tcpdump output help

asim_s2000 · 11-11-2004, 05:50 AM

hey guys, im doing some work for uni an i need to make sense of tcpdump readings.

15:44:13.775216 IP 192.168.2.5.32773 > 192.168.2.1.domain: 63131+ PTR? 1.2.168.192.in-addr.arpa. (42)

can someone help explain it. I know the first part is a timestamp, then theres a local ip, forwarding to a gateway. but then i dont understand the rest, a reverse dns lookup to where?

scowles · 11-11-2004, 06:41 AM

Host 192.168.2.5 issued a DNS request to host 192.168.2.1 asking for the reverse lookup record (PTR) for IP 192.168.2.1. The actual DNS query for a PTR record is the IP reversed with in-addr.arpa appended. i.e. 1.2.168.192.in-addr.arpa

asim_s2000 · 11-11-2004, 07:07 AM

Thanks that expained it well.

now ive jus gotta explain about 10 ping packets and 26 telnet packets

asim_s2000 · 11-11-2004, 07:41 AM

15:45:55.547961 IP 192.168.2.5 > p23.www.re2.yahoo.com: icmp 64: echo request seq 1
15:45:55.674642 IP p23.www.re2.yahoo.com > 192.168.2.5: icmp 64: echo reply seq 1

This here icmp would mean ping of 64 bytes. What im tryin to understand is, is this a ping request to that yahoo address which then replies to the address as having been pinged? or does it ping back?

scowles · 11-11-2004, 08:30 AM

Conceptually, your interpretation of the tcpdump capture is correct. Although I would suggest that you read: man ping - for a better description of ICMP echo request/replies.