Tcpdump - Revision history

NKirnbauer: google link removed

2024-10-03T09:20:03Z

google link removed

← Older revision		Revision as of 09:20, 3 October 2024
Line 36:		Line 36:

	* https://tcpdump.org		* https://tcpdump.org
	* https://google.com

	[[Category:Documentation]]		[[Category:Documentation]]

MDag: /* Capture and Analyse */

2022-02-16T16:11:00Z

Capture and Analyse

← Older revision		Revision as of 16:11, 16 February 2022
Line 15:		Line 15:


	=== Capture and ~~Analyse~~ ===		=== Capture and Analysis ===
	[[File:tcpdump-D.jpg\|thumb\|Show available interfaces]]		[[File:tcpdump-D.jpg\|thumb\|Show available interfaces]]
	To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,		To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,

MDag: /* Capture and Analysis */

2022-02-16T16:10:08Z

Capture and Analysis

← Older revision		Revision as of 16:10, 16 February 2022
Line 15:		Line 15:


	=== Capture and ~~Analysis~~ ===		=== Capture and Analyse ===
	[[File:tcpdump-D.jpg\|thumb\|Show available interfaces]]		[[File:tcpdump-D.jpg\|thumb\|Show available interfaces]]
	To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,		To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,

MDag: /* Capture */

2022-02-16T16:09:38Z

Capture

← Older revision		Revision as of 16:09, 16 February 2022
Line 15:		Line 15:


	=== Capture ===		=== Capture and Analysis ===
	[[File:tcpdump-D.jpg\|thumb\|Show available interfaces]]		[[File:tcpdump-D.jpg\|thumb\|Show available interfaces]]
	To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,		To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,

MDag at 16:08, 16 February 2022

2022-02-16T16:08:52Z

@@ Line 32: / Line 32: @@
 Capture packet size:
 In the second line you can see it says the capture size is 262144 bytes, this means that for every packet tcpdump will keep 262144 bytes for analysis. This is much larger than the typical packet size, so essentially this is saying tcpdump is capturing full packets. It's important to note the default capture size. Some versions of tcpdump default to much smaller capture sizes, for example 96 bytes. This would mean just the first 96 bytes of every packet is captured and the rest is thrown away. The capture size can be altered with the <syntaxhighlight lang="python" inline>-s</syntaxhighlight> option, in figure ''''Altered capture size 96 bytes'''' it is requested just 96 bytes for each packet instead of the default of 262144 bytes.
 == References ==

MDag: /* Functionality */

2022-02-16T16:08:15Z

Functionality

@@ Line 32: / Line 32: @@
 Capture packet size:
 In the second line you can see it says the capture size is 262144 bytes, this means that for every packet tcpdump will keep 262144 bytes for analysis. This is much larger than the typical packet size, so essentially this is saying tcpdump is capturing full packets. It's important to note the default capture size. Some versions of tcpdump default to much smaller capture sizes, for example 96 bytes. This would mean just the first 96 bytes of every packet is captured and the rest is thrown away. The capture size can be altered with the <syntaxhighlight lang="python" inline>-s</syntaxhighlight> option, in figure ''''Altered capture size 96 bytes'''' it is requested just 96 bytes for each packet instead of the default of 262144 bytes.
 == Used Hardware ==

MDag: /* Capture */

2022-02-01T07:26:12Z

Capture

← Older revision		Revision as of 07:26, 1 February 2022
Line 31:		Line 31:
	[[File:tcpdump-i any -c 5 -n -s96.jpg\|thumb\|Altered capture size 96 bytes ]]		[[File:tcpdump-i any -c 5 -n -s96.jpg\|thumb\|Altered capture size 96 bytes ]]
	Capture packet size:		Capture packet size:
	In the second line you can see it says the capture size is 262144 bytes, this means that for every packet tcpdump will keep 262144 bytes for analysis. This is much larger than the typical packet size, so essentially this is saying tcpdump is capturing full packets. It's important to note the default capture size. Some versions of tcpdump default to much smaller capture sizes, for example 96 bytes. This would mean just the first 96 bytes of every packet is captured and the rest is thrown away. The capture size can be altered with the <syntaxhighlight lang="python" inline>-s</syntaxhighlight> option, in figure ''''Altered capture size 96 bytes'''' it is requested just 96 bytes for each packet instead of the default of 262144 bytes. Specifying '0' with the <syntaxhighlight lang="python" inline>-s</syntaxhighlight> option means maximum size. When performing captures it's importnant to think about the goal when deciding the packet size to set for, for example if you are just looking for evidence of lost or out of order packets on a large file transfer, you probably don't need much more than 64 or 96 bytes of each packet. Alternatively if you are troubleshooting problems at the application layer you may require having full packets with nothing thrown out, in that case the maximum size of 262144 bytes should be plenty.		In the second line you can see it says the capture size is 262144 bytes, this means that for every packet tcpdump will keep 262144 bytes for analysis. This is much larger than the typical packet size, so essentially this is saying tcpdump is capturing full packets. It's important to note the default capture size. Some versions of tcpdump default to much smaller capture sizes, for example 96 bytes. This would mean just the first 96 bytes of every packet is captured and the rest is thrown away. The capture size can be altered with the <syntaxhighlight lang="python" inline>-s</syntaxhighlight> option, in figure ''''Altered capture size 96 bytes'''' it is requested just 96 bytes for each packet instead of the default of 262144 bytes.

