# Monitoring TCP Packets

This section illustrates how to monitor TCP packets received by the system. This is useful in analyzing network traffic generated by applications running on the system.

tcpdumplike.stp

While is running, it will print out the following information about any received TCP packets in real time:

- Source and destination IP address (`saddr`, `daddr`, respectively)

- Source and destination ports (`sport`, `dport`, respectively)

- Packet flags

To determine the flags used by the packet, uses the following functions:

- `urg` - urgent

- `ack` - acknowledgement

- `psh` - push

- `rst` - reset

- `syn` - synchronize

- `fin` - finished

The aforementioned functions return `1` or `0` to specify whether the packet uses the corresponding flag.

Sample Output

    -----------------------------------------------------------------
           Source IP         Dest IP  SPort  DPort  U  A  P  R  S  F
    -----------------------------------------------------------------
      209.85.229.147       10.0.2.15     80  20373  0  1  1  0  0  0
      92.122.126.240       10.0.2.15     80  53214  0  1  0  0  1  0
      92.122.126.240       10.0.2.15     80  53214  0  1  0  0  0  0
      209.85.229.118       10.0.2.15     80  63433  0  1  0  0  1  0
      209.85.229.118       10.0.2.15     80  63433  0  1  0  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.118       10.0.2.15     80  63433  0  1  1  0  0  0
    [...]

script examples monitoring TCP packets
examples of SystemTap scripts monitoring TCP packets
monitoring TCP packets examples of SystemTap scripts
TCP packets, monitoring examples of SystemTap scripts
TCP packets, monitoring examples of SystemTap scripts