top of page
Search

tcpdump Sees Nothing on the Right Host: -i any and Offload Before You Blame the Firewall

  • 3 days ago
  • 2 min read
Linux / packet path network security troubleshooting lab
Linux / packet path · Techclick CLI troubleshooting lab
You tcpdump on the server. Empty. The firewall log shows the packet delivered. The app is still down.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Linux / packet path for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Wrong interface, NIC offload, or you filtered the NAT'd address. Use -i any first, then turn off GRO/TSO for the capture.

Why this ticket shows up

Modern NICs coalesce packets so tcpdump can miss what the app sees, or you captured eth0 while traffic is on a VLAN/bond.

Symptoms operators actually see

  • Empty pcap

  • Firewall delivered

  • Bond/VLAN present

  • Filter used the public IP on the server

CLI first — copy this block

Run these on the Linux / packet path device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

ip -br a
tcpdump -nni any host 10.1.1.20 and port 443
ethtool -k eth0 | egrep 'generic-receive-offload|tcp-segmentation-offload'
ss -lntp | grep 443
conntrack -L -d 10.1.1.20 2>/dev/null | head

How to read that output

any should show the SYN. If only then you see it on bond0.12, you were on the wrong NIC. If packets look huge or missing ACKs, disable offload for the capture.

Triage order

  1. ip -br a and pick the right NIC

  2. tcpdump -i any with a tight filter

  3. Confirm the app is listening with ss

  4. Disable offload only for the capture if needed

  5. Then move to the app log

Classic traps

What you see

Real cause

Fix

Open another firewall port

Packet already arrived

Wrong layer

Capture only eth0 on a bond

Traffic is on the bond

-i any

Leave offload off

Throughput dies

Re-enable

Proof the ticket is closed

  • pcap has the handshake

  • ss shows the listener

  • App error is now visible

Say this in an interview

Empty tcpdump is my filter or my interface until -i any proves the packet is absent.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page