0

Link to question tcpdump to see the first packet

Hi Moderators -- This seems like a good question to me, how to find certain kinds of packets with packet tools such as tcpdump, tshark etc. Most especially because it's not trivial. I have a good answer for it, would like to post it. Please can we reopen it? Thanks, Jonathan.

1 Answer 1

Reset to default
1

This wasn't a question of "how to find certain kinds of packets". UDP is connectionless, so there's no specific type of packet to look for. The "initial" packet is simply the first one you see, and that's a programming question.

How to find a specific bit pattern is a more acceptable question. However, it is a round-about way to ask how to use a specific application (tcpdump, wireshark, etc.) Those applications use a fairly universal language (BPF, pcap, etc.), so I wouldn't vote them off-topic.

3
  • Of course UDP is itself connectionless; once it starts going through NAT and firewalls there's state which behaves in many ways like a connection. Hence, "first packet between A and B we see for a certain amount of time" is something you might need to look for That's why I thought it a good question.
    – jonathanjo
    Commented Nov 5, 2017 at 13:01
  • 1
    And that's a programming question. That can't be written as a BPF/pcap rule.
    – Ricky
    Commented Nov 5, 2017 at 20:13
  • The distinction between programming tcl on a router and lua on a packet capture machine doesn't seem important; the fact that both these are exactly the things a network engineer needs to do seems much more important. The fact that (apparently) we can't do this with pcap makes it more important to answer. Let's agree to differ and leave it there.
    – jonathanjo
    Commented Nov 5, 2017 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .