Freebsd – tcpdump don’t show src and dst address

freebsdtcpdump

I'm having a problem with a tcpdump. The output is:

21:53:53.877873 MPLS (label 266837, exp 0, [S], ttl 255), IP, length: 193
21:53:53.878037 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: 1332
21:53:53.878037 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: 1332
21:53:53.878050 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: 1332
21:53:53.878070 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: 1332
21:53:53.878149 MPLS (label 326819, exp 0, [S], ttl 255), IP, length: 1332
21:53:53.878430 MPLS (label 279951, exp 0, [S], ttl 255), IP, length: 50

And not the expected:

22:08:12.029608 IP 10.57.169.224.49612 > 68.171.231.64.51620: Flags [.], ack 2761, win 65535, length 0
22:08:12.029620 IP 10.57.169.224.49612 > 68.171.231.64.51620: Flags [.], ack 4141, win 65535, length 0
22:08:12.029631 IP 10.57.169.224.49612 > 68.171.231.64.51620: Flags [.], ack 5521, win 65535, length 0
22:08:12.029657 IP 206.51.26.193.19063 > 10.45.14.157.19060: UDP, length 386
22:08:12.029694 IP 206.51.26.193.19064 > 10.56.143.63.19060: UDP, length 1300

So, with this output, the host filter don't work.

When i put the -v option or -vv option, i get the IP's (src and dest):

21:54:04.727826 MPLS (label 299984, exp 0, [S], ttl 255)
        IP (tos 0x0, ttl 55, id 26147, offset 0, flags [DF], proto TCP (6), length 1500)
    72.21.91.19.http > 186.165.14.97.42408: Flags [.], seq 702450604:702452064, ack 2572860166, win 245, length 1460
21:54:04.727867 MPLS (label 262205, exp 0, [S], ttl 255)
        IP (tos 0x48, ttl 252, id 357, offset 0, flags [none], proto UDP (17), length 1328)
    10.101.12.105.19060 > 206.51.26.193.19061: UDP, length 1300
21:54:04.727880 MPLS (label 279961, exp 0, [S], ttl 255)
        IP (tos 0x0, ttl 49, id 50980, offset 0, flags [DF], proto TCP (6), length 109)
    69.167.149.108.9933 > 181.185.41.153.53120: Flags [P.], seq 3203122401:3203122470, ack 2844602734, win 63504, length 69
21:54:04.727891 MPLS (label 264603, exp 0, [S], ttl 255)
        IP (tos 0x0, ttl 81, id 59423, offset 0, flags [DF], proto TCP (6), length 200)
    69.171.247.29.https > 186.25.255.129.50605: Flags [P.], seq 2597755680:2597755840, ack 2375027064, win 35, length 160

But -v and -vv option don't work with -w option, so the filter don't work and the file generated is empty.

Anyone know how to make the tcpdump print the IP's and host filter works?

I'm using SVOS 9.20.0200 (FreeBSD 8.2 based), tcpdump version 4.0.0 and libpcap version 1.0.0

Best Answer

Host filtering in tcpdump works on MPLS-prefixed packets if you specify "mpls" before the "host" primitive.

$ tcpdump 'mpls and host example.com'

or

$ tcpdump 'host example.com or (mpls and host example.com)'

if you're dealing with packets with and without the MPLS prefix.

Related Question