A tcpdump Primer with Examples.docx

1、A tcpdump Primer with ExamplesA tcpdump Primer with Examples Options Basic Usage Examples Writing to a File Getting Creative Advancedtcpdumpis the premier network analysis tool forinformation securityprofessionals. Having a solid grasp of this ber-powerful application is mandatory for anyone desirin

2、g a thorough understanding ofTCP/IP. Many prefer to use higher level analysis tools such asEtherealWireshark, but I believe this to usually be a mistake.In a discipline so dependent on a true understanding of concepts vs.rote learning, its important to stay fluent in the underlying mechanics of the

3、TCP/IP suite. A thorough grasp of these protocols allows one to troubleshoot at a level far beyond the average analyst, but mastery of the protocols is only possible through continued exposure to them.When using a tool that displays network traffic a more natural (raw) way the burden of analysis is

4、placed directly on the human rather than the application. This approach cultivates continued and elevated understanding of the TCP/IP suite, and for this reason Istronglyadvocate usingtcpdumpinstead of other tools whenever possible.15:31:34.079416 IP (tos 0x0, ttl 64, id 20244, offset 0, flags DF, p

5、roto: TCP (6), length: 60) source.35970 dest.80: S, cksum 0x0ac1 (correct), 2647022145:2647022145(0) win 5840 0x0000: 4500 003c 4f14 4000 4006 7417 0afb 0257 E. 0x0010: 4815 222a 8c82 0050 9dc6 5a41 0000 0000 H.*.P.ZA. 0x0020: a002 16d0 0ac1 0000 0204 05b4 0402 080a . 0x0030: 14b4 1555 0000 0000 010

6、3 0302OptionsBelow are a few options (with examples) that will help you greatly when working with the tool. Theyre easy to forget and/or confuse with other types of filters, i.e. ethereal, so hopefully this page can serve as a reference for you, as it does me.First off, I like to add a few options t

7、o thetcpdumpcommand itself, depending on what Im looking at. The first of these is-n, which requests that names are not resolved, resulting in the IPs themselves always being displayed. The second is-X, which displays both hex and ascii content within the packet. The final one is-S, which changes th

8、e display of sequence numbers to absolute rather than relative. The idea there is that you cant see weirdness in the sequence numbers if theyre being hidden from you. Remember, the advantage of usingtcpdumpvs. another tool is getting manual interaction with the packets.Its also important to note tha

9、ttcpdumponly takes the first6896 bytes of data from a packet by default. If you would like to look at more, add the-snumberoption to the mix, wherenumberis the number of bytes you want to capture. I recommend using 0 (zero) for a snaplength, which gets everything. Heres a short list of the options I

10、 use most: NOTE: All of the following come aftertcpdump, for example:tcpdump -i any -i any: Listen on all interfaces just to see if youre seeing any traffic. -i eth0: Listen on the eth0 interface. -D: Show the list of available interfaces -n: Dont resolve hostnames. -nn: Dont resolve hostnamesorport

11、 names. -q: Be less verbose (more quiet) with your output. -X: Show the packetscontentsin bothhexandASCII. -XX: Same as-X, but also shows the ethernet header. -v, -vv, -vvv: Increase the amount of packet information you get back. -c: Only getxnumber of packets and then stop. icmp: Only get ICMP pack

12、ets. -s: Define thesnaplength(size) of the capture in bytes. Use-s0to get everything, unless you are intentionally capturing less. -S: Print absolute sequence numbers. -e: Get the ethernet header as well. -q: Show less protocol information. -E: Decrypt IPSEC traffic by providing an encryption key. T

13、he default snaplength as oftcpdump4.0 has changed from 68 bytes to 96 bytes. While this will give you more of a packet to see, it still wont get everything. Use-s 1514to get full coverage Basic UsageSo, based on the kind of traffic Im looking for, I use a different combination of options totcpdump,

14、as can be seen below:1. Basic communication/ see the basics without many options#tcpdump-nS2. Basic communication (very verbose)/ see a good amount of traffic, with verbosity and no name help#tcpdump-nnvvS3. A deeper look at the traffic/ adds -X for payload but doesnt grab any more of the packet#tcp

15、dump-nnvvXS4. Heavy packet viewing/ the final “s” increases the snaplength, grabbing the whole packet#tcpdump-nnvvXSs1514Heres a capture of exactly two (-c2)ICMPpackets (apingandpong) using some of the options described above. Notice how much we see about each packet.hermes root # tcpdump -nnvXSs 0

