<r-cellspan="1-8"data-tooltiptitle="16 bits<br>Port segment was sent from"class="ethernet-frame-cell">
<pclass="frame-text">Source port</p>
</r-cell>
<r-cellspan="9-16"data-tooltiptitle="16 bits<br>Port segmnent is sent to"class="ethernet-frame-cell">
<pclass="frame-text">Destination port</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="32 bits<br>If SYN flag is set, this is the initial packet.<br>If SYN is not set, data is at number+1"class="ethernet-frame-cell">
<pclass="frame-text">Sequence number</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="32 bits<br>If the ACK flag is set then the value of this field is the next sequence number that the sender of the ACK is expecting."class="ethernet-frame-cell">
<pclass="frame-text">Acknowledgment number</p>
</r-cell>
</r-grid>
<r-gridcolumns="16"class="ethernet-frame-grid">
<r-cellspan="1-2"data-tooltiptitle="4 bits<br>Number of 32 bit words that define the size of the header."class="ethernet-frame-cell">
<pclass="frame-text">Data offset</p>
</r-cell>
<r-cellspan="3-4"data-tooltiptitle="3 bits<br>Reserved for future use."class="ethernet-frame-cell">
<pclass="frame-text">Reserved</p>
</r-cell>
<r-cellspan="5-9"data-tooltiptitle="9 bits<br>SYN: synchronize, start of connection<br>ACK: acknowledge, confirm connection<br>RST: reset connection<br>FIN: last package from sender<br>URG: urgent bit is significant<br>CWR: congestion window reduced"class="ethernet-frame-cell">
<pclass="frame-text">Flags</p>
</r-cell>
<r-cellspan="10-16"data-tooltiptitle="16 bits<br>Number of bytes the sender of this segment is willing to receive"class="ethernet-frame-cell">
<pclass="frame-text">Window size</p>
</r-cell>
</r-grid>
<r-gridcolumns="2"class="ethernet-frame-grid">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Used for error checking. TCP can resend invalid segments."class="ethernet-frame-cell">
<pclass="frame-text">Checksum</p>
</r-cell>
<r-cellspan="1"data-tooltiptitle="16 bits<br>If the URG flag is set, then this 16-bit field is an offset from the sequence number indicating the last urgent data byte."class="ethernet-frame-cell">
<pclass="frame-text">Urgent pointer</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="0-320 bits<br>Optional options. Must be divisable by 32, otherwise 0 padding at the end."class="ethernet-frame-cell">
<pclass="frame-text">Options</p>
</r-cell>
</r-grid>
</r-cell><!-- TCP Header -->
<r-cellclass="panel">
<h2>UDP Header</h2>
<r-gridcolumns="2"class="ethernet-frame-grid">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Port the datagram is sent from (optional in IPv6)."class="ethernet-frame-cell">
<pclass="frame-text">Source Port</p>
</r-cell>
<r-cellspan="1"data-tooltiptitle="16 bits<br>Port the datagram is sent to."class="ethernet-frame-cell">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Used for error recognition. Optional in V4, mandatatory in V6. All zeroes if unused."class="ethernet-frame-cell">
<pclass="frame-text">Checksum</p>
</r-cell>
</r-grid>
</r-cell><!-- UDP Header -->
<r-cell>
<r-gridcolumns="10"class="panel">
<r-cellspan="row"><h2>tcpdump</h2></r-cell>
<r-cellspan="row"><h3>flags</h3></r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -i eth0">-i name</r-cell><r-cellspan="2-5">Capture named interfaces, any for all</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -c10">-c integer</r-cell><r-cellspan="7-10">Capture amount of packages</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -D">-D</r-cell><r-cellspan="2-5">Show available interfaces</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i any">-n</r-cell><r-cellspan="7-10">Do not resolve host-names</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -nn -c10 -i eth0">-nn</r-cell><r-cellspan="2-5">Do not resolve host-names or services (ports)</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 tcp">udp</r-cell><r-cellspan="2-5">Capture udp, also works with others such as arp</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 host 10.10.10.10 and [not] udp">host IP</r-cell><r-cellspan="7-10">Capture data to or from this host only</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 src 10.10.10.10 and tcp">src IP</r-cell><r-cellspan="2-5">Capture data from this host only</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 dst 10.10.10.10">dst IP</r-cell><r-cellspan="7-10">Capture data sent to this host only</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 net 10.10.10.0/24">net CIDR</r-cell><r-cellspan="2-5">Capture data to or from this subnet</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 host 10.10.10.10 and port 53">port number</r-cell><r-cellspan="7-10">Use service name instead of port</r-cell>
<r-cellspan="row"><h3>tcp flags</h3></r-cell>
<r-cellspan="1-2">[S] SYNC</r-cell>
<r-cellspan="3-4">[.|A] ACKNOWLEDGE</r-cell>
<r-cellspan="5-6">[R] RESET</r-cell>
<r-cellspan="7-8">[F] FINISHED</r-cell>
<r-cellspan="9-10">[P] PUSH</r-cell>
<r-cellspan="row">Flags can be displayed combined, [S.] means sync and acknowledge</r-cell>
