LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-27-2003, 11:53 AM   #1
BenCarlisle
LQ Newbie
 
Registered: Feb 2003
Distribution: RH7,RH8,Slack
Posts: 29

Rep: Reputation: 15
Help reading TCPDUMP output


I am getting severe tcp traffic and I was wondering if anyone could help?? I am obviously a networking newbie, so any help is greatly appreciated.

Here is a sample of the tcpdump output:

11:01:36.404310 xxxx.xx.client2.attbi.com.1789 > 10.10.10.10.ircd: R [tcp sum ok] 0:0(0) win 0 (ttl 151, id 29779, len 40)
11:01:36.404310 xxxx.xx.client2.attbi.com.1789 > 10.10.10.10.ircd: R [tcp sum ok] 0:0(0) win 0 (ttl 160, id 29779, len 40)
11:01:36.404310 xxxx.xx.client2.attbi.com.1789 > 10.10.10.10.ircd: R [tcp sum ok] 0:0(0) win 0 (ttl 152, id 29779, len 40)
11:01:36.404310 xxxx.xx.client2.attbi.com.1789 > 10.10.10.10.ircd: R [tcp sum ok] 0:0(0) win 0 (ttl 151, id 29779, len 40)


As you can see, the source is on the ATTBI network (which is what I am on as well). The destination is what is confusing me... 10.10.10.10 is not my IP address. Why am I getting these packets? I'm getting loads of them, always from the same source.

Also the RESET flag is set for all of these, and there is no data being sent. What the heck is going on?

-B
 
Old 02-27-2003, 12:55 PM   #2
SlickWilly
Member
 
Registered: Dec 2002
Posts: 327

Rep: Reputation: 30
What kindof network are you connected to there?
 
Old 02-27-2003, 02:27 PM   #3
BenCarlisle
LQ Newbie
 
Registered: Feb 2003
Distribution: RH7,RH8,Slack
Posts: 29

Original Poster
Rep: Reputation: 15
Well, I'm on two networks, my machine uses IP Masq to route local traffic.

* eth0 is AT&T Broadband Cable - it initializes through DHCP (pump), my BCAST is 255.255.255.255 and my MASK is 255.255.248.0.

* eth1 is an internal LAN, Class-C 192.168.1 network.

Does that answer your question? Is there anything else I can do to help clarify?
 
Old 02-27-2003, 03:35 PM   #4
SlickWilly
Member
 
Registered: Dec 2002
Posts: 327

Rep: Reputation: 30
Yeah, it helps...

What you're seeing there is 'shared traffic'. I expect they've configured their cable modems to the 10. network (I know mine does). Although 10.10.10.10 seems a little fishy.

Anyway. This isn't aimed at you. The cable network has shared segments, the same way that a hub (not a switch mind) sends data to all ports, so does the cable network.

Hence you'll see ARP requests, DHCP stuff, free-floating crud passed along to your cable modem, and you'll be able to listen in on it, should you so desire.

The way I read your dump, to answer the question is :

client2.attbi.com is sending packets from port 1789 to 10.10.10.10 on port um.. (quick lookup) 6667. The packets are Reset packets with a window (return data) size of Zero. Which is expected for Reset packets.

Basically what you're seeing is some host sending traffic to some (private, and certainly not internet routable) ip address attempting to reset a connection on ircd port - Which 'services' says is internet relay chat (I assume daemon). This may or may not actually be what the port is used for.

Anyway, as I said, this traffic isn't destined for you, but since your network card is (I think - slap me if I'm wrong) being put into promiscuous mode by tcpdump you're listening in on all the conversations that happen to pass by your cable modem.. Which, under the nature of cable modems is rather alot, and probably has nothing to do with you...



Slick.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help interpreting tcpdump output line wrw3 Linux - Networking 0 10-29-2005 08:47 PM
tcpdump output help asim_s2000 Linux - Networking 4 11-11-2004 09:30 AM
how to get a formatted output of the tcpdump abirami Linux - Networking 4 10-18-2004 01:57 AM
Summarizing tcpdump output Xit Linux - Networking 1 08-07-2004 03:35 PM
tcpdump output hampel Linux - Security 9 07-18-2003 01:53 AM


All times are GMT -5. The time now is 04:57 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration