Quantcast
Channel: Active questions tagged ubuntu - Stack Overflow
Viewing all articles
Browse latest Browse all 6015

Why does tcpdump capture only half the packets that is received by the filter?

$
0
0

OS:Ubuntu 16.04

I created some packets using Scapy packet creator tool. The destination address for the packets is my localhost (ie) 127.0.0.1

    while(True):         packet = IP(src='127.0.1.1',dst="127.0.0.1")/TCP(dport=80)/"from scapy packet"         send(packet)         print "tcp sent"

Now,when i run a tcpdump on my machine and stop after some time, the packets captured is only half the number of packets received by the filter, but none of the packets are dropped. Here is the output of tcpdump:

 sudo tcpdump -i any dst 127.0.0.1 OUTPUT:     119 packets captured     238 packets received by filter     0 packets dropped by kernel

Even if i run tcpdump -i lo , i get the same problem. Using tshark instead of tcpdump also displays the same number of packets captured.

Why does this happen? Is it due to small tcpdump buffer size? How can i capture rest of the packets?


Viewing all articles
Browse latest Browse all 6015

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>