Ask Your Question

Why doesn't tcpdump's filter take effect?

asked 2020-05-12 07:03:28 +0000

nanxiao gravatar image

Hi Community,

Greetings from me!

My tcpdump version is:

$ tcpdump --version
tcpdump version tcpdump version 4.9.3 -- Apple version 90.100.1
libpcap version 1.9.1
LibreSSL 2.8.3

I tried to use tcpdump to filter some packets:

$ tcpdump -nr tests/traces/gtp/gtp-tcp-no-data-rst-after-fin.anon.pcap port 2152
reading from file tests/traces/gtp/gtp-tcp-no-data-rst-after-fin.anon.pcap, link-type EN10MB (Ethernet)

Nothing is found, but actually there are packets whose port is 2152:

$ tcpdump -nr tests/traces/gtp/gtp-tcp-no-data-rst-after-fin.anon.pcap
reading from file tests/traces/gtp/gtp-tcp-no-data-rst-after-fin.anon.pcap, link-type EN10MB (Ethernet)
15:57:40.095481 IP > UDP, length 186
15:57:40.288664 IP > UDP, length 130
16:00:07.540641 IP > UDP, length 72
16:00:08.041768 IP > UDP, length 72

Did I miss something? Thanks very much in advance!

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-05-12 12:20:36 +0000

Jim Young gravatar image

Adding the -e option to the tcpdump command to display link level headers may reveal the presence of 'ethertype 802.1Q (0x8100)' or some other additional headers. If there are additional headers then you will need to modify your pcap_filter expression.

For example if there are 802.1Q headers then modify the pcap_filter from 'port 2152' to 'vlan and port 2152'.

If the capture includes both packets with and without 802.1Q headers a more complex pcap_filter might be needed such as 'port 2152 or vlan and port 2152'.

Review the pcap_filter(7) man page for more details on how the vlan|mpls|pppoes|geneve keywords changes the decoding offsets for the remainder of expression.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-05-12 07:03:28 +0000

Seen: 268 times

Last updated: May 12 '20