Login or Register to Ask a Question and Join Our Community


IP Networking

tcpdump -w file is not capturing all the packets

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums IP Networking tcpdump -w file is not capturing all the packets
# 1  
Old 05-22-2009
tcpdump -w file is not capturing all the packets
I am trying to capture tcpdump for traffic to a port in a file but this does not seem to capture all the packets. Command I use is :

tcpdump -w tdump.dat port 22

Why is it not capturing all the packets ?

Here is my experiment:
root@pmode-client6 adc-demo]# tcpdump port 22
tcpdump: listening on eth0
00:06:45.290838 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 4216814594 win 65415 (DF)
00:06:45.290865 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1:69(68) ack 0 win 11792 (DF) [tos 0x10]
00:06:45.995979 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1:69(68) ack 0 win 11792 (DF) [tos 0x10]
00:06:46.394715 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 69 win 65347 (DF)
00:06:46.394750 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 69:513(444) ack 0 win 11792 (DF) [tos 0x10]
00:06:46.795739 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 513 win 64903 (DF)
00:06:46.795751 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 513:809(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:47.300580 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 809 win 64607 (DF)
00:06:47.300590 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 809:1105(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:47.697982 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1105 win 64311 (DF)
00:06:47.697993 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1105:1401(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:48.106128 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1401 win 65535 (DF)
00:06:48.106137 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1401:1697(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:48.598476 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1697 win 65239 (DF)
00:06:48.598483 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1697:1993(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:49.007872 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 1993 win 64943 (DF)
00:06:49.007884 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 1993:2289(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:49.512090 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 2289 win 64647 (DF)
00:06:49.512100 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 2289:2585(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:49.913489 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 2585 win 64351 (DF)
00:06:49.913496 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 2585:2881(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:50.315388 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 2881 win 65535 (DF)
00:06:50.315401 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 2881:3177(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:50.813982 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 3177 win 65239 (DF)
00:06:50.813989 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 3177:3473(296) ack 0 win 11792 (DF) [tos 0x10]
00:06:51.042979 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: P 0:88(88) ack 3177 win 65239 (DF)

26 packets received by filter
0 packets dropped by kernel

[root@pmode-client6 adc-demo]# tcpdump -w tdump.dat port 22
tcpdump: listening on eth0

6 packets received by filter
0 packets dropped by kernel
[root@pmode-client6 adc-demo]# tcpdump -r tdump.dat port 22
00:08:56.741761 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 4216835054:4216835106(52) ack 3917910214 win 11792 (DF) [tos 0x10]
00:08:57.157589 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 52 win 65483 (DF)
00:08:57.157610 172.21.76.96.ssh > sjc-vpn6-65.cisco.com.2654: P 52:120(68) ack 1 win 11792 (DF) [tos 0x10]
00:08:57.562987 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: . ack 120 win 65415 (DF)
00:09:06.055469 sjc-vpn6-65.cisco.com.2654 > 172.21.76.96.ssh: P 1:89(88) ack 120 win 65415 (DF)

Both the commands were run for 10 secs. In fact I ran the command with -w option for 15 secs but still the captured packets in the dump are are just 6 compared to 26 packets without the file save option. Any reason ? What I can I do to capture all ?

-Satish
Last edited by radiatejava; 05-26-2009 at 10:22 AM..
# 2  
Old 05-22-2009
You can use snoop to capture packets

check the man pages for details

#snoop -x0 port 22
# 3  
Old 05-22-2009
This is not the answer I am looking for. I believe tcpdump is a widely used free utility to capture network packets in a file. Can someone else update me on using tcpdump to capture all the packets in a file ?
# 4  
Old 05-22-2009
Quote:
Originally Posted by radiatejava
This is not the answer I am looking for. I believe tcpdump is a widely used free utility to capture network packets in a file. Can someone else update me on using tcpdump to capture all the packets in a file ?
In the future, if you want good answers to your questions, please do not use small fonts or colored fonts.

I, for one, find your original post very difficult to read. I think most readers will quickly go to "next post" when they encounter a post that is an eye strain Smilie
# 5  
Old 05-28-2009
Quote:
Originally Posted by radiatejava
[...]Both the commands were run for 10 secs. In fact I ran the command with -w option for 15 secs but still the captured packets in the dump are are just 6 compared to 26 packets without the file save option. Any reason ? What I can I do to capture all ?

