Skip to content

Instantly share code, notes, and snippets.

@sotodel
Last active March 10, 2017 03:42
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save sotodel/6d58790628e57101a49b3420a6f59218 to your computer and use it in GitHub Desktop.
Save sotodel/6d58790628e57101a49b3420a6f59218 to your computer and use it in GitHub Desktop.
Sample single frame output of "tcpdump -i lo ‘port 9042’ -vv -X"
10:18:34.248245 IP (tos 0x0, ttl 64, id 4762, offset 0, flags [DF], proto TCP (6), length 16436)
mountainjust-vm0.corp.yahoo.com.38383 > mountainjust-vm0.corp.yahoo.com.9042: Flags [.], cksum 0x7a37 (incorrect -> 0xf050), seq 106:16490, ack 104, win 4, options [nop,nop,TS val 79452205 ecr 79452185], length 16384
0x0000: 4500 4034 129a 4000 4006 ae19 0a49 92bf E.@4..@.@....I..
0x0010: 0a49 92bf 95ef 2352 025f 4b06 22a4 ffca .I....#R._K."...
0x0020: 8010 0004 7a37 0000 0101 080a 04bc 582d ....z7........X-
0x0030: 04bc 5819 0400 0000 0a00 005d 7800 10ac ..X........]x...
0x0040: 35a8 b01c b135 323a 7b69 b184 b6fd 3900 5....52:{i....9.
0x0050: 0a05 0002 0000 0004 0000 0000 0000 5d51 ..............]Q
0x0060: 305f 315f 325f 335f 345f 355f 365f 375f 0_1_2_3_4_5_6_7_
0x0070: 385f 395f 3130 5f31 315f 3132 5f31 335f 8_9_10_11_12_13_
0x0080: 3134 5f31 355f 3136 5f31 375f 3138 5f31 14_15_16_17_18_1
--
0x4010: 5f33 3438 335f 3334 3834 5f33 3438 355f _3483_3484_3485_
0x4020: 3334 3836 5f33 3438 375f 3334 3838 5f33 3486_3487_3488_3
0x4030: 3438 395f 489_
10:18:34.248319 IP (tos 0x0, ttl 64, id 42860, offset 0, flags [DF], proto TCP (6), length 52)
mountainjust-vm0.corp.yahoo.com.9042 > mountainjust-vm0.corp.yahoo.com.38383: Flags [.], cksum 0x1964 (correct), seq 104, ack 16490, win 96, options [nop,nop,TS val 79452205 ecr 79452205], length 0
[... ack ...]
10:18:34.248613 IP (tos 0x0, ttl 64, id 4763, offset 0, flags [DF], proto TCP (6), length 7605)
mountainjust-vm0.corp.yahoo.com.38383 > mountainjust-vm0.corp.yahoo.com.9042: Flags [P.], cksum 0x57b8 (incorrect -> 0xe5e2), seq 16490:24043, ack 104, win 4, options [nop,nop,TS val 79452206 ecr 79452205], length 7553
0x0000: 4500 1db5 129b 4000 4006 d097 0a49 92bf E.....@.@....I..
0x0010: 0a49 92bf 95ef 2352 025f 8b06 22a4 ffca .I....#R._.."...
0x0020: 8018 0004 57b8 0000 0101 080a 04bc 582e ....W.........X.
0x0030: 04bc 582d 3334 3930 5f33 3439 315f 3334 ..X-3490_3491_34
0x0040: 3932 5f33 3439 335f 3334 3934 5f33 3439 92_3493_3494_349
0x0050: 355f 3334 3936 5f33 3439 375f 3334 3938 5_3496_3497_3498
--
0x1d90: 3939 335f 3439 3934 5f34 3939 355f 3439 993_4994_4995_49
0x1da0: 3936 5f34 3939 375f 3439 3938 5f34 3939 96_4997_4998_499
0x1db0: 3900 0013 88 9....
10:18:34.249576 IP (tos 0x0, ttl 64, id 42861, offset 0, flags [DF], proto TCP (6), length 65)
mountainjust-vm0.corp.yahoo.com.9042 > mountainjust-vm0.corp.yahoo.com.38383: Flags [P.], cksum 0x3a44 (incorrect -> 0x6aca), seq 104:117, ack 24043, win 96, options [nop,nop,TS val 79452207 ecr 79452206], length 13
[... ack ...] .
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment