search

mcr / tcpdump

the TCPdump network dissector. now moved to:
https://github.com/the-tcpdump-group/tcpdump
Other
84 stars 2 forks source link

[bug ? ]tcpdump lack the first packet #61

Open shanwei opened 11 years ago

shanwei commented 11 years ago

I have hit a strange problem. tcpdump can't print the first packet after starting tcpdump. but the packet can successfully be send out. From following ping test, on same host, we can see icmp reply packet, but can't see the first request packet. reply and ping show that the request packet must send out. strace log of following reproduced steps include two ping is attached.

On other host, but it's ok. How can i to debug this strange problem?

Reproduced steps:

  1. sudo ./tcpdump -i any host 10.139.18.27
  2. ping 10.139.18.27 ok
  3. sleep 2s(maybe...)
  4. ping 10.139.18.27 ok

The tcpdump shows:

sudo ./tcpdump -i any host 10.139.18.27 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes 21:19:56.648248 ARP, Request who-has 10.139.18.26 tell 10.139.18.27, length 46 21:19:56.648272 ARP, Reply 10.139.18.26 is-at 4c:1f:cc:9f:cb:9f (oui Unknown), length 28 21:19:56.648559 IP 10.139.18.27 > 10.139.18.26: ICMP echo reply, id 29243, seq 1, length 64

21:20:11.484001 IP 10.139.18.26 > 10.139.18.27: ICMP echo request, id 36668, seq 1, length 64 21:20:11.484049 IP 10.139.18.27 > 10.139.18.26: ICMP echo reply, id 36668, seq 1, length 64

