How to decipher tcpdump file

[vtntl]

Hi,



I am stuck with a tricky situation in which one of my applications is flooding the network with UDP messages. The architecture of the application is not supposed to do so. Neither is there any place where the application will go into an infinite loop sending UDP messages over the network. To find out what message is being sent out, I captured the output of tcpdump to get the contents of the UDP packets sent by the application over the network. Following is a portion of the tcpdump output:



13:37:33.568065 udm > activeip: ip-proto-153 13 (DF)

4500 0021 0512 4000 fe99 01d4 2f87 2b01

0a46 1118 2547 2547 000d 735b 7000 2e04

2e00 0000 0000 0000 0000 0000 0000

13:37:33.568091 udm > activeip: ip-proto-153 13 (DF)

4500 0021 0513 4000 fe99 01d3 2f87 2b01

0a46 1118 2547 2547 000d 735b 7000 2e04

2e00 0000 0000 0000 0000 0000 0000

13:37:33.568116 udm > activeip: ip-proto-153 13 (DF)

4500 0021 0514 4000 fe99 01d2 2f87 2b01

0a46 1118 2547 2547 000d 735b 7000 2e04

2e00 0000 0000 0000 0000 0000 0000



Can anyone help me in deciphering the contents of the packets? This will help me in finding out in the code where these messages are being sent out. Do keep in mind that I am pretty new to tcpdump.



Regards,

Diganta

[trong_dat1402]

A reference on IPv4 headers would greatly help you decipher the packet information:

Code:

An IPv4 header 



<------------------------------------ 32 bits ---------------------------------->



|-------------------------------------------------------------------------------|

| Version |   IHL   |  Type of Service  |            Total Length               |

|-------------------------------------------------------------------------------|

|             Identification            | Flags |          Fragment Offset      |

|-------------------------------------------------------------------------------|

|   Time to Live    |     Protocol      |             Header Checksum           |

|-------------------------------------------------------------------------------|

|                                  Source Address                               |

|-------------------------------------------------------------------------------|

|                               Destination Address                             |

|-------------------------------------------------------------------------------|

|                     Options                               |      Padding      |

|-------------------------------------------------------------------------------|





|-------------------------------------------------------------------------------|

|                                     Payload                                   |

|-------------------------------------------------------------------------------|

Reference:

An IPv4 header

[kent_jay]

Excellent CMU lecture on IPv4

[duong nhat than]

Following is a very good link to understand tcpdump for beginners.



http://www.aei.ca/~pmatulis/pub/tcpdump.html