Skip to content

Instantly share code, notes, and snippets.

@timothyclifford

timothyclifford/tcpdump

Created October 12, 2016 09:34
Show Gist options
  • Save timothyclifford/f9b51d5528dbe74f491bb7c35153c667 to your computer and use it in GitHub Desktop.
Save timothyclifford/f9b51d5528dbe74f491bb7c35153c667 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
tcpdump
EC2
ubuntu@ip-10-9-0-159:~$ sudo tcpdump -nn port 9000
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:30:36.710756 IP xxx.xxx.xxx.xxx.33988 > 10.9.0.159.9000: Flags [S], seq 1218808160, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 664858778 ecr 0,sackOK,eol], length 0
09:30:36.710866 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [S.], seq 3812133477, ack 1218808161, win 28960, options [mss 1460,sackOK,TS val 1814882 ecr 664858778,nop,wscale 7], length 0
09:30:36.842457 IP xxx.xxx.xxx.xxx.33988 > 10.9.0.159.9000: Flags [.], ack 1, win 4117, options [nop,nop,TS val 664858909 ecr 1814882], length 0
09:30:36.843524 IP xxx.xxx.xxx.xxx.33988 > 10.9.0.159.9000: Flags [P.], seq 1:84, ack 1, win 4117, options [nop,nop,TS val 664858909 ecr 1814882], length 83
09:30:36.843586 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [.], ack 84, win 227, options [nop,nop,TS val 1814915 ecr 664858909], length 0
09:30:36.845561 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [P.], seq 1:1239, ack 84, win 227, options [nop,nop,TS val 1814915 ecr 664858909], length 1238
09:30:37.238044 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [P.], seq 1:1239, ack 84, win 227, options [nop,nop,TS val 1815014 ecr 664858909], length 1238
09:30:40.150047 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [P.], seq 1:1239, ack 84, win 227, options [nop,nop,TS val 1815742 ecr 664858909], length 1238
09:30:41.846155 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [F.], seq 1239, ack 84, win 227, options [nop,nop,TS val 1816166 ecr 664858909], length 0
09:30:45.966053 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [FP.], seq 1:1239, ack 84, win 227, options [nop,nop,TS val 1817196 ecr 664858909], length 1238
09:30:57.598073 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [FP.], seq 1:1239, ack 84, win 227, options [nop,nop,TS val 1820104 ecr 664858909], length 1238
09:31:20.862069 IP 10.9.0.159.9000 > xxx.xxx.xxx.xxx.33988: Flags [FP.], seq 1:1239, ack 84, win 227, options [nop,nop,TS val 1825920 ecr 664858909], length 1238
LOCAL
$ sudo tcpdump -nn port 9000
tcpdump: data link type PKTAP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
17:30:35.763786 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 3667143682, ack 857236479, win 4117, options [nop,nop,TS val 664857240 ecr 1770822], length 0
17:30:36.350165 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664857825 ecr 1770822], length 0
17:30:37.307280 IP 10.5.100.134.54936 > xx.xxx.xxx.xxx.9000: Flags [S], seq 1218808160, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 664858778 ecr 0,sackOK,eol], length 0
17:30:37.325171 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664858795 ecr 1770822], length 0
17:30:37.439187 IP xx.xxx.xxx.xxx.9000 > 10.5.100.134.54936: Flags [S.], seq 3812133477, ack 1218808161, win 28960, options [mss 1460,sackOK,TS val 1814882 ecr 664858778,nop,wscale 7], length 0
17:30:37.439255 IP 10.5.100.134.54936 > xx.xxx.xxx.xxx.9000: Flags [.], ack 1, win 4117, options [nop,nop,TS val 664858909 ecr 1814882], length 0
17:30:37.439391 IP 10.5.100.134.54936 > xx.xxx.xxx.xxx.9000: Flags [P.], seq 1:84, ack 1, win 4117, options [nop,nop,TS val 664858909 ecr 1814882], length 83
17:30:37.569521 IP xx.xxx.xxx.xxx.9000 > 10.5.100.134.54936: Flags [.], ack 84, win 227, options [nop,nop,TS val 1814915 ecr 664858909], length 0
17:30:39.071661 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664860535 ecr 1770822], length 0
17:30:42.320908 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [.], ack 1, win 4117, length 0
17:30:42.360743 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664863815 ecr 1770822], length 0
17:30:48.730956 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664870175 ecr 1770822], length 0
17:30:57.554861 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664878983 ecr 1770822], length 0
17:31:15.023232 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664896399 ecr 1770822], length 0
17:31:32.467611 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664913815 ecr 1770822], length 0
17:31:37.714434 IP 10.5.100.134.54936 > xx.xxx.xxx.xxx.9000: Flags [.], ack 1, win 4117, length 0
17:31:42.534097 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [.], ack 1, win 4117, length 0
17:31:49.998038 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664931231 ecr 1770822], length 0
17:32:07.507439 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664948647 ecr 1770822], length 0
17:32:25.061060 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664966063 ecr 1770822], length 0
17:32:38.071549 IP 10.5.100.134.54936 > xx.xxx.xxx.xxx.9000: Flags [.], ack 1, win 4117, length 0
17:32:42.527027 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [F.], seq 0, ack 1, win 4117, options [nop,nop,TS val 664983480 ecr 1770822], length 0
17:32:42.824154 IP 10.5.100.134.54832 > xx.xxx.xxx.xxx.9000: Flags [.], ack 1, win 4117, length 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment