LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 10-22-2007, 04:35 PM   #1
lumix
Member
 
Registered: Mar 2007
Distribution: Hardy (Gnome on Ubuntu 8.04) on Compaq N600c laptop
Posts: 323

Rep: Reputation: 30
tcpdump output question


Just to confirm:

1) in the default output, the number in parentheses is the the packet size? If so, does this include headers (tcp, ip, http, etc..)?

2) the sequence numbers are actually translated from original to reflect this?

from the manual:

"On subsequent packets of the conversation, the difference betweenthe current packet’s sequence number and this initial sequence number is printed. This means that sequence numbers after the first can be interpreted as relative byte positions in the conversation’s data stream (with the first data byte each direction being ‘1’).
 
Old 10-23-2007, 09:29 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,373

Rep: Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962Reputation: 1962
Yes, the number is the *packet* size, ie. IP and up. if you an an -e to the command you get the layer 2 data too, which then includes the *frame* size, ie.. ethernet and up.

and tcpdump won't cahnge a sequence number. it won't change any data at all, otherwise it'd be a useless tool...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
modifying tcpdump output sautila LinuxQuestions.org Member Intro 0 03-09-2007 06:05 PM
tcpdump output help asim_s2000 Linux - Networking 4 11-11-2004 08:30 AM
how to get a formatted output of the tcpdump abirami Linux - Networking 4 10-18-2004 12:57 AM
Summarizing tcpdump output Xit Linux - Networking 1 08-07-2004 02:35 PM
tcpdump output hampel Linux - Security 9 07-18-2003 12:53 AM


All times are GMT -5. The time now is 12:09 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration