Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: tcpdump -w file is not capturing all the packets
Special Forums IP Networking tcpdump -w file is not capturing all the packets Post 302318642 by radiatejava on Friday 22nd of May 2009 03:18:04 AM
Old 05-22-2009
tcpdump -w file is not capturing all the packets
I am trying to capture tcpdump for traffic to a port in a file but this does not seem to capture all the packets. Command I use is :

tcpdump -w tdump.dat port 22

Why is it not capturing all the packets ?

Here is my experiment:
root@pmode-client6 adc-demo]# tcpdump port 22
tcpdump: listening on eth0
00:06:45.290838 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 4216814594 win 65415 (DF)
00:06:45.290865 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1:69(68) ack 0 win 11792 (DF) [tos 0x10]
00:06:45.995979 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1:69(68) ack 0 win 11792 (DF) [tos 0x10]
00:06:46.394715 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 69 win 65347 (DF)
00:06:46.394750 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 69:513(444) ack 0 win 11792 (DF) [tos 0x10]
00:06:46.795739 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 513 win 64903 (DF)
00:06:46.795751 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 513:809(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:47.300580 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 809 win 64607 (DF)
00:06:47.300590 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 809:1105(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:47.697982 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1105 win 64311 (DF)
00:06:47.697993 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1105:1401(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:48.106128 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1401 win 65535 (DF)
00:06:48.106137 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1401:1697(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:48.598476 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1697 win 65239 (DF)
00:06:48.598483 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1697:1993(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:49.007872 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1993 win 64943 (DF)
00:06:49.007884 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1993:2289(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:49.512090 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 2289 win 64647 (DF)
00:06:49.512100 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 2289:2585(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:49.913489 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 2585 win 64351 (DF)
00:06:49.913496 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 2585:2881(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:50.315388 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 2881 win 65535 (DF)
00:06:50.315401 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 2881:3177(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:50.813982 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 3177 win 65239 (DF)
00:06:50.813989 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 3177:3473(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:51.042979 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: P 0:88(88) ack 3177 win 65239 (DF)

26 packets received by filter
0 packets dropped by kernel

[root@pmode-client6 adc-demo]# tcpdump -w tdump.dat port 22
tcpdump: listening on eth0

6 packets received by filter
0 packets dropped by kernel
[root@pmode-client6 adc-demo]# tcpdump -r tdump.dat port 22
00:08:56.741761 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 4216835054:4216835106(52) ack 3917910214 win 11792 (DF) [tos 0x10]
00:08:57.157589 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 52 win 65483 (DF)
00:08:57.157610 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 52:120(68) ack 1 win 11792 (DF) [tos 0x10]
00:08:57.562987 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 120 win 65415 (DF)
00:09:06.055469 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: P 1:89(88) ack 120 win 65415 (DF)

Both the commands were run for 10 secs. In fact I ran the command with -w option for 15 secs but still the captured packets in the dump are are just 6 compared to 26 packets without the file save option. Any reason ? What I can I do to capture all ?

-Satish
Last edited by radiatejava; 05-26-2009 at 10:22 AM..
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

TCPDump Binary File......

I have a file on a linux box with the extension .gz thats supposed to be a gzip file. when i use gzip -d filename it gives me squares and triangles and you know garbarge. Its a 900 meg file. Is there someway to decode the file and where could I store a 900 meg file for free???? I am going to... (8 Replies)
Discussion started by: pydyer
8 Replies

2. Cybersecurity

Reading and Manipulating captured packets (pflog file)

Hey, I currently have a set of captured sessions thru ethereal, saved in pflog files, basically its a tcpdump, which i need to go thru and sort the applications/protocols in order of the times they were used. I also need to change the headers of the packets, basically the source and destination... (0 Replies)
Discussion started by: PenguinDevil
0 Replies

3. Cybersecurity

How to decipher tcpdump file

Hi, I am stuck with a tricky situation in which one of my applications is flooding the network with UDP messages. The architecture of the application is not supposed to do so. Neither is there any place where the application will go into an infinite loop sending UDP messages over the network. To... (3 Replies)
Discussion started by: diganta
3 Replies

4. UNIX for Dummies Questions & Answers

how to use tcpdump to track packets(mails) ?

I am running 2 Unix machines and trying to use IMAP.pm/Simple.pm perl modules to exchange mails between 2 systems. Mail exchanges is through SMTP(for sending the mail) and IMAP(for retrieving the mails). Somehow it's not working So wanted to check where the packets are and what is their path. I... (3 Replies)
Discussion started by: contactme
3 Replies

5. Linux

Capturing TCPDUMP

Hi, I want to capture TCPDUMP of traffic, I tried doing this but did not find success..can anyone plz correct it. # tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161 bash: tcpdump: command not found # tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host... (5 Replies)
Discussion started by: sureshcisco
5 Replies

6. Shell Programming and Scripting

Help with script, trying to get tcpdump and rotate the file every 300 seconds

Greetings, I just started using scripting languages, im trying to get a tcpdump in a file, change the file name every 5mins ... this is what i have but its not working ... any suggestions? #!/bin/bash # timeout.sh #timestamp format TIMESTAMP=`date -u "+%Y%m%dT%H%M%S"` #tdump =`tcpdump... (3 Replies)
Discussion started by: livewire
3 Replies

7. Infrastructure Monitoring

Capturing bad packets

Hello, SNMP reports from my Linux server a large number of "ipInAddrErrors" on several of my systems. According to one description, these packets are discarded datagrams due to: How do I determine what packets these are? Can tcpdump help? If so, can anyone suggest a filter? (1 Reply)
Discussion started by: otheus
1 Replies

8. IP Networking

Help with capturing/reading total packets on specific port number

Hi guys, I'm using a Linux system(Ubuntu) and I've been trying to find a method to read the total packets received/sent on a specific port (e.g port 80 or port 25) on a local machine. I can read the overall total packets received/sent from the /proc/net/dev file system. But what I can't do is... (2 Replies)
Discussion started by: lildee
2 Replies

9. IP Networking

Capture packets (TcpDump) and forwarding them

Hi, I want to capture a certain type of packets (selected according to the protocol) coming to my PC and then transmit them to another PC. I had the idea to use tcpdump to filter input packets and extract those chosen. Well my questions are: 1- after filtering input packets, those that have not... (1 Reply)
Discussion started by: ziedf
1 Replies

10. Shell Programming and Scripting

Capturing time stamp in file name

I have a file that is created via a perl script where the file is named like so: 01-07-2016_10:17:08. I am running a shell script that needs to take this file and print it. I can capture the date portion fine, but I am unsure how to capture the time stamp, since there will be a difference from what... (1 Reply)
Discussion started by: ldorsey
1 Replies
All times are GMT -4. The time now is 10:44 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy