Ping and tcpdump at the same time

Question

The situation is this - There is one script on the server which make ping to somewhere and I don't know to where. I want to see to which machine is this ping make and why is returning FAILED.

What I make is to turn tcpdump in one terminal and at the same time turning the script which make ping in second terminal but I'm not sure that is capturing the actual ping.

This is the command I use

tcpdump -w - | tee ping.pcap | tcpdump -r -

Is this the right way of doing this or there is other way?

Edit:

The problem is that when I start tcpdump there is a lot of traffic and I can't recognize which one is from this ping...

score 18 · Accepted Answer · answered Sep 24 '15 at 06:29

18

Try:

tcpdump -i eth0 icmp

which will list ping traffic on interface eth0.

answered Sep 24 '15 at 06:29

garethTheRed

33,289
4
92
101

1

Thank's for the answer but I still doesn't see the ping request from second terminal. – S.I. Sep 24 '15 at 06:42
Yes, I saw what is causing the fail of the ping. Thank's – S.I. Sep 24 '15 at 06:47
Is it outgoing and incoming both? how to check outgoing ping send and reply? – Oct 03 '19 at 11:53

score 2 · Answer 2 · answered Sep 24 '15 at 06:27

You can use tcpdump -n icmp to filter on ping requests and replies. I added the -n switch to prevent name lookups. You might have several interfaces in your host so it might be necessary to add the -i ethX switch to specify the correct interface.

Note that the filter - icmp in this case - should be the last part of the command.

score 1 · Answer 3 · answered Aug 05 '18 at 01:47

Always try going through the man pages of unix/linux commands before using them. tcpdump command has different options. It is very interesting to explore all of them.

You need to have root access in order to capture the dump using tcpdump command.

Example:

tcpdump -i any -s 0 -v -w ping.pcap

The above command will capture all the packets on all the available ethernet interfaces, with unlimited snaplength, verbose and will write the capture into file ping.pcap.

Similarly you can use inline filters to filter the packets for a specific host.

Example:

tcpdump -i any -s 0 -v -w ping.pcap 135.250.80.55

The above command will capture all the packets from 135.250.80.55 and to 135.250.80.55.

Ping and tcpdump at the same time

3 Answers3