[FUG-BR] Entendendo o tcpdump

[Ricardo Augusto de Souza]

Fala galera,

 

Estou precisando de um  help para entender os tipos de pacotes/requisições que estão trafegando entre um PDV e um servidor SCM.

Este PDV é responsável pela carga de créditos nos cartões dos usuários.

Hoje começou a dar problema e não sabemos o q é.

Não houve mudanças nos firewalls ( FreeBSD ).

 

Fiz uma analise com tcpdump e preciso de ajuda para entende-los:

 

15:53:42.813952 10.100.0.27.10000 > 10.10.51.7.4831: P 43:85(42) ack 146 win 65390 <nop,nop,timestamp 35630407 4753> (DF)

15:53:42.825702 10.10.51.7.4831 > 10.100.0.27.10000: . ack 85 win 2920 <nop,nop,timestamp 4831 35630407> (DF)

15:53:43.064756 10.10.51.7.4831 > 10.100.0.27.10000: P 146:189(43) ack 85 win 2920 <nop,nop,timestamp 4855 35630407> (DF)

15:53:43.224712 10.100.0.27.10000 > 10.10.51.7.4831: . ack 189 win 65347 <nop,nop,timestamp 35630411 4855> (DF)

15:53:43.281616 10.100.0.27.10000 > 10.10.51.7.4831: P 85:127(42) ack 189 win 65347 <nop,nop,timestamp 35630411 4855> (DF)

15:53:43.293177 10.10.51.7.4831 > 10.100.0.27.10000: . ack 127 win 2920 <nop,nop,timestamp 4878 35630411> (DF)

15:53:45.858525 10.10.51.7.4831 > 10.100.0.27.10000: P 189:232(43) ack 127 win 2920 <nop,nop,timestamp 5043 35630411> (DF)

15:53:45.991184 10.100.0.27.10000 > 10.10.51.7.4831: P 127:169(42) ack 232 win 65304 <nop,nop,timestamp 35630438 5043> (DF)

15:53:46.003366 10.10.51.7.4831 > 10.100.0.27.10000: . ack 169 win 2920 <nop,nop,timestamp 5058 35630438> (DF)

15:53:47.226167 10.10.51.7.4831 > 10.100.0.27.10000: P 232:279(47) ack 169 win 2920 <nop,nop,timestamp 5168 35630438> (DF)

15:53:47.364699 10.100.0.27.10000 > 10.10.51.7.4831: P 169:223(54) ack 279 win 65257 <nop,nop,timestamp 35630452 5168> (DF)

15:53:47.376669 10.10.51.7.4831 > 10.100.0.27.10000: . ack 223 win 2920 <nop,nop,timestamp 5183 35630452> (DF)

15:53:47.926833 10.10.51.7.4831 > 10.100.0.27.10000: P 279:353(74) ack 223 win 2920 <nop,nop,timestamp 5231 35630452> (DF)

15:53:48.160527 10.100.0.27.10000 > 10.10.51.7.4831: . ack 353 win 65183 <nop,nop,timestamp 35630461 5231> (DF)

15:53:49.878443 10.100.0.27.10000 > 10.10.51.7.4831: P 223:265(42) ack 353 win 65183 <nop,nop,timestamp 35630477 5231> (DF)

15:53:49.890277 10.10.51.7.4831 > 10.100.0.27.10000: . ack 265 win 2920 <nop,nop,timestamp 5428 35630477> (DF)

15:53:50.461960 10.10.51.7.4831 > 10.100.0.27.10000: P 353:400(47) ack 265 win 2920 <nop,nop,timestamp 5477 35630477> (DF)

15:53:50.672970 10.100.0.27.10000 > 10.10.51.7.4831: P 265:319(54) ack 400 win 65136 <nop,nop,timestamp 35630485 5477> (DF)

15:53:50.684968 10.10.51.7.4831 > 10.100.0.27.10000: . ack 319 win 2920 <nop,nop,timestamp 5500 35630485> (DF)

15:53:51.287185 10.10.51.7.4831 > 10.100.0.27.10000: P 400:474(74) ack 319 win 2920 <nop,nop,timestamp 5552 35630485> (DF)

15:53:51.442947 10.100.0.27.10000 > 10.10.51.7.4831: . ack 474 win 65062 <nop,nop,timestamp 35630493 5552> (DF)

15:53:53.319291 10.100.0.27.10000 > 10.10.51.7.4831: P 319:361(42) ack 474 win 65062 <nop,nop,timestamp 35630511 5552> (DF)

15:53:53.331103 10.10.51.7.4831 > 10.100.0.27.10000: . ack 361 win 2920 <nop,nop,timestamp 5757 35630511> (DF)

15:55:27.086589 10.10.51.7.4831 > 10.100.0.27.10000: F 474:474(0) ack 361 win 2920 <nop,nop,timestamp 13093 35630511> (DF)

15:55:27.092311 10.100.0.27.10000 > 10.10.51.7.4831: . ack 475 win 65062 <nop,nop,timestamp 35631449 13093> (DF)

 

 

Queria saber o q significa este: P, . , F e etc.

 

Valeu