sudo ./tcpdump -h tcpdump version 4.3.0 libpcap version 1.0.0

------------------------------------------------------attached strace log ------------------------------------ execve("./tcpdump", ["./tcpdump", "-i", "any", "host", "10.139.18.27"], [/* 16 vars _/]) = 0 brk(0) = 0x2523000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023346000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=60158, ...}) = 0 mmap(NULL, 60158, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f8023337000 close(3) = 0 open("/usr/lib64/libpcap.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0l\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=223432, ...}) = 0 mmap(NULL, 2321824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8022ef1000 mprotect(0x7f8022f26000, 2093056, PROT_NONE) = 0 mmap(0x7f8023125000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x34000) = 0x7f8023125000 close(3) = 0 open("/lib64/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\355\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1898872, ...}) = 0 mmap(NULL, 3729576, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8022b62000 mprotect(0x7f8022ce8000, 2093056, PROT_NONE) = 0 mmap(0x7f8022ee7000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x185000) = 0x7f8022ee7000 mmap(0x7f8022eec000, 18600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f8022eec000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023336000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023335000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023334000 arch_prctl(ARCH_SET_FS, 0x7f8023335700) = 0 mprotect(0x7f8022ee7000, 16384, PROT_READ) = 0 mprotect(0x7f8023347000, 4096, PROT_READ) = 0 munmap(0x7f8023337000, 60158) = 0 brk(0) = 0x2523000 brk(0x2544000) = 0x2544000 open("/etc/localtime", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=405, ...}) = 0 fstat(3, {st_mode=S_IFREG|0644, st_size=405, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023345000 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\3\0\0\0\0"..., 4096) = 405 lseek(3, -240, SEEK_CUR) = 165 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\3\0\0\0\0"..., 4096) = 240 close(3) = 0 munmap(0x7f8023345000, 4096) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=405, ...}) = 0 socket(PF_PACKET, SOCK_DGRAM, 768) = 3 ioctl(3, SIOCGIFINDEX, {ifr_name="lo", ifr_index=1}) = 0 setsockopt(3, SOLPACKET, 0x8 / PACKET??? /, [1], 4) = 0 getsockopt(3, SOLPACKET, 0xb / PACKET??? /, [17179869212], [4]) = 0 setsockopt(3, SOLPACKET, 0xa / PACKET??? /, [1], 4) = 0 setsockopt(3, SOLPACKET, 0xc / PACKET_??? */, [4], 4) = 0 setsockopt(3, SOL_PACKET, PACKET_RX_RING, "\0\0\2\0\37\0\0\0@\0\1\0\37\0\0\0", 16) = 0 mmap(NULL, 4063232, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = 0x7f8022782000 getgid() = 0 setgid(0) = 0 getuid() = 0 setuid(0) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=1710, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023345000 read(4, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1710 read(4, "", 4096) = 0 close(4) = 0 munmap(0x7f8023345000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=60158, ...}) = 0 mmap(NULL, 60158, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f8023337000 close(4) = 0 open("/lib64/libnss_files.so.2", O_RDONLY) = 4 read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360!\0\0\0\0\0\0"..., 832) = 832 fstat(4, {st_mode=S_IFREG|0755, st_size=65928, ...