Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Need Help with this TCPDUMP output...
Special Forums Cybersecurity Need Help with this TCPDUMP output... Post 302885340 by neutronscott on Saturday 25th of January 2014 02:47:12 AM
Old 01-25-2014
The port number is not after a semicolon. The ports are in red below:

Code:
66.81.1.252.53 > 64.147.113.139.28638

The rest I have to look at the tcpdump source for. I didn't see much explained in documentation.

The next number, 52313 is the DNS query ID which is used to differentiate queries. During the request this can be followed by a + or % to mean Recursion Disabled and Check Disabled bits are set, respectively. There are a few symbols that can be sent with the reply as well: AA*, RA-, TC|, AD$. Will have to look at the DNS RFC for those meanings.

What I was really curious of is that #/#/#. That seems to be the reply counts. AN/NS/AR (Answer, Nameserver, Additional Records).

The SOA record isn't really printed, just that it was in there, as "SOA", then all the A records which you see are the IPs associated.

Lastly you should have seen a (#) which would be the total length.
 

10 More Discussions You Might Find Interesting

1. Programming

How To Use tcpdump

I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0. I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
Discussion started by: chenhao_no1
2 Replies

2. UNIX for Dummies Questions & Answers

tcpdump

does anybody know what the -d -dd and -ddd options are used for ? thanks (2 Replies)
Discussion started by: ant04
2 Replies

3. Shell Programming and Scripting

Tcpdump in cron

I wrote a short BASH script to run tcpdump and save the output to a log file for when I'm away from my desk. The script runs fine normally, but fails to start in cron. Any ideas? #!/bin/bash today=`date +%Y%m%d` tcpdump -i eth0 -s 1500 -w ${today}.cap & exit (5 Replies)
Discussion started by: paulzeromi
5 Replies

4. Shell Programming and Scripting

analyzing tcpdump output

hello, i have a lot of pcap files (tcpdump output) that i want to compare. every tcpdump output has two file, server and client. what i want to do is: 1. take timestamp, source address, destination address, and packet id from each file (server and client) 2. find the packets sent from... (0 Replies)
Discussion started by: slumpia
0 Replies

5. Cybersecurity

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (0 Replies)
Discussion started by: chamnanpol
0 Replies

6. IP Networking

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (2 Replies)
Discussion started by: chamnanpol
2 Replies

7. Shell Programming and Scripting

write a script to parse some tcpdump output

i am trying to write a script to parse some tcpdump output, in each line of the tcpdump output, I know for sure there are 3 keywords exist: User{different usernamehere} NAS_ipaddr{different ip here} Calling_station{ip or dns name here} But the positions for these 3 keywords in the... (4 Replies)
Discussion started by: fedora
4 Replies

8. IP Networking

tcpdump vs. wireshark

Hi, I am trying to capture manually crafted IP packets, created using Scapy, to a pcap file that can later be replayed using tcpreplay. When using wireshark, I can successfully capture these packets and view them in wireshark. However, when using tcpdump, these packets are then shown in... (2 Replies)
Discussion started by: yotamhc
2 Replies

9. Debian

Tcpdump Help !

Hi. Need Help with TcpDump Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error can anyone help me with this error ? Thanks alot !!:) (1 Reply)
Discussion started by: SoulZB
1 Replies

10. IP Networking

TCPdump

I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Discussion started by: Ultrix
3 Replies

LEARN ABOUT DEBIAN

colorgccrc

COLORGCCRC(5)							File Formats Manual						     COLORGCCRC(5)

NAME

       colorgccrc - configuration file for colorgcc

DESCRIPTION

       A colorgccrc configuration file is used to configure the highlighting of the compiler output from colorgcc.

SYNTAX

       Each  line  consists  of  a  keyword  designating  a configuration variable.  The keyword is followed by `:' and then one or several values
       (depending on the keyword).  Lines beginning with a hash mark `#' are comments.

CONFIGURATION VARIABLES

       g++ | gcc | c++ | cc | g77 | gcj | gnat | gpc
	      Specifies the paths to the compilers.  Takes one value; a path to the compiler.

       nocolor
	      Specifies what terminal types colorization should be disabled on.  Takes one or several values, separated by whitespace.

       srcColor
	      Specifies the highlighting attributes source-code should be given.  Takes one or several color attributes.  See  the  section  COLOR
	      ATTRIBUTES for more information.

       introColor
	      Specifies  the  highlighting  attributes	for normal compiler output.  Takes one or several color attributes.  See the section COLOR
	      ATTRIBUTES for more information.

       warningFileNameColor | errorFileNameColor
	      Specifies the highlighting attributes for the filename in a  warning  or	an  error,  respectively.   Takes  one	or  several  color
	      attributes.  See the section COLOR ATTRIBUTES for more information.

       warningNumberColor | errorNumberColor
	      Specifies  the  highlighting  attributes	for  the  line-number  in a warning or an error, respectively.	Takes one or several color
	      attributes.  See the section COLOR ATTRIBUTES for more information.

       warningMessageColor | errorMessageColor
	      Specifies the highlighting attributes for the message-text in a warning or an error,  respectively.   Takes  one	or  several  color
	      attributes.  See the section COLOR ATTRIBUTES for more information.

COLOR ATTRIBUTES

       The following attributes are valid for highlighting.

       clear, reset

       bold, underline, underscore, blink, reverse, concealed

       black, red, green, yellow, blue, magenta, cyan, white

       on_black, on_red, on_green, on_yellow, on_blue, on_magenta, on_cyan, on_white

SEE ALSO

       gcc(1), colorgcc(1)

HISTORY

       Jan 15 2003: Initial version of this manual-page.

REPORTING BUGS

       Report bugs to <jmoyers@geeks.com>

AUTHORS

       Jamie Moyers <jmoyers@geeks.com> is the author of colorgcc.

       This  manual  page  was	written  by Joe Wreschnig <piman@sacredchao.net>, and modified by David Weinehall <tao@debian.org>, for the Debian
       GNU/Linux system (but may be used by others).

COPYRIGHT

       Copyright (C) 2003 Jamie Moyers
       This is free software; see the source for copying conditions.  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICU-
       LAR PURPOSE.

								   Jan 15, 2003 						     COLORGCCRC(5)
All times are GMT -4. The time now is 07:40 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy