capturing loopback with tcpdump

trek413 · 12-05-2006, 03:48 PM

I want to capture packets going over loopback without retaining all of the duplicates. Is there anyway to filter this out with tcpdump?

Thanks for your help.

acid_kewpie · 12-05-2006, 04:06 PM

what do you mean by duplicates? if you mean things like restransmissions, or retries of udp conections, then it's not tcpdump's place to regard those packets as anything special, as they are "duplicated" at much higher osi layers than the ip / tcp level's of tcpdump

trek413 · 12-06-2006, 08:36 AM

sorry, I should've been more clear. On loopback, the packet is sent and received. Tcpdump captures both the outgoing and incoming packets. Is there any way to differentiate between the packets sent by lo and the packets received by lo?

Thanks.

acid_kewpie · 12-06-2006, 11:22 AM

to be honest i'm not seeing that at all. can you show an example output containing this replication? note that as it's a single interface, lo will be sending and recieving between itself. if i do a telnet to localhost i see

Code:

[root@kermit ~]# tcpdump -i lo
17:21:20.038428 IP localhost.localdomain.49645 > localhost.localdomain.telnet: S 1657860734:1657860734(0) win 32792 <mss 16396,sackOK,timestamp 120682619 0,nop,wscale 6>
17:21:20.038812 IP localhost.localdomain.telnet > localhost.localdomain.49645: R 0:0(0) ack 1657860735 win 0

which doesn't have any replications as fasr as a take your use of it to be.