}) = 0 mmap(NULL, 2151824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f8022574000 mprotect(0x7f8022580000, 2097152, PROT_NONE) = 0 mmap(0x7f8022780000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xc000) = 0x7f8022780000 close(4) = 0 mprotect(0x7f8022780000, 4096, PROT_READ) = 0 munmap(0x7f8023337000, 60158) = 0 open("/etc/ethers", O_RDONLY|O_CLOEXEC) = 4 fcntl(4, F_GETFD) = 0x1 (flags FD_CLOEXEC) fstat(4, {st_mode=S_IFREG|0644, st_size=28, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023345000 read(4, "# see man ethers for syntax\n", 4096) = 28 read(4, "", 4096) = 0 close(4) = 0 munmap(0x7f8023345000, 4096) = 0 open("/etc/services", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=640999, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023345000 lseek(4, 0, SEEK_CUR) = 0 lseek(4, 0, SEEK_SET) = 0 read(4, "# /etc/services:\n# $Id: services"..., 4096) = 4096 read(4, "ervice\nfinger 79/tcp\nfi"..., 4096) = 4096 read(4, " 209/udp "..., 4096) = 4096 read(4, "a-cluster 694/tcp "..., 4096) = 4096 read(4, " 1494/tcp "..., 4096) = 4096 read(4, "603/udp #"..., 4096) = 4096 read(4, " # BPRD (VERITAS NetBack"..., 4096) = 4096 read(4, "432/tcp postgresql #"..., 4096) = 4096 read(4, "GS Protocol\nmpm 45/t"..., 4096) = 4096 read(4, " 103/udp # Genes"..., 4096) = 4096 read(4, "ransfer Program\nsgmp "..., 4096) = 4096 read(4, " Location Service\ndls-mon "..., 4096) = 4096 read(4, "# Tobit David Service Layer\ntd-s"..., 4096) = 4096 read(4, "# DATEX-ASN\ndatex-asn "..., 4096) = 4096 read(4, "Data Transfer\nnetcp 39"..., 4096) = 4096 read(4, " 431/tcp # UT"..., 4096) = 4096 read(4, "# hybrid-pop\nhybrid-pop 473"..., 4096) = 4096 brk(0x2565000) = 0x2565000 read(4, " # IBM-DB2\nibm-db2 "..., 4096) = 4096 read(4, "mmi 575/tcp "..., 4096) = 4096 read(4, " # SCO System Administra"..., 4096) = 4096 read(4, " 655/udp "..., 4096) = 4096 read(4, " # almanid Connec"..., 4096) = 4096 read(4, " 763/udp #"..., 4096) = 4096 read(4, "ftps-data 989/tcp "..., 4096) = 4096 read(4, " # Sun's NEO Object Reque"..., 4096) = 4096 read(4, " 1085/tcp # We"..., 4096) = 4096 read(4, "rotocol\nbnetfile 1120/udp"..., 4096) = 4096 read(4, " # ANSI C12.22 Port\nc"..., 4096) = 4096 read(4, "luster Manager\nalias 1"..., 4096) = 4096 read(4, " 1223/tcp # T"..., 4096) = 4096 read(4, "B\nqnts-orb 1262/udp "..., 4096) = 4096 read(4, " 1301/udp # CI3-"..., 4096) = 4096 read(4, "erver\nnaap 1340/tcp "..., 4096) = 4096 read(4, "re Systems\nmolly 1374/"..., 4096) = 4096 read(4, "on Starter\nibm-res 1405/"..., 4096) = 4096 read(4, "n X25/SNA Gateway\neicon-slp "..., 4096) = 4096 read(4, "openmath 1473/tcp "..., 4096) = 4096 read(4, "on Ltd. Lic. Man.\nmvx-lm "..., 4096) = 4096 read(4, " Shiva Hose\nshivasound 1549"..., 4096) = 4096 read(4, " 1585/udp "..., 4096) = 4096 read(4, " # softdataphone\nontime"..., 4096) = 4096 read(4, "udp # netview-aix"..., 4096) = 4096 read(4, " # RSVP-ENCAPSULATION-2\nrsvp-e"..., 4096) = 4096 read(4, "# encore\ncisco-net-mgmt 1741/tc"..., 4096) = 4096 read(4, " # answersoft-lm\nanswerso"..., 4096) = 4096 read(4, "r\nunisys-lm 1823/udp "..., 4096) = 4096 read(4, " # LeCroy VICP\nlecroy-vicp "..., 4096) = 4096 read(4, " # MetaAgent\ncymtec-por"..., 4096) = 4096 read(4, "/tcp # CTT Broker"..., 4096) = 4096 read(4, "ote 1967/udp "..., 4096) = 4096 read(4, "knet 2005/tcp csync "..., 4096) = 4096 brk(0x2586000) = 0x2586000 read(4, " # EPNSDP\nclearvi"..., 4096) = 4096 read(4, " # SunCluster Geographic\ns"..., 4096) = 4096 read(4, " # ELATELINK\nelatelink"..., 4096) = 4096 read(4, " Remote Debug Port\ngdbremote "..., 4096) = 4096 read(4, " 2193/tcp # "..., 4096) = 4096 read(4, " # eHome Message Se"..., 4096) = 4096 read(4, "# CoMotion Master Server\ncomotio"..., 4096) = 4096 read(4, "ager (FLEX)\nadvant-lm 2295"..., 4096) = 4096 read(4, " # RCC Host\nrcc-host 2"..., 4096) = 4096 read(4, "L3-HBMon\nl3-hbmon 2370/ud"..., 4096) = 4096 read(4, "414/udp # Beeyond"..., 4096) = 4096 read(4, " # Rapido_IP\nrapido-"..., 4096) = 4096 read(4, " 2492/udp # GROO"..., 4096) = 4096 read(4, "erce\nvrcommerce 2530/udp "..., 4096) = 4096 read(4, "568/udp # SPAM TR"..., 4096) = 4096 read(4, "/udp # SMNTUBoots"..., 4096) = 4096 read(4, "site 2651/udp "..., 