Home / server / Questions / 586776
In Process
Steve Kehlet
Asked: 2014-04-05 10:12:33 +0800 CST

tcpdump expression to show zero-byte ACKs?

  • 772

I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding tcpKeepAlive=true) is causing the keepalives to be sent periodically (at the interval I've already configured in /proc/sys/net/ipv4/tcp_keepalive_time, and I know is working). They look like this:

21:35:00.150604 IP 1.2.3.4.53019 > 5.6.7.8.postgres: . ack 635465 win 772 <nop,nop,timestamp 1666835314 1722393170>

But I'd like to figure out a filter so it doesn't show all traffic. I found ip[2:2] which allows you to filter by the total packet length. Is the length of a zero-byte ACK constant?

# not it, but maybe close
tcpdump -nn 'ip[2:2] = 50'

Thanks!

tcpdump

0 Answers