2011

i am working on this thread: [URL] if it is better to open a file every time i need to write to it or should i keep a file open the whole time and when i am done with the script, close it and sendmail it out?

Or i just thought of this: i could keep concatenating to a string and just sendmail when done.

View 2 Replies View Related

General :: Removing Write Permission Does Not Prevent Root From Writing To File

Feb 3, 2010

I just noticed on my Ubuntu machine (ext3 filesystem) that removing write permissions from a file does not keep root from writing to it. Is this a general rule of UNIX file permissions? Or specific to Ubuntu? Or a misconfiguration on my machine? Writing to the file fails (as expected) if I do this from my normal user account.Is this normal behavior?Is there a way to prevent root from accidentally writing to a file (Preferably using normal filesystem mechanisms, not AppArmor, etc.)

I understand that root has total control over the system and can, eg, change the permissions on any file.My question is whether currently set permissions are enforced on code running as root. The idea is the root user preventing her/himself from accidentally writing to a file. also understand that one should not be logged in as root for normal operations.

View 4 Replies View Related

Networking :: Kernel - Forward Packets From Eth0 To Eth1 And Eth1-to Eth0 As Well As Get A Copy Of These Packets For Analysis

Sep 27, 2010

I have a hardware device with two ethernet ports, eth0 and eth1 running Centos 5. Basically my goal is to forward packets from eth0->eth1 and eth1->eth0 as well as get a copy of these packets for analysis. If I set IP routing to do the forwarding then I won't get a copy of the packets for analysis.

View 3 Replies View Related

Networking :: How To Create Dump Log Using TCPdump

Dec 7, 2010

I am trying to create a dump log using tcpdump. I want display the top 10 ip addresses sorted numerically showing how many times the ips are hitting the server. I'm getting frustrated because It's not working how I'd like it to.

View 1 Replies View Related

Networking :: Using Multiple Interfaces For Tcpdump?

Feb 16, 2011

Is there a way to do multiple interfaces in tcpdump? I have found that when using "-i any", not all packets are captured (compared to "-i eth0" on a machine with only one interface). I need to monitor traffic on some machines with as many as 6 interfaces, and get these packets that "-i any" misses. When I give the "-i" option multiple times, it seems to only use the last one.

View 3 Replies View Related

Slackware :: Write A Script To Switch Between Different Network Configuration?

May 8, 2010

I am running Slackware 12.2.
I have checked the file like /etc/rc.d/rc.inet1.conf, and the command 'ip' or 'ifconfig', but still can not figure out how to write a script to switch between two network configurations easily.

Suppose that one configuration uses DHCP server to dynamically give the ip address, and uses a Default Gateway 1.1.1.1, a net mask 1.0.0.0, a DNS server 1.1.1.0;
and in another configuration the Ip address is fixed, and use a Default Gateway 2.2.2.2, a net mask 2.0.0.0, a DNS server 2.2.2.0;
Anyone would like to give me a hint on how to write one (or two separate) script(s) to switch between these two settings?

View 4 Replies View Related

Networking :: Rotating Capture Files Using Tcpdump?

Apr 6, 2010

I would like to set up tcpdump to rotate log file every 1 hour and retain files for the lat 14 days but I don't think any combination of -C and -W would allow me to do that (Atleast I haven't been able to figure it out), so I am trying to rotate the files every X number of MB and retain the last 20 files. This seems to be fairly simple with the '-C X -W 20' option but I am having some trouble in customizing the names of the log files. I have tried '-w capture-$(date +%Y-%M-%d-%H:%M-)' thinking that each file would start with the current date and time but all files are using the date and time when the capture was started so the only difference is the number at the end (which is done by -W). if I can customize the names of the file so that it has the date and time when the capture in started. In fact if I can do that, I dont need the numbers that '-W' appends at the end but I dont know how to get rid of them.

View 4 Replies View Related

Networking :: Tcpdump - No Suitable Device Found?