-Satish
Sounds like some bottleneck in the system, perhaps a problem with the buffers. Try
Code:
# tcpdump -l port 22 | tee tdump.dat

instead. Using a pipe should bring relief.
# 6  
Old 05-29-2009
I got over the problem. Actually, when you display the ssh dump over a remote monitor, even the bytes transferred for the display will be captured and will result in more packets in the tcpdump compared to if we want to run the tcpdump just on the host.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Capturing time stamp in file name

I have a file that is created via a perl script where the file is named like so: 01-07-2016_10:17:08. I am running a shell script that needs to take this file and print it. I can capture the date portion fine, but I am unsure how to capture the time stamp, since there will be a difference from what... (1 Reply)
Discussion started by: ldorsey
1 Replies

2. IP Networking

Capture packets (TcpDump) and forwarding them

Hi, I want to capture a certain type of packets (selected according to the protocol) coming to my PC and then transmit them to another PC. I had the idea to use tcpdump to filter input packets and extract those chosen. Well my questions are: 1- after filtering input packets, those that have not... (1 Reply)
Discussion started by: ziedf
1 Replies

3. IP Networking

Help with capturing/reading total packets on specific port number

Hi guys, I'm using a Linux system(Ubuntu) and I've been trying to find a method to read the total packets received/sent on a specific port (e.g port 80 or port 25) on a local machine. I can read the overall total packets received/sent from the /proc/net/dev file system. But what I can't do is... (2 Replies)
Discussion started by: lildee
2 Replies

4. Infrastructure Monitoring

Capturing bad packets

Hello, SNMP reports from my Linux server a large number of "ipInAddrErrors" on several of my systems. According to one description, these packets are discarded datagrams due to: How do I determine what packets these are? Can tcpdump help? If so, can anyone suggest a filter? (1 Reply)
Discussion started by: otheus
1 Replies

5. Shell Programming and Scripting

Help with script, trying to get tcpdump and rotate the file every 300 seconds

Greetings, I just started using scripting languages, im trying to get a tcpdump in a file, change the file name every 5mins ... this is what i have but its not working ... any suggestions? #!/bin/bash # timeout.sh #timestamp format TIMESTAMP=`date -u "+%Y%m%dT%H%M%S"` #tdump =`tcpdump... (3 Replies)
Discussion started by: livewire
3 Replies

6. Linux

Capturing TCPDUMP

Hi, I want to capture TCPDUMP of traffic, I tried doing this but did not find success..can anyone plz correct it. # tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161 bash: tcpdump: command not found # tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host... (5 Replies)
Discussion started by: sureshcisco
5 Replies

7. UNIX for Dummies Questions & Answers

how to use tcpdump to track packets(mails) ?

I am running 2 Unix machines and trying to use IMAP.pm/Simple.pm perl modules to exchange mails between 2 systems. Mail exchanges is through SMTP(for sending the mail) and IMAP(for retrieving the mails). Somehow it's not working So wanted to check where the packets are and what is their path. I... (3 Replies)
Discussion started by: contactme
3 Replies

8. Cybersecurity

How to decipher tcpdump file

Hi, I am stuck with a tricky situation in which one of my applications is flooding the network with UDP messages. The architecture of the application is not supposed to do so. Neither is there any place where the application will go into an infinite loop sending UDP messages over the network. To... (3 Replies)
Discussion started by: diganta
3 Replies

9. Cybersecurity

Reading and Manipulating captured packets (pflog file)

Hey, I currently have a set of captured sessions thru ethereal, saved in pflog files, basically its a tcpdump, which i need to go thru and sort the applications/protocols in order of the times they were used. I also need to change the headers of the packets, basically the source and destination... (0 Replies)
Discussion started by: PenguinDevil
0 Replies

10. UNIX for Dummies Questions & Answers

TCPDump Binary File......

I have a file on a linux box with the extension .gz thats supposed to be a gzip file. when i use gzip -d filename it gives me squares and triangles and you know garbarge. Its a 900 meg file. Is there someway to decode the file and where could I store a 900 meg file for free???? I am going to... (8 Replies)
Discussion started by: pydyer
8 Replies
Login or Register to Ask a Question