This is our old Q&A Site. Please post any new questions and answers at

Is there anyway to capture the sate of ONLY incoming packets to the sender (like the tcpprobe does) using either tcpdump or wireshark (or tshark)? I tried with the following command but i am not getting the right packets. This only captures packets with length of less than the MTU (outstanding bytes). I am sending an iperf traffic from the client ( to the server (

sudo tcpdump -i eth1 tcp and dst host -w test.pcap

asked 15 May '17, 07:38

armodes's gravatar image

accept rate: 0%

edited 15 May '17, 07:47

Can you clarify? A "sender" is someone sending, so it's outgoing, not incoming. Do you mean a "server"? Not really sure what you're trying to get... using the "dst host" part should make sure you only get one direction.

(15 May '17, 13:31) Jasper ♦♦

yes the sender is someone sending Jasper and its ip is

(16 May '17, 03:21) armodes

Then dst host will capture packets sent to the "sender". See my answer.

(16 May '17, 11:17) Guy Harris ♦♦

Both Wireshark/TShark/dumpcap and tcpdump capture packets, not "state", so I assume you mean that you only want to capture packets going in one direction. If the "sender" is the host sending the perf traffic, i.e., you would want a filter of

tcp and src host

I.e., you want packets with the sender's IP address as the source (src), not as the destination (dst).

As for "packets with length of less than the MTU", I presume you mean "less than or equal to" - there's nothing that should prevent full-MTU-size packets from being captured - and the "M" in "MTU" stands for "maximum", so the only way you should ever see packets with a length greater than the MTU is if packets are being handed to the capture mechanism after TCP reassembly, for example, if the network adapter is doing TCP reassembly (TCP reassembly offloading) or if the kernel is not directly handing received packets to the capture mechanism but is, instead, handing the results of TCP reassembly to the capture mechanism.

permanent link

answered 15 May '17, 19:00

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

but that's not how tcpprobe works.

(16 May '17, 08:04) armodes

"probe" and "dump" are different words; why does the way that tcpprobe work matter here?

(16 May '17, 11:17) Guy Harris ♦♦

because i want to infer the congestion window of the sender from the traffic that we capture

(17 May '17, 17:58) armodes

Then you definitely need something that works differently from tcp_probe, because the tcp_probe kernel module works by "inserting a hook into the tcp_recv processing path" on the machine on which you're running it - if you want to infer the congestion window purely from network traffic, you need something different. (It's like trying to diagnose a medical disorder without actually being able to do tests on the patient.)

I.e., the tcp_probe kernel module has access to the connection state on that machine - it can just get the congestion window from the kernel TCP code's data structure. Programs that capture network traffic do NOT have access to kernel state information, so they must infer it. It's literally impossible for tcpdump or TShark or Wireshark or any other network analyzer to work like a Linux kernel module such as tcp_probe.

So you'll have to capture whatever traffic is needed for whatever code you're going to use to read the capture and infer the congestion window (the congestion window is not something that's transmitted over the wire!), and, if you're going to use a capture filter, you'll have to use a capture filter that captures the traffic you need. tcp and dst host will capture packets sent to; tcp and src host will capture packets sent from; tcp and host will capture packets sent to or from

(17 May '17, 18:21) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 May '17, 07:38

question was seen: 2,035 times

last updated: 17 May '17, 18:21

p​o​w​e​r​e​d by O​S​Q​A