tcpdump Flags [. ]

casperdaghost · 09-27-2012, 12:40 AM

this is a truncated output from a tcp dump

what do the Flags [.] , [P.] and [S.] mean - and are there wepages , tutorials which could point me in the direction of leaning to read tcpdump output.

Code:

09:09:23.883403 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 1, win 8192, length 0
09:09:24.011326 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [P.], ack 1, win 8192, length 49
09:09:24.011329 IP 192.168.2.45.34583 > 172.54.4.5.45608: Flags [.], ack 50, win 5840, length 0
09:09:24.011359 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 1, win 8192, length 0
09:09:24.011457 IP 192.168.2.45.34583 > 172.54.4.5.45608: Flags [P.], ack 50, win 5840, length 33
09:09:24.011488 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 34, win 8159, length 0
09:09:24.011491 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 34, win 8191, length 0
09:09:24.011511 IP 192.168.2.45.34583 > 172.54.4.5.45608: Flags [P.], ack 50, win 5840, length 13
09:09:24.011541 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 47, win 8178, length 0
09:09:24.011544 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 47, win 8191, length 0
09:09:24.017494 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [P.], ack 47, win 8191, length 3
09:09:24.054194 IP 192.168.2.45.34583 > 172.54.4.5.45608: Flags [.], ack 53, win 5840, length 0
09:09:24.054224 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 47, win 8191, length 0
09:09:24.719107 IP 192.168.2.45.34583 > 172.54.4.5.45608: Flags [P.], ack 53, win 5840, length 3
09:09:24.719138 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 50, win 8188, length 0
09:09:24.719140 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 50, win 8191, length 0
09:09:25.005134 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [P.], ack 50, win 8191, length 3
09:09:25.005136 IP 192.168.2.45.34583 > 172.54.4.5.45608: Flags [.], ack 56, win 5840, length 0
09:09:25.005165 IP 172.54.4.5.45608 > 192.168.2.45.34583: Flags [.], ack 50, win 8191, length 0

Berhanie · 09-27-2012, 02:19 AM

it's documented in the tcpdump man page under the heading "TCP packets":

Code:

       The general format of a tcp protocol line is:
              src > dst: flags data-seqno ack window urgent options
       Src and dst are the source and destination IP addresses and ports.  Flags are some  combination
       of  S  (SYN),  F  (FIN), P (PUSH), R (RST), U (URG), W (ECN CWR), E (ECN-Echo) or `.' (ACK), or
       `none' if no flags are set...

Berhanie · 09-27-2012, 07:32 AM

@Hendri2201, spamming other people's threads (also, here) is not the way to ask for help with your problems.