Sponsored Content
Full Discussion: tcpdump: strange logging?
Special Forums IP Networking tcpdump: strange logging? Post 302170274 by one71 on Monday 25th of February 2008 04:39:13 AM
Old 02-25-2008
I have partially understood the strange connections popping up.

tcpdump sets the network interface in promiscuous mode. This means that:

Quote:
In computing, promiscuous mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to it
Still I do not understand the "strange connection Nr3", any idea?
Thanks
 

10 More Discussions You Might Find Interesting

1. Programming

How To Use tcpdump

I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0. I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
Discussion started by: chenhao_no1
2 Replies

2. UNIX for Dummies Questions & Answers

tcpdump

does anybody know what the -d -dd and -ddd options are used for ? thanks (2 Replies)
Discussion started by: ant04
2 Replies

3. IP Networking

tcpdump question

Hi, I got the following question regarding tcpdump and I would appreciate your help/feedback: --Scenario I am instructed to capture the network traffic by getting the tcpdump data/files of our network for every hour. --Problem Some of the connections are still open when the capture is done... (1 Reply)
Discussion started by: jinsunnyvale
1 Replies

4. Cybersecurity

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (0 Replies)
Discussion started by: chamnanpol
0 Replies

5. IP Networking

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (2 Replies)
Discussion started by: chamnanpol
2 Replies

6. Post Here to Contact Site Administrators and Moderators

Constant Logging In (After Logging Out)

Hi Everyone. First, I want to thank all of you for letting me participate in this great group. I am having a bit of a problem. After I get an email from a responder, I login to make my reply. In the mean time I get another response by email from another member, I go to reply to them and I... (6 Replies)
Discussion started by: Ccccc
6 Replies

7. Debian

Tcpdump Help !

Hi. Need Help with TcpDump Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error can anyone help me with this error ? Thanks alot !!:) (1 Reply)
Discussion started by: SoulZB
1 Replies

8. Cybersecurity

Need Help with this TCPDUMP output...

Hello everyone, so I'm getting this tcpdump, and it looks like..quite a mess... Can anyone decipher this? I can tell that one IP is requesting DNS info? but I'm having trouble finding out what some of the fields actually mean.. 19:44:50.707637 IP 66.81.1.252.53 > 64.147.113.139.28638: 52313... (4 Replies)
Discussion started by: Lost in Cyberia
4 Replies

9. Linux

Syslog not logging successful logging while unlocking server's console

When unlocking a Linux server's console there's no event indicating successful logging Is there a way I can fix this ? I have the following in my rsyslog.conf auth.info /var/log/secure authpriv.info /var/log/secure (1 Reply)
Discussion started by: walterthered
1 Replies

10. IP Networking

TCPdump

I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Discussion started by: Ultrix
3 Replies
ifconfig(8c)															      ifconfig(8c)

Name
       ifconfig - configure network interface parameters

Syntax
       /etc/ifconfig interface [ address [ dest_address ] ] [ parameters ]

Description
       The  command assigns an address to a network interface and/or configures network interface parameters.  You must use at boot time to define
       the network address of each interface present on a machine. You can also use it at a later time to redefine an  interface's  address.   The
       interface parameter is a string of the form: name, unit, for example, en0.  The address is either a host name present in the host name data
       base, or a DARPA Internet address expressed in the Internet standard dot notation.

Arguments
       You can set the following parameters with

       up	 Marks an interface up.

       down	 Marks an interface down.  When an interface is marked down, the system does not attempt to transmit messages through that  inter-
		 face.

       trailers  Enables  the  use of a trailer link level encapsulation when sending.	If a network interface supports trailers, the system, when
		 possible, encapsulates outgoing messages in a manner that minimizes the number of memory-to-memory copy operations  performed	by
		 the receiver.
		 Although trailers is the default on some network interfaces, the use of trailers is not recommended; failures in trailer negotia-
		 tion can disrupt network transmissions.  See -trailers.

       -trailers Disables the use of a trailer link level encapsulation.  This is the recommended setting.

       promisc	 Enables the use of the in the promiscuous mode. The promiscuous mode allows the network interface to receive all the packets  off
		 the wire and pass it onto to the packet filter.

       -promisc  Disables the promiscuous mode of the packet filter. This is the default.

       +copyall  Sets  the interface into copy-all mode (receives packets sent/received by the kernel-resident protocol software [for example, IP,
		 ARP, DECnet, LAT] on this host).

       -copyall  Disables copy-all mode. (See for more information aboutut the flag.)

       arp	 Enables the use of the Address Resolution Protocol in mapping between network level addresses and link level addresses.  This	is
		 the default.  This is currently implemented for mapping between DARPA Internet addresses and 10Mb/s Ethernet addresses.

       -arp	 Disables the use of the Address Resolution Protocol.

       debug	 Enables driver-dependent debugging code. Usually, this turns on extra console error logging.

       -debug	 Disables driver dependent debugging code.

       netmask	 Specifies  how  many  bits  of  the  address you wish to reserve for subdividing Class A and B networks into sub-networks.  (Inet
		 only).

       dstaddr	 Specifies the correspondent on the other end of a point to point link.

       broadcast Specifies the address you wish to use to represent broadcasts to the network.

       The command displays the current configuration for a network interface when no optional parameters are supplied.

       Only the superuser can modify the configuration of a network interface.

Diagnostics
       The command returns messages indicating the specified interface does not exist, the requested address is unknown, the user tried  to  alter
       an interface's configuration but is not privileged.

See Also
       netstat(1), intro(4n), packetfilter(4), MAKEDEV(8), pfconfig(8c), pfstat(8), rc(8)

																      ifconfig(8c)
All times are GMT -4. The time now is 05:16 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy