Could not figure out filters (port,protocol) of tcpdump command!

[vipulkrishna]

Could not figure out filters (port, protocol) of tcpdump command!
If I run a command without -w flag and then run ping it shows output below but when I attach -w flag in this then nothing is being written in pcap file. Now if I do not put filters then pcap file becomes huge in seconds and the size of the whole directory starts increasing automatically untill I reset the workspace. I am stuck in milestone 2

[nabhanpv]

Hi @vipulkrishna,
By nothing is being written in pcap file, do you mean the size of the file after running tcpdump is remaining zero itself or you can’t see anything on opening the file?

[vipulkrishna]

you are gonna suggest me to refresh it?

[nabhanpv]

If it’s something like the file size is non-zero on checking but you can’t see anything on opening the file, it could be because the .pcap file having root as owner and we usually open files with crio-user

[vipulkrishna]

I want to filter on esn5 in between regular traffic and ping google.com. How can I do that?

[yashkedia]

pcap_check_tcp_handshake
what we have to check in this task i think i have completed ecery milestone but dunno why it is failing

[nabhanpv]

@vipulkrishna
As you rightly mentioned in the description about pcap file size exploding w/o filters, we’ll have to optimally use the filters. Now, how to filter using tcpdump?
This could help

Capturing packages

@ankyy Like a fish net catch different types of fishes big,small etc, tcpdump is a tool to catch all network requests coming to a computer. Now, there are different type of network requests. For example, website content are usually retrieved by a HTTP request which translates to sending a network packet having data in accordance with the HTTP protocol. Also, common requests like HTTP, SSH use predefined ports(although can be changed). HTTP - 80, FTP - 21, SSH-22, DNS-53 Coming to you…

Also, you can use multiple filters simultaneously if required. Search about how to use a combination of filters with tcpdump on Google.

[nabhanpv]

@yashkedia
What review message are you getting in the unit testing log file?

[yashkedia]

i was not able to find the packer number for three way handshake

[nabhanpv]

This could help

TCP 3 way handshake is just not happening

So i have connecting to vsftpd using filezilla and even transferred files successfully. But when the tcpdump -i any port not 8080 -w command which im using is correct right? In the pcap file i filtered according to find 3 way handshake but all im seeing is the 1st and 2nd step but the 3rd (acknowledgement isnt happening) [aa]

[vipulkrishna]

If I am applying udp as an filter both dns packets should capture but when I run it and run ping after it it does not gives any output below of tcpdump command in terminal. why is that ?

[nabhanpv]

• DNS can make use of both TCP and UDP

• See here for which protocol ping command uses
  https://www.paessler.com/it-explained/ping

[vipulkrishna]

Thanks, I passed milestone 2. what would I do without you.

[vipulkrishna]

I was wrong. It is showing output fine

[nabhanpv]

Cool, congrats!
I’m just returning favors