<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello to all and happy new year.<br>
<br>
I am trying to acquire a tcp dump in a pcap file using the following
command:<br>
<br>
<font face="Courier New, Courier, monospace"><i>sudo tcpdump -s 0
host HOST_IP -i eth0 -w tcpdump_test.pcap</i></font><br>
<br>
The OS is <u><i>Ubuntu 14.04</i></u> server edition with the <b><i>3.13.0-92-generic</i></b>
kernel running on an AWS instance.<br>
<br>
I am able to capture incoming traffic from the host to my server but
when I download the pcap file and open it in Wireshark I do not see
the outgoing traffic (neither ESP packets nor clear text). <br>
<br>
I have tried to use nflog as described in
(<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/CorrectTrafficDump">https://wiki.strongswan.org/projects/strongswan/wiki/CorrectTrafficDump</a>)
but it seems that nflog is not included with the Ubuntu kernel. I am
unable to find a way to see outgoing traffic towards the host in
question.<br>
<br>
Can anyone please suggest a solution?<br>
<br>
Thank you in advance<br>
<br>
Alex<br>
<br>
<br>
</body>
</html>