4096) = 4096 read(4, "ata 2690/udp "..., 4096) = 4096 read(4, "ay Control Protocol Call Agent\ns"..., 4096) = 4096 read(4, " 2767/udp "..., 4096) = 4096 read(4, "anager products\ndvr-esm "..., 4096) = 4096 read(4, " 2845/tcp #"..., 4096) = 4096 read(4, "/tcp # TopFlow\nto"..., 4096) = 4096 read(4, "/udp # CESD Conte"..., 4096) = 4096 read(4, " # BOLDSOFT-LM\nboldsoft-lm "..., 4096) = 4096 read(4, " 2998/tcp # Rea"..., 4096) = 4096 read(4, " 3033/tcp "..., 4096) = 4096 read(4, "onitor Port\ncsd-monitor 3072"..., 4096) = 4096 read(4, " # Business protocol\ngeoloc"..., 4096) = 4096 read(4, " # CSI-LFAP\ncsi-lf"..., 4096) = 4096 read(4, "/udp # H2GF W.2m "..., 4096) = 4096 read(4, " # Survey Instrument\nsurve"..., 4096) = 4096 read(4, "p # VIEO Fabric E"..., 4096) = 4096 read(4, " # VS Server\nvs-server 328"..., 4096) = 4096 brk(0x25a7000) = 0x25a7000 read(4, " Manager\nofficelink2000 3320/tc"..., 4096) = 4096 read(4, "ilm 3362/tcp "..., 4096) = 4096 read(4, " ch 2\nnokia-ann-ch2 3406/udp "..., 4096) = 4096 read(4, "Admin\nhri-port 3439/tcp "..., 4096) = 4096 read(4, "isar-port 3475/udp "..., 4096) = 4096 read(4, "eb\nvt-ssl 3509/tcp "..., 4096) = 4096 read(4, "lookup 3543/tcp "..., 4096) = 4096 read(4, " 3578/tcp # Data "..., 4096) = 4096 read(4, "Port\nhp-dataprotect 3612/tcp "..., 4096) = 4096 read(4, "Cyc\nxss-srv-port 3646/tcp "..., 4096) = 4096 read(4, " 3678/tcp # Da"..., 4096) = 4096 read(4, " # Anoto Rendezvous Por"..., 4096) = 4096 read(4, " # CimTrak\ncimtrak "..., 4096) = 4096 read(4, "Impact Mgr./PEM Gateway\nbfd-cont"..., 4096) = 4096 read(4, "mite Tech Tapeware\ntapeware "..., 4096) = 4096 read(4, "spw-dnspreload 3849/tcp "..., 4096) = 4096 read(4, "# DTS Service Port\nmsdts1 "..., 4096) = 4096 read(4, "5/udp # Auto-Grap"..., 4096) = 4096 read(4, " 3948/tcp # Anto"..., 4096) = 4096 read(4, " 3980/udp "..., 4096) = 4096 read(4, " # Talarian Mcast\ntalarian-mcas"..., 4096) = 4096 read(4, "eract 4052/tcp "..., 4096) = 4096 read(4, " # Lorica outside facing (SS"..., 4096) = 4096 read(4, " # Netadmin Systems"..., 4096) = 4096 read(4, " 4151/udp # Men &"..., 4096) = 4096 read(4, "udp # Vatata Peer"..., 4096) = 4096 read(4, " # File System Port Map"..., 4096) = 4096 read(4, " 4403/tcp # ASIG"..., 4096) = 4096 read(4, " # isigate\nworldscores "..., 4096) = 4096 read(4, "te It! Message Service\nnoteit "..., 4096) = 4096 read(4, "hronization\nnetxms-sync 4702"..., 4096) = 4096 read(4, "42/udp # nCode IC"..., 4096) = 4096 read(4, "nitor\nccss-qsm 4970/tcp "..., 4096) = 4096 read(4, "ix I/O daemon (stat)\nqvr "..., 4096) = 4096 read(4, "cp # Qpur File Pr"..., 4096) = 4096 read(4, "ica-Online\naol-1 5191/"..., 4096) = 4096 read(4, "NLG Data Service\nhacl-hb "..., 4096) = 4096 brk(0x25c8000) = 0x25c8000 read(4, "tion 5363/tcp # "..., 4096) = 4096 read(4, " # SGI Array Servic"..., 4096) = 4096 read(4, " # inin secure messagi"..., 4096) = 4096 read(4, " proshare conf video\nprosharevid"..., 4096) = 4096 read(4, " # NetAgent\ndali-port 57"..., 4096) = 4096 read(4, "cp # SSDTP\nssdtp "..., 4096) = 4096 read(4, "e Manager\nmontage-lm 6147/t"..., 4096) = 4096 read(4, "udp # Metatude Di"..., 4096) = 4096 read(4, "Domain\nsun-sr-iiops 6486/udp "..., 4096) = 4096 read(4, "eros V5 FTP Data\nkftp-data "..., 4096) = 4096 read(4, "-https 6789/udp "..., 4096) = 4096 read(4, " 7030/udp # "..., 4096) = 4096 read(4, "dezvous 7392/udp "..., 4096) = 4096 read(4, "gnaling Transport Layer\nnls-tl "..., 4096) = 4096 read(4, "RAQMON PDU\nprgp 7747/"..., 4096) = 4096 read(4, "teradataordbms 8002/udp "..., 4096) = 4096 read(4, "doms-migr 8101/tcp "..., 4096) = 4096 read(4, "ium) Network Protocol\ntnp "..., 4096) = 4096 read(4, " # Sun App Server - JMX/RMI\nsu"..., 4096) = 4096 read(4, " 8999/tcp # "..., 4096) = 4096 read(4, "evice Discovery\napani1 "..., 4096) = 4096 read(4, "# VERITAS