Tcpdump is a free open source, very common and fast packet analyzer that runs under the command line.
It prints out a description of the contents of packets on a network interface that match the Boolean
expression given as a parameter.
Tcpdump has a lot of filtering options.
We'll discuss some of them in the next slide.
It can be preferred to the other packet analyzers such as Wireshark because it's so fast.
It also supports some of the most common network traffic capturing format pcap.
You can save the results as raw Ascii text in a document as well.
So have a look at this.
These are some of the parameters you can use with the Tcpdump Command D or list interfaces.
Prints the list of the network interfaces available on the system and on which tcpdump can capture packets.
I or interface listens in on the interface.
If unspecified.
Tcpdump searches the system interface list for the lowest numbered configured interface excluding loopback,
which may turn out to be, for example, Eth0.
N means do not convert addresses.
That is, host addresses, port numbers, etcetera to names.
V produces verbose output when parsing and printing, the more V, the more details.
W writes the raw packets to specified file rather than parsing and printing them out.
Are reads packets from the file which was created with the W option or by other tools that write pcap
or pcap files.
A prince each packet in Ascii.
Handy for capturing web pages when parsing and printing.
In addition to printing the headers of each packet.
Capital X prints the data of each packet in hex and Ascii.
This is very handy for analyzing new protocols.
So if you use the X option, the data of each packet is printed in hex.
In addition to these options, you can filter the results in several ways.
If you would like to monitor a specific protocol such as TCP, you can use its name as the filter.
You can capture packets to or from an endpoint residing in the network using netfilter or use host filter
to see the packets of a host as a source destination or either one.
Use the port to filter TCP or UDP packets sent to or from a specified port.
Use port range to listen to ports in any given range.
Now, if you use the SRC option, you can see only the packets where the target system is the source
of the packets.
Similarly, DST is used to specify the destination system.
So of course you can use more than one filter in a command and set up the relation using and and or
as logical operators.
For example, host is 1.1.1.1 and port is 80.
Now, before running several Tcpdump commands, let's examine the fields of a typical tcpdump output
row.
The row is shown in the slide is a TCP packet.
The first field is the time when the packet arrived with the time stamp as our minute second and well,
the fractions of a second.
So the second field is a protocol running atop the link layer in this case IPV four.
Now for IP packets.
The third field is the IP address or host name of the host sending the packet along with for TCP and
UDP packets.
The source port.
The packet on the slide came from Port 80 of the system.
172.16.99.139.
Now the fourth field is the IP address or hostname of the host receiving the packet along with for TCP
and UDP packets the destination port.
Flags is the TCP segment flag.
The packet on the slide doesn't have any flags set other than ack ack is the acknowledgement number
in the packet.
Tcpdump shows sequence and acknowledgement numbers relative to the initial sequence number by default.
When is the source hosts TCP window and you see the options.
Field length is the length of the data in the TCP segment.
Length here is zero.
So that means that no data is exchanged yet.
So that's enough for now.
Let's see.
Tcpdump in action.
Time for Hands on.