	~~Tcpdump output:~~
	Here is at the fields displayed in the tcpdump output for some TCP packets. First there is a timestamp for in lid libpcap picked up the packet. On my VM you can see values down to milliseconds and even to microseconds. Next, the protocol is specified, after this is the source IP of the packet a dot and then source port of the packet. After the souce IP and port is the destination IP important. These addresses are followed by TCP flags, which could be SYN, ACK, RESET, FIN, URGENT and PUSH. All the flags are represented by the first letter with the exception of ACK which is represented by simply a dot. For an example a second VM (aitsf) is started to generate some traffic over ens33 interface to another VM. First to a closed port on the other VM and then to an open port. When connecting to the closed port we can see a SYn packet from my VM an immediately we see a reset from the other VM. Then, when connecting to port 22 through SSH which is open we see the normal three-way handshake. First the SYN and then the SYN ACK and return and finally the ACK.

	=== Analyze ===		=== Analyze ===

MDag at 07:25, 1 February 2022

2022-02-01T07:25:09Z

@@ Line 64: / Line 64: @@
 * '''Follow traffic stream''' - The traffic you are interested in will often be spread across a number of incoming and outgoing packets. This can be quite frustrating when trying to view sensitive HTTP Request/Response pairs and most application level data in general. Fortunately Wireshark allows you to select a packet and view the entire TCP stream it belongs to. Inbound and outbound traffic will be highlighted in red and blue to show the application layer communication without packet headers.
 * '''Statistics''' - This menu contains items to display various statistics windows, including a summary of recorded packets, a display of protocol hierarchy statistics and more. For example, the tab Protocol hierarchy displays descriptive statistics per log. This is useful for determining the types, amounts, and relative proportions of protocols within a trace. The tab Conversations generates descriptive statistics about each conversation for each protocol in the trace. And most importanly  the tab Flow Graph. The Flow Graph Generates a sequence graph for the selected traffic. This is useful for understanding seq. and ack. calculations.
 == Used Hardware ==

MDag: /* Capture */

2022-02-01T05:11:26Z

Capture

← Older revision		Revision as of 05:11, 1 February 2022
Line 19:		Line 19:
	To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,		To run tcpdump the available interfaces for packet captures needs to be determined. If these are not already known, they can be checked with <syntaxhighlight lang="python" inline>tcpdump -D</syntaxhighlight>,
	on my VM 'bitsf' ens33, loopback, any, bluetooth-monitor, nflog and nfqueue interfaces are available, as shown in figure ''''Show available interfaces''''.		on my VM 'bitsf' ens33, loopback, any, bluetooth-monitor, nflog and nfqueue interfaces are available, as shown in figure ''''Show available interfaces''''.


	[[File:tcpdump-i any.jpg\|thumb\|Capture without packet limit]]		[[File:tcpdump-i any.jpg\|thumb\|Capture without packet limit]]

MDag: /* Capture */

2022-02-01T05:11:09Z

Capture

← Older revision		Revision as of 05:11, 1 February 2022
Line 23:		Line 23:
	[[File:tcpdump-i any.jpg\|thumb\|Capture without packet limit]]		[[File:tcpdump-i any.jpg\|thumb\|Capture without packet limit]]
	[[File:tcpdump-i any -c 5.jpg\|thumb\|Capture limit 5 packets ]]		[[File:tcpdump-i any -c 5.jpg\|thumb\|Capture limit 5 packets ]]
	Capturing packets on all interfaces by using the 'any' option. Now we see in figure ''''Capture without packet limit'''' packets are moving by way too fast to read. Tcpdump will not stop without an interrupt signal, so to stop the capture you can use ctrl + c. Instead of letting tcpdump run until interrupted, you can use the <syntaxhighlight lang="python" inline>-c</syntaxhighlight> option, this option instructs the utility to stop after the specified number of packets are captured, for example see figure ''''Capture limit 5 packets''''. In the output we can see host names are being used instead of IP addresses (e.g. 'bitsf'), also commonly known ports are replaced with application names. Usually however it is easier to work with IP addresses and port numbers instead of these names.		Capturing packets on all interfaces by using the 'any' option. Now we see in figure ''''Capture without packet limit'''' packets are moving by way too fast to read. Tcpdump will not stop without an interrupt signal, so to stop the capture you can use ctrl + c.

			Instead of letting tcpdump run until interrupted, you can use the <syntaxhighlight lang="python" inline>-c</syntaxhighlight> option, this option instructs the utility to stop after the specified number of packets are captured, for example see figure ''''Capture limit 5 packets''''. In the output we can see host names are being used instead of IP addresses (e.g. 'bitsf'), also commonly known ports are replaced with application names. Usually however it is easier to work with IP addresses and port numbers instead of these names.

	[[File:tcpdump-i any -c 5 -n.jpg\|thumb\|Show IP addresses instead host names ]]		[[File:tcpdump-i any -c 5 -n.jpg\|thumb\|Show IP addresses instead host names ]]