Information Serve\nvisd"..., 4096) = 4096 read(4, "Agent\ncba8 9593/udp "..., 4096) = 4096 read(4, "erver channel\nenrp-sctp 99"..., 4096) = 4096 read(4, "r Desktop Patrol\nswdtp "..., 4096) = 4096 read(4, " # sun cacao rmi registry a"..., 4096) = 4096 read(4, "udp # LinoGrid Eng"..., 4096) = 4096 read(4, " # hde-lcesrvr-2\nhde-lc"..., 4096) = 4096 read(4, "tcp # ZigBee IP Tr"..., 4096) = 4096 read(4, " 20005/udp # O"..., 4096) = 4096 read(4, "22763/udp # Talika"..., 4096) = 4096 read(4, " 25003/tcp # icl-"..., 4096) = 4096 read(4, "45\nxqosd 31416/tcp "..., 4096) = 4096 read(4, " # PROFInet Context Manager\ne"..., 4096) = 4096 read(4, "ice\nqdb2service 45825/udp "..., 4096) = 2023 read(4, "", 4096) = 0 close(4) = 0 munmap(0x7f8023345000, 4096) = 0 brk(0x25e9000) = 0x25e9000 rt_sigaction(SIGPIPE, {0x44f180, [], SA_RESTORER, 0x7f8022b94980}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGTERM, {0x44f180, [], SA_RESTORER, 0x7f8022b94980}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGINT, {0x44f180, [], SA_RESTORER, 0x7f8022b94980}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGCHLD, {0x44f170, [], SA_RESTORER, 0x7f8022b94980}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGHUP, {0x44f180, [], SA_RESTORER, 0x7f8022b94980}, {SIG_DFL, [], 0}, 8) = 0 getuid() = 0 setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\0\0\0\0\0\0\0o\22#\200\177\0\0", 16) = 0 fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 recvfrom(3, 0x7fff53df98af, 1, 32, 0, 0) = -1 EAGAIN (Resource temporarily unavailable) fcntl(3, F_SETFL, O_RDWR) = 0 setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\16\0\0\0\0\0\0\0000\204\2\0\0\0\0", 16) = 0 rt_sigaction(SIGUSR1, {0x44e9b0, [], SA_RESTORER, 0x7f8022b94980}, {SIG_DFL, [], 0}, 8) = 0 write(2, "tcpdump: verbose output suppress"..., 75tcpdump: verbose output suppressed, use -v or -vv for full protocol decode ) = 75 write(2, "listening on any, link-type LINU"..., 79listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes ) = 79 poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 1 ([{fd=3, revents=POLLIN}]) poll([{fd=3, events=POLLIN}], 1, 1000) = 1 ([{fd=3, revents=POLLIN}]) fstat(1, {st_mode=S_IFREG|0644, st_size=17200, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023345000 socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = 0 sendto(4, "\2\0\0\0\r\0\0\0\6\0\0\0hosts\0", 18, MSG_NOSIGNAL, NULL, 0) = 18 poll([{fd=4, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=4, revents=POLLIN|POLLHUP}]) recvmsg(4, {msg_name(0)=NULL, msg_iov(2)=[{"hosts\0", 6}, {"\270O\3\0\0\0\0\0", 8}], msg_controllen=24, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {5}}, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 14 mmap(NULL, 217016, PROT_READ, MAP_SHARED, 5, 0) = 0x7f80232ff000 close(5) = 0 close(4) = 0 open("/etc/ethers", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=28, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8023344000 read(4, "# see man ethers for syntax\n", 4096) = 28 read(4, "", 4096) = 0 close(4) = 0 munmap(0x7f8023344000, 4096) = 0 poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 1 ([{fd=3, revents=POLLIN}]) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000) = 0 (Timeout) poll([{fd=3, events=POLLIN}], 1, 1000 <unfinished ...> 21:19:56.648248 ARP, Request who-has 10.139.18.26 tell 10.139.18.27, length 46 21:19:56.648272 ARP, Reply 10.139.18.26 is-at 4c:1f:cc:9f:cb:9f (oui Unknown), length 28 21:19:56.648559 IP 10.139.18.27 > 10.139.18.26: ICMP echo reply, id 29243, seq 1, length 64 21:20:11.484001 IP 10.139.18.26 > 10.139.18.27: ICMP echo request, id 36668, seq 1, length 64 21:20:11.484049 IP 10.139.18.27 > 10.139.18.26: ICMP echo reply, id 36668, seq 1, length 64

5 packets captured 28 packets received by filter 0 packets dropped by kernel