May 27, 2010

I'm running NetWare SLES 10 sp3 with OES2 sp2. I was working with the folks at Novell to resolve an iPrint Print Manager problem.

During the process they wanted to perform a packet capture using tcpdump. While logged in as the root user the error no suitable device was found, and I received no data at all. This server is running on a VMWare Center. On other SLES 10 sp3 systems (residing on that same VMWre Center), tcpdump captures packets just fine. I inherited all of these servers, so I wasn't here during the initial build, but I'd make the guess that they were configured similarly. On a Server that I built recently, tcpdump works fine. On two of my Servers it does not, and gives the mentioned error.

It's not that big a deal, otherwise the Servers are communicating and working just fine. But, I'd like to get it working just because it's supposed to work. Students are off for the summer, so I have time to play.

View 5 Replies View Related

Ubuntu Networking :: Tcpdump Shows Lots Of Activity

Jan 24, 2011

The only window that's open is the terminal running this command, no pidgin, skype, samba, torrent or anything I can think of is using the network yet there is ***** load of output from tcpdump. I was hoping to use this to check where certain applications connect to and what messages they send but when I'm doing nothing there is already more output than I can go through. Running tcpdump for less than 10 seconds gives me the following output:

Code:
16:13:22.015683 IP ns.hihkptt.net.cn.domain > desk.local.56598: 46887 1/2/2 (166)
16:13:22.016251 IP ns.hihkptt.net.cn.domain > desk.local.60099: 21168 1/2/2 (166)
16:13:22.016743 IP ns.hihkptt.net.cn.domain > desk.local.42325: 50346 1/2/2 (166)
16:13:22.034733 IP ns.hihkptt.net.cn.domain > desk.local.41441: 63658 1/2/0 (134)
16:13:22.035215 IP ns.hihkptt.net.cn.domain > desk.local.42865: 37537 1/2/0 (134)
16:13:22.036124 IP ns.hihkptt.net.cn.domain > desk.local.35006: 7520 1/2/0 (134)
16:13:22.036569 IP ns.hihkptt.net.cn.domain > desk.local.38480: 51322 1/2/0 (134)
16:13:22.066006 ARP, Reply 192.168.0.1 is-at 00:b0:0c:02:60:9c (oui Unknown), length 46 .....

View 2 Replies View Related

CentOS 5 Networking :: Tcpdump Error With NFS Port Sniffing

Feb 16, 2010

I have configured NFS Server on CentOS 5.2 with IBM Web Server,which is having AIX 5.3 The IBM Web Server can upload all data onto NFS Server. Now, Today i was having slow response on IBM Web Server & by measuring the NFS, i found below error while running "tcpdump" command on CentOS Server.

tcpdump -n -i eth1 | grep 2049
18:36:37.237451 IP 10.100.19.241.2049 > 10.100.19.88.1758143293: reply ok 1448 read [|nfs]
18:36:37.237476 IP 10.100.19.241.2049 > 10.100.19.88.539981409: reply ERR 1448
18:36:37.237481 IP 10.100.19.241.2049 > 10.100.19.88.796287348: reply ERR 1448

[code]....

I have changed Network Card in CentOS. All LAN is on Gigabit Network. Also I have changed the Network Cable(Patch Cord). But,still no response.

View 3 Replies View Related

Networking :: Packet Drop Measured By Ethtool, Tcpdump And Ifconfig?

May 20, 2010

I am running a test to determine when packet drops occur. I'm using a Spirent TestCenter through a switch (necessary to aggregate Ethernet traffic from 5 ports to one optical link) to a server using a Myricom card.While running my test, if the input rate is below a certain value, ethtool does not report any drop (except dropped_multicast_filtered which is incrementing at a very slow rate). However, tcpdump reports X number of packets "dropped by kernel". Then if I increase the input rate, ethtool reports drops but "ifconfig eth2" does not. In fact, ifconfig doesn't seem to report any packet drops at all. Do they all measure packet drops at different "levels", i.e. ethtool at the NIC level, tcpdump at the kernel level etc?nd am I right to say that in the journey of an incoming packet, the NIC level is the "so-called" first level, then the kernel, then the user application? So any packet drop is likely to happen first at the NIC, then the kernel, then the user application? So if there is no packet drop at the NIC, but packet drop at the kernel, then the bottleneck is not at the NIC?

