On 12/3/20 5:34 PM, home user wrote:
On 12/2/20 9:11 PM, Ed Greshko wrote:
I think this would be easier for you to capture network traffic at
this time......
With a quite system, open a terminal and as root use the following to
capture some packets....
tcpdump -c 500 port 22 -w cap.pcap
This will capture 500 packets and then exit. Post the cap.pcap file.
I done it. But after 35+ minutes, I terminated it. The resulting
cap.pcap is attached. If you want something else/more, let me know. I
don't understand much of what I see in wireshark. What I gather is:
* 3 packets were captured.
* the third was a tcp from 162.142.125.30 to 24.128.103.197. whois
claims it's from Ann Arbor, Michigan to 24.128.103.197,
Based on what I sent to Samuel a little while ago, the destination ip
address is actually me. The "info" column and the bottom part of the
display (hexadecimal) make no sense to me.
The first packet is strange, not sure why the other end is sending you a
reset, but possibly that's it giving up trying to connect.
I wouldn't really expect you to understand much of the details, but the
last two lines of the middle info are the most useful to you:
> Internet Protocol Version 4, Src: 162.142.125.30, Dst: 24.128.103.197
The other end is at 162.142.125.30.
> Transmission Control Protocol, Src Port: 57473, Dst Port: 22, Seq: 0,
Len: 0
It's a connection to your ssh port (22). In the top section, you'll see
the packet is marked with [SYN], that means it's a connection attempt.
Why is the first entry (from
the Netherlands) in the top part highlighted red?
Probably because it's a RST (connection reset) packet. Those packets
show that your firewall is doing its job and blocking the incoming
connections.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
