Forum Discussion
dirome
Cirrus
CirrusHow can I interpret the results in tcpdump?
Hi,
I have some questions with the command the tcpdump i need your help for clarify how can i read this, for example i send you the next result and i need that you explain me how read:
17:07:33....
What_Lies_Bene1
Cirrostratus
CirrostratusThis may help: http://packetpushers.net/masterclass-tcpdump-interpreting-output/.
As to the output, by line;
1: ACK packet from 64.39.103.201 source port 42214 to 186.113.14.108 destination port 80
2: RST packet back to 64.39.103.201, same ports
==The connection between hosts (using these ports) is closed==
3: SYN packet from 64.39.103.201 source port 28969 to 186.113.14.108 destination port 80
4: SYN/ACK packet back
==New connection being established
5: SYN packet from 64.39.103.201 source port 28972 (*Note, different port to 3:) to 186.113.14.108 destination port 80
6: SYN/ACK packet back
==Another new connection being established