View 1 Replies View Related

Networking :: Correct Command To Filter Outgoing Traffic With Tcpdump?

May 6, 2010

I have a need to make a rather odd filter in tcpdump- I would like to capture only all those packages on interface eth0, that are outgoing(in other words from IP 192.168.1.1, which is IP for eth0 in this computer) and doesn't have src MAC address 11:22:33:44:55:66. However, fallowing command says, that syntax is wrong:

Code:
tcpdump -n -p -i eth0 src host 192.168.1.1 ether src not 11:22:33:44:55:66
Is this possible? If yes, then what is the correct command?

View 3 Replies View Related

Networking :: Convert Tcpdump Output File To A Pcap Format?

Feb 21, 2011

How to convert Tcpdump output file to a Pcap format? Is there such way?

This is what i mean:

tcpdump -i eth0 >> test.out

Now i want to convert test.out to Pcap so It's readable via Wireshark.

View 5 Replies View Related

Networking :: Opnet With Traffic Data Gathered Using Tcpdump Tool?

Jan 11, 2011

I have a WAN network that i need to do some analysis on, for the traffic flows. I did lots of googling to figure out what useful tool to collect the packet informations.I found this site [URL]..witch i made great use of to recognize the tcpdum tool. I also have a network simulator on windows platform wich is Opnet Guru, (by the way.. is there a linux version for this simulator?).

MY QUESTION IS: How can i feed the Opnet Guru with the flows data collected with the

Code:
tcpdump
with its different options?

NOTE: in the Opnet Guru invironment there is an object called the profile that is beeing used to customize and genarate data flows with the desired characteristics to simulate the real flows. So i need to feed the Opnet with the fresh data collected with the tcpdump tool (command) instead of using the built-in profile.. i hope i was clear enough..

View 3 Replies View Related

Networking :: Packet Drop Measured By Ethtool / Tcpdump And Ifconfig

May 19, 2010

I have a question regarding packet drops. I am running a test to determine when packet drops occur. I'm using a Spirent TestCenter through a switch (necessary to aggregate Ethernet traffic from 5 ports to one optical link) to a server using a Myricom card. While running my test, if the input rate is below a certain value, ethtool does not report any drop (except dropped_multicast_filtered which is incrementing at a very slow rate). However, tcpdump reports X number of packets "dropped by kernel". Then if I increase the input rate, ethtool reports drops but "ifconfig eth2" does not.

In fact, ifconfig doesn't seem to report any packet drops at all. Do they all measure packet drops at different "levels", i.e. ethtool at the NIC level, tcpdump at the kernel level etc? And am I right to say that in the journey of an incoming packet, the NIC level is the "so-called" first level, then the kernel, then the user application? So any packet drop is likely to happen first at the NIC, then the kernel, then the user application? So if there is no packet drop at the NIC, but packet drop at the kernel, then the bottleneck is not at the NIC?

View 1 Replies View Related

Networking :: Tcpdump Shows Packages Even IPTables Policy Set To Drop

Feb 19, 2010

I have set the iptables INPUT policy to DROP. As I have expected tcpdump wasn't showing any packages... for a while. Suddenly it begun to show UDP syslog packages being sent by a remote host. It is conform with the configuration of syslog, but since the INPUT policy was set to DROP, with no exceptions, it is not conform with configuration of iptables. Why after setting INPUT policy to DROP, with no exceptions most of the packets recieved before are being dropped and some not, as tcpdump shows?

View 7 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved