Linux Labs
Linux Labs
EN

Networking / Stage 14 of 15

What the packets show

Not running Starting usually ~20 s
Leave the lesson

Step 1 of 7 · on a machine · 5 min

The monitor waits until the timeout

What you will learn

  • Read a tcpdump line — who sent the packet to whom and with which flags.
  • Tell from the packets the silence of drop from the refusal of reject and an empty port.
  • Keep the packets you need with a filter and save them to a file.

A monitor on lab-node1 checks the site 192.0.2.12:8080 on lab-node2 every few seconds and reports a timeout. By the table from the previous lesson, a packet or its reply gets lost on the way. Exactly where shows up in the packets themselves.

The machines are the same lab-node1 and lab-node2 namespaces. The tcpdump program prints the packets that pass through a machine's interface; on lab-node2 it is called lab1.

Exercise · look

What reaches lab-node2

Request the site at 192.0.2.12:8080 from lab-node1, then look at four port 8080 packets on the lab1 interface of lab-node2.

First, predict

The monitor reports a timeout. What will tcpdump show on lab-node2?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Check yourself 1 question

The monitor waits until the timeout. Judging by the tcpdump output, where does the exchange break?

  • There is no reply at all — not after one second, not after two, when the monitor repeats the request.

  • There are no lines from 192.0.2.12 in the output: the reply did not even leave lab1.

  • The same SYNs show up on lab1 of lab-node2, so they left lab-node1 and arrived.

The requests reach lab1, and not a single packet goes back: lab-node2 itself stays silent.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…