Forum Discussion

DarioGB_339840's avatar
DarioGB_339840
Icon for Altostratus rankAltostratus
May 29, 2018
Solved

tcpdump 'h' noise amplifier

Does anyone know the definition of 'h' noise amplifier in tcpdump? It's possible to use this amplifier when I sniff TMM traffic or CMI traffic, so I think it's just to sniff internal processes traf...
application delivery
BIG-IP
tcpdump
TMOS
  • lmiestc_26212's avatar
    lmiestc_26212
    Icon for Cirrus rankCirrus
    May 29, 2018

    Notes about the wireshark plugin

     

    As of Wireshark 2.6.0 (rel. 4/24/2018) the 1.11 version of the f5ethtrailer dissector is included as a built-in. It is no longer necessasary to use the plugin do decode f5ethtrailer information.

     

    It is disabled by default. To enable it, from the menu select "Anyalyze" : "Enabled Protocols...". Then search for f5ethtrailer and enable the dissector. https://www.wireshark.org/news/20180424.html

     

  • DarioGB_339840's avatar
    DarioGB_339840
    Icon for Altostratus rankAltostratus
    May 29, 2018

    Hello Imiestc, thanks for your response ;-).

     

    Actually, I'm asking for 'h' option (not for 'nnn'), which is not included in this KB.

     

    Do you know any other which talks about 'h' option?

     

    KR, Dario.

     

  • DarioGB_339840's avatar
    DarioGB_339840
    Icon for Altostratus rankAltostratus
    Jun 15, 2018

    Just to clarify. With "noise amplifier" i mean "noise amplitude".

     

    Any help?

     

  • lmiestc_26212's avatar
    lmiestc_26212
    Icon for Cirrus rankCirrus
    Jun 15, 2018

    From K13637 "The extra TMM information can only be captured when the interface on which tcpdump is listening is a Virtual Local Area Network (VLAN)." E.G "vlan:noiseamplitude"

     

    So tcpdump -nnei tmm:h will fail with tcpdump: Ingress/egress modifier not supported on this interface.

     

    In regards of the vlan:h option here is what man tcpdump on the F5 CLI says

     

    h = Capture only traffic destined for the Linux host.