<r-cellspan="1-8"data-tooltiptitle="16 bits<br>Port segment was sent from"class="ethernet-frame-cell">
<pclass="frame-text">Source port</p>
</r-cell>
<r-cellspan="9-16"data-tooltiptitle="16 bits<br>Port segmnent is sent to"class="ethernet-frame-cell">
<pclass="frame-text">Destination port</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="32 bits<br>If SYN flag is set, this is the initial packet.<br>If SYN is not set, data is at number+1"class="ethernet-frame-cell">
<pclass="frame-text">Sequence number</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="32 bits<br>If the ACK flag is set,<br>then the value of this field is the next<br>sequence number that the sender of the ACK is expecting."class="ethernet-frame-cell">
<pclass="frame-text">Acknowledgment number</p>
</r-cell>
</r-grid>
<r-gridcolumns="16"class="ethernet-frame-grid">
<r-cellspan="1-2"data-tooltiptitle="4 bits<br>Number of 32 bit words that define the size of the header."class="ethernet-frame-cell">
<pclass="frame-text">Data offset</p>
</r-cell>
<r-cellspan="3-4"data-tooltiptitle="3 bits<br>Reserved for future use."class="ethernet-frame-cell">
<pclass="frame-text">Reserved</p>
</r-cell>
<r-cellspan="5-9"data-tooltiptitle="9 bits<br>SYN: synchronize, start of connection<br>ACK: acknowledge, confirm connection<br>RST: reset connection<br>FIN: last package from sender<br>URG: urgent bit is significant<br>CWR: congestion window reduced"class="ethernet-frame-cell">
<pclass="frame-text">Flags</p>
</r-cell>
<r-cellspan="10-16"data-tooltiptitle="16 bits<br>Number of bytes the sender of this segment is willing to receive"class="ethernet-frame-cell">
<pclass="frame-text">Window size</p>
</r-cell>
</r-grid>
<r-gridcolumns="2"class="ethernet-frame-grid">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Used for error checking. TCP can resend invalid segments."class="ethernet-frame-cell">
<pclass="frame-text">Checksum</p>
</r-cell>
<r-cellspan="1"data-tooltiptitle="16 bits<br>If the URG flag is set, then this 16-bit field is an offset from the sequence number indicating the last urgent data byte."class="ethernet-frame-cell">
<pclass="frame-text">Urgent pointer</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="0-320 bits<br>Optional options. Must be divisable by 32, otherwise 0 padding at the end."class="ethernet-frame-cell">
<pclass="frame-text">Options</p>
</r-cell>
</r-grid>
</r-cell><!-- TCP Header -->
<r-cellclass="panel">
<h2>UDP Header</h2>
<r-gridcolumns="2"class="ethernet-frame-grid">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Port the datagram is sent from (optional in IPv6)."class="ethernet-frame-cell">
<pclass="frame-text">Source Port</p>
</r-cell>
<r-cellspan="1"data-tooltiptitle="16 bits<br>Port the datagram is sent to."class="ethernet-frame-cell">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Used for error recognition. Optional in V4, mandatatory in V6. All zeroes if unused."class="ethernet-frame-cell">
<pclass="frame-text">Checksum</p>
</r-cell>
</r-grid>
</r-cell><!-- UDP Header -->
<r-cell>
<r-gridcolumns="10"columns-s="1"class="panel">
<r-cellspan="row"><h2>tcpdump</h2></r-cell>
<r-cellspan="row"><h3>flags</h3></r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -i eth0">-i name</r-cell><r-cellspan="2-5">Capture named interfaces, any for all</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -c10">-c integer</r-cell><r-cellspan="7-10">Capture amount of packages</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -D">-D</r-cell><r-cellspan="2-5">Show available interfaces</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i any">-n</r-cell><r-cellspan="7-10">Do not resolve host-names</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -nn -c10 -i eth0">-nn</r-cell><r-cellspan="2-5">Do not resolve host-names or services (ports)</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 tcp">udp</r-cell><r-cellspan="2-5">Capture udp, also works with others such as arp</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 host 10.10.10.10 and [not] udp">host IP</r-cell><r-cellspan="7-10">Capture data to or from this host only</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 src 10.10.10.10 and tcp">src IP</r-cell><r-cellspan="2-5">Capture data from this host only</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 dst 10.10.10.10">dst IP</r-cell><r-cellspan="7-10">Capture data sent to this host only</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 net 10.10.10.0/24">net CIDR</r-cell><r-cellspan="2-5">Capture data to or from this subnet</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 host 10.10.10.10 and port 53">port number</r-cell><r-cellspan="7-10">Use service name instead of port</r-cell>
<r-cellspan="row"><h3>tcp flags</h3></r-cell>
<r-cellspan="1-2">[S] SYNC</r-cell>
<r-cellspan="3-4">[.|A] ACKNOWLEDGE</r-cell>
<r-cellspan="5-6">[R] RESET</r-cell>
<r-cellspan="7-8">[F] FINISHED</r-cell>
<r-cellspan="9-10">[P] PUSH</r-cell>
<r-cellspan="row">Flags can be displayed combined, [S.] means sync and acknowledge</r-cell>