One output line is one packet: when, from whom, to whom and what is in it.
tcpdump shows the packets passing through a network interface. Only root may read them: without sudo you get You don't have permission to perform this capture on that device.
| Part of the command | What it does |
|---|---|
-i lab1 |
listens on the lab1 interface |
-n |
prints addresses and ports as numbers: without it 8080 turns into http-alt |
-c 4 |
stops after four packets; without it only Ctrl+C stops it |
tcp port 8080 |
a filter: TCP with port 8080 only, both ways |
The start of a line from your output:
Left of > is the sender, address and port joined by a dot; on the right is the receiver. Flags [S] is the SYN flag: the first packet of a TCP connection, a request to open it. Then come the seq number, the TCP parameters and length 0 — the packet carries no data.
A client port shows up again a second later, with the same seq. That is a repeat: the client's kernel got no reply and sent the SYN again. The monitor's next attempt comes from a different port.
Why there is no reply shows in the rules of lab-node2:
They say tcp dport 8080 drop. tcpdump copies a packet at the interface: an incoming one before the nftables filter, an outgoing one after it. That is why the dropped SYNs are in the output, and the reply is not: there was none.
On another server a rule in the output chain drops its [S.] replies, while the filter leaves incoming packets alone. What will tcpdump show on that server's interface?
-
tcpdumpgets the incoming SYN before the filter, and theoutputchain does not touch it. -
Without an incoming SYN the server would not reply at all. The SYN is in the output, the replies are not.
-
tcpdumpsees an outgoing packet after the filter: a dropped reply never reaches the interface.
tcpdump copies a packet at the interface: an incoming one before the filter, an outgoing one after it. So the picture matches an input drop: a SYN and repeats with no reply. nft list ruleset on the server tells them apart.
Key points
-
A tcpdump line is one packet: the time,
sender > receiver, the flags and the data length. - A SYN with no reply and its repeat from the same port: the request arrived, the reply did not.
- tcpdump sees an incoming packet before the filter and an outgoing one after it.