Forum Discussion

Dany_Lee_19801's avatar
Dany_Lee_19801
Icon for Nimbostratus rankNimbostratus
Jun 02, 2010

tcpdump interpretation

Hi guys,

 

 

I tried googling for this info, but couldn't find anything useful. How do i interpret the additional info behind the tcpdump line below:

 

 

[root@TC1-03-HSM1-LB1:Active] config tcpdump -npi VLAN_INTERNAL host 10.100.60.52 tcpdump: listening on VLAN_INTERNAL 00:14:19.421187 10.100.60.20 > 10.100.60.52: icmp: echo request (DF)

 

00:14:19.421668 10.100.60.52 > 10.100.60.20: icmp: echo reply (DF) tail-type 2 len 4 f5-med cap too small (have 4 need 6)

 

00:14:20.367699 10.100.59.31.37506 > 10.100.60.52.4200: P 3179599216:3179599217(1) ack 915029818 win 49640 (DF)

 

00:14:20.388695 10.100.60.52.4200 > 10.100.59.31.37506: . ack 1 win 28672 tail-type 1 len 1 f5-low cap too small (have 1 need 33) tail-type 43 len 0 f5 type 43 len 0

 

00:14:20.389916 10.100.59.31.37506 > 10.100.60.52.4200: P 1:11(10) ack 1 win 49640 (DF)

 

00:14:20.396748 10.100.60.52.4200 > 10.100.59.31.37506: P 1:33(32) ack 11 win 28672

 

00:14:20.421192 10.100.60.20.43841 > 10.100.60.52.4200: S 221353047:221353047(0) win 5840 (DF)

 

00:14:20.421654 10.100.60.52.4200 > 10.100.60.20.43841: S 1134924289:1134924289(0) ack 221353048 win 28672

 

00:14:20.422146 10.100.60.20.43841 > 10.100.60.52.4200: . ack 1 win 5840 (DF)

 

00:14:20.422153 10.100.60.20.43841 > 10.100.60.52.4200: F 1:1(0) ack 1 win 5840 (DF)

 

00:14:20.422629 10.100.60.52.4200 > 10.100.60.20.43841: F 1:1(0) ack 1 win 28672 tail-type 2 len 4 f5-med cap too small (have 4 need 6)

 

00:14:20.422637 10.100.60.52.4200 > 10.100.60.20.43841: F 1:1(0) ack 2 win 28672 tail-type 2 len 4 f5-med cap too small (have 4 need 6)

 

00:14:20.423120 10.100.60.20.43841 > 10.100.60.52.4200: . ack 2 win 5840 (DF)

 

 

I'm referring to these words:

 

tail-type 2 len 4 f5-med cap too small (have 4 need 6)

 

 

Any help is appreciated.

 

 

Best regards,

 

dany

 

2 Replies

  • Hello Dany,

     

     

    I've not seen that before and I can't find reference to that particular message in the tcpdump manpages etc. It doesn't appear that you've manually altered the snarf length with '-s' either which would be my first thought. If you write the pcap to a file and open with Wireshark, does this happen to provide you with any more details?
  • Yeah, I think the default snap length captured if you don't set it explicitly with -s is 68 bytes. So Chris' suggestion seems like a good one. On LTM, you can use -s 0 to specify no limit on the snap length. Else, -s 1600 should work fine too.

     

     

    Aaron