CODEWITHSUNDEEP
fragmenttcpdump
Henry
Henry

Reputation: 151

tcpdump to capture error IP Flags packets

I am using: 

# tcpdump -i gphy -vv -B 28000 -s 120 -w log.pcap tcp portrange 10032-10001

to capture packets which I sent out from a host, and I notice all the packets with IP flags altered are missing, is there away to capture all packets even if IP flags is not correctly programmed ?

Upvotes: 0

Views: 1295

Answers (1)

gratio
gratio

Reputation: 83

This non deterministic behaviour could occur due to multiple potential reasons, such as incorrectly setting the 'Do Not Fragment' bit in IP flags, which may result in the packet being dropped. Perhaps you should ensure that you've correctly set the IP flags field to check whether the packet is being sent. If it is being sent (and not being dropped during transmission), with the given command you should be able to capture all packets (provided they match the filter).

Upvotes: 1

Related Questions