Network Tools on Support Tools

Understanding 'TCP Segment of a Reassembled PDU' in Wireshark

Fri, 13 Oct 2023 12:15:00 -0500

Understanding ‘TCP Segment of a Reassembled PDU’ in Wireshark

Wireshark often marks TCP packets with the label “TCP segment of a reassembled PDU.” This annotation can seem perplexing but serves a crucial purpose in network analysis. Let’s delve into why Wireshark uses this label and what it signifies.

In essence, Wireshark uses the “TCP segment of a reassembled PDU” label when a packet contains part of a longer application message or document, and the complete message or document is assembled across multiple packets.

How to Use tcpdump to Capture Incoming Traffic

Fri, 13 Oct 2023 11:30:00 -0500

How to Use tcpdump to Capture Incoming Traffic

If you need to capture incoming network traffic using tcpdump, the most reliable option is to use the -Q option as follows:

bash
tcpdump -Qin other filter logic

The -Q option may not be supported on all platforms, and an alternative is to use equivalent logic in BPF (Berkeley Packet Filter) syntax in the form of the inbound predicate:

How to Filter MAC Addresses Using tcpdump

Fri, 13 Oct 2023 10:45:00 -0500

How to Filter MAC Addresses Using `tcpdump`

Suppose you’re using tcpdump for network monitoring and must filter traffic based on MAC addresses. In that case, you can utilize the “ether” qualifier to specify Ethernet addresses in the standard colon-separated format. Here’s how you can do it:

To capture any broadcast traffic, use the following command:

bash
tcpdump ether dst ff:ff:ff:ff:ff:ff

This command will capture all packets sent to the broadcast MAC address.