LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 11-11-2004, 05:50 AM   #1
asim_s2000
LQ Newbie
 
Registered: Oct 2004
Posts: 6

Rep: Reputation: 0
tcpdump output help


hey guys, im doing some work for uni an i need to make sense of tcpdump readings.


15:44:13.775216 IP 192.168.2.5.32773 > 192.168.2.1.domain: 63131+ PTR? 1.2.168.192.in-addr.arpa. (42)

can someone help explain it. I know the first part is a timestamp, then theres a local ip, forwarding to a gateway. but then i dont understand the rest, a reverse dns lookup to where?
 
Old 11-11-2004, 06:41 AM   #2
scowles
Member
 
Registered: Sep 2004
Location: Texas, USA
Distribution: Fedora
Posts: 620

Rep: Reputation: 31
Host 192.168.2.5 issued a DNS request to host 192.168.2.1 asking for the reverse lookup record (PTR) for IP 192.168.2.1. The actual DNS query for a PTR record is the IP reversed with in-addr.arpa appended. i.e. 1.2.168.192.in-addr.arpa
 
Old 11-11-2004, 07:07 AM   #3
asim_s2000
LQ Newbie
 
Registered: Oct 2004
Posts: 6

Original Poster
Rep: Reputation: 0
Thanks that expained it well.

now ive jus gotta explain about 10 ping packets and 26 telnet packets
 
Old 11-11-2004, 07:41 AM   #4
asim_s2000
LQ Newbie
 
Registered: Oct 2004
Posts: 6

Original Poster
Rep: Reputation: 0
15:45:55.547961 IP 192.168.2.5 > p23.www.re2.yahoo.com: icmp 64: echo request seq 1
15:45:55.674642 IP p23.www.re2.yahoo.com > 192.168.2.5: icmp 64: echo reply seq 1


This here icmp would mean ping of 64 bytes. What im tryin to understand is, is this a ping request to that yahoo address which then replies to the address as having been pinged? or does it ping back?
 
Old 11-11-2004, 08:30 AM   #5
scowles
Member
 
Registered: Sep 2004
Location: Texas, USA
Distribution: Fedora
Posts: 620

Rep: Reputation: 31
Conceptually, your interpretation of the tcpdump capture is correct. Although I would suggest that you read: man ping - for a better description of ICMP echo request/replies.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help interpreting tcpdump output line wrw3 Linux - Networking 0 10-29-2005 07:47 PM
how to get a formatted output of the tcpdump abirami Linux - Networking 4 10-18-2004 12:57 AM
Summarizing tcpdump output Xit Linux - Networking 1 08-07-2004 02:35 PM
tcpdump output hampel Linux - Security 9 07-18-2003 12:53 AM
Help reading TCPDUMP output BenCarlisle Linux - Networking 3 02-27-2003 02:35 PM


All times are GMT -5. The time now is 07:14 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration