Views: 15

Locate tcpdump

which tcpdump

Install TCPdump

sudo apt install tcpdump

Tcpdump Version Validation

sudo tcpdump --version

TCPDump will resolve IPs to hostnames by default.

Traffic Captures with Tcpdump

Basic Capture Options

Listing Available Interfaces

sudo tcpdump -D

Choosing an Interface to Capture From

sudo tcpdump -i eth0

Disable Name Resolution

sudo tcpdump -i eth0 -nn

Display the Ethernet Header

sudo tcpdump -i eth0 -e

Include ASCII and Hex Output

sudo tcpdump -i eth0 -X

Tcpdump Switch Combinations

sudo tcpdump -i eth0 -nnvXX

Tcpdump Output

Tcpdump Shell Breakdown

File Input/Output with Tcpdump

Save PCAP Output to a File

sudo tcpdump -i eth0 -w ~/output.pcap

Reading Output From a File

sudo tcpdump -r ~/output.pcap

Tcpdump Packet Filtering

Filtering and Advanced Syntax Options

Helpful TCPDump Filters

Host Filter

### Syntax: host [IP]
sudo tcpdump -i eth0 host 172.16.146.2

Source/Destination Filter

### Syntax: src/dst [host|net|port] [IP|Network Range|Port]
sudo tcpdump -i eth0 src host 172.16.146.2

Utilizing Source With Port as a Filter

sudo tcpdump -i eth0 tcp src port 80

Using Destination in Combination with the Net Filter

sudo tcpdump -i eth0 dest net 172.16.146.0/24

Protocol Filter

### Syntax: [tcp/udp/icmp]
sudo tcpdump -i eth0 udp

Protocol Number Filter

With protocols that use both TCP and UDP for different functions, such as DNS, we can filter looking at one or the other TCP/UDP port 53 or filter for port 53. By doing this, we will see any traffic-utilizing that port, regardless of the transport protocol.

### Syntax: proto [protocol number]
sudo tcpdump -i eth0 proto 17

Port Filter

### Syntax: port [port number]
sudo tcpdump -i eth0 tcp port 443

Port Range Filter

### Syntax: portrange [portrange 0-65535]
sudo tcpdump -i eth0 portrange 0-1024

Less/Greater Filter

### Syntax: less/greater [size in bytes]
sudo tcpdump -i eth0 less 64

Those packets consisted of SYN, FIN, or KeepAlive packets are mostly smaller . Less than and greater than can be a helpful modifier set. 

Utilizing Greater

sudo tcpdump -i eth0 greater 500

AND Filter

### Syntax: and [requirement]
sudo tcpdump -i eth0 host 192.168.0.1 and port 23

OR Filter

### Syntax: or/|| [requirement]
sudo tcpdump -r sus.pcap icmp or host 172.16.146.1

NOT Filter

### Syntax: not/! [requirement]
sudo tcpdump -r sus.pcap not icmp

Interpreting Tips and Tricks

Using the -S switch will display absolute sequence numbers, which can be extremely long. Typically, tcpdump displays relative sequence numbers, which are easier to track and read. However, if we look for these values in another tool or log, we will only find the packet based on absolute sequence numbers. For example, 13245768092588 to 100.

The -v, -X, and -e switches can help you increase the amount of data captured, while the -c, -n, -s, -S, and -q switches can help reduce and modify the amount of data written and seen.

Many handy options that can be used but are not always directly valuable for everyone are the -A and -l switches. A will show only the ASCII text after the packet line, instead of both ASCII and Hex. L will tell tcpdump to output packets in a different mode. L will line buffer instead of pooling and pushing in chunks. It allows us to send the output directly to another tool such as grep using a pipe |.

sudo tcpdump -Ar telnet.pcap

ASCII values shown below each output line because of our use of -A. This can be helpful when quickly looking for something human-readable in the output.

Piping a Capture to Grep

sudo tcpdump -Ar http.cap -l | grep 'mailto:*'

Looking for TCP Protocol Flags

tcpdump -i eth0 'tcp[13] &2 != 0'

Hunting For a SYN Flag

sudo tcpdump -i eth0 'tcp[13] &2 != 0'