16、-c2 icmptcpdump: listening on eth0, link-type EN10MB (Ethernet), 23:11:10.370321 IP (tos 0x20, ttl 48, id 34859, offset 0, flags none, length: 84) 69.254.213.43 72.21.34.42: icmp 64: echo request seq 0 0x0000: 4520 0054 882b 0000 3001 7cf5 45fe d52b E.T.+.0.|.E.+ 0x0010: 4815 222a 0800 3530 272a 000

17、0 25ff d744 H.50.%.D 0x0020: ae5e 0500 0809 0a0b 0c0d 0e0f 1011 1213 . 0x0030: 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 .!# 0x0040: 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233 $%&()+,-./0123 0x0050: 3435 3637 456723:11:10.370344 IP (tos 0x20, ttl 64, id 35612, offset 0, flags none, length: 84) 72.21.34.4

18、2 69.254.213.43: icmp 64: echo reply seq 0 0x0000: 4520 0054 8b1c 0000 4001 6a04 4815 222a E.T.j.H. 0x0010: 45fe d52b 0000 3d30 272a 0000 25ff d744 E.+.=0.%.D 0x0020: ae5e 0500 0809 0a0b 0c0d 0e0f 1011 1213 . 0x0030: 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223 .!# 0x0040: 2425 2627 2829 2a2b 2c2d 2e2f 3

19、031 3233 $%&()+,-./0123 0x0050: 3435 3637 45672 packets captured2 packets received by filter0 packets dropped by kernelhermes root # ExamplesExpressions allow you to trim out various types of traffic and find exactly what youre looking for. Mastering the expressions and learning to combine them crea

20、tively is what makes one truly powerful withtcpdump. There are three main types of expression:type,dir, andproto.Type options arehost,net, andport. Direction is indicated bydir, and there you can havesrc,dst,src or dst, andsrc and dst. Here are a few that you should definitely be comfortable with: h

21、ost/ look for traffic based on IP address (also works with hostname if youre not using-n)#tcpdumphost1.2.3.4 src,dst/ find traffic from only a source or destination (eliminates one side of ahostconversation)#tcpdumpsrc2.3.4.5#tcpdumpdst3.4.5.6 net/ capture an entire network usingCIDRnotation#tcpdump

22、net1.2.3.0/24 proto/ works for tcp, udp, and icmp. Note that you dont have to typeproto#tcpdumpicmp port/ see only traffic to or from a certain port#tcpdumpport3389 src, dst port/ filter based on the source or destination port#tcpdumpsrcport1025#tcpdumpdstport389 src/dst, port, protocol/ combine all

23、 three#tcpdumpsrcport1025andtcp#tcpdumpudpandsrcport53You also have the option to filter by arangeof ports instead of declaring them individually, and to only see packets that are above or below a certain size. Port Ranges/ see traffic to any port in a rangetcpdumpportrange21-23 Packet Size Filter/

24、only see packets below or above a certain size (in bytes)tcpdumpless32tcpdumpgreater128 You can use the symbols forless than,greater than, andless than or equal/greater than or equal signsas well. / filtering for size using symbolstcpdump32tcpdump=128Writing to a Filetcpdumpallows you to send what y

25、oure capturing to a file for later use using the-woption, and then to read it back using the-roption. This is an excellent way to capture raw traffic and then run it through various tools later.The traffic captured in this way is stored intcpdumpformat, which is pretty much universal in the network

26、analysis space. This means it can be read in by all sorts of tools, includingWireshark,Snort, etc.Capture all Port 80 Traffic to a File#tcpdump -s 1514port80-wcapture_fileThen, at some point in the future, you can then read the traffic back in like so:Read Captured Traffic back intotcpdump#tcpdump -

27、rcapture_fileGetting CreativeExpressions are nice, but the real magic oftcpdumpcomes from the ability tocombinethem in creative ways in order to isolate exactly what youre looking for. There are three ways to do combinations, and if youve studied computers at all theyll be pretty familar to you:1. A

28、NDandor&2. ORoror|3. EXCEPTnotor!More Examples# TCP traffic from 10.5.2.3 destined for port 3389tcpdump -nnvvSsrc 10.5.2.3anddst port 3389# Traffic originating from the 192.168 network headed for the 10 or 172.16 networkstcpdump -nvX src net 192.168.0.0/16anddst net 10.0.0.0/8or172.16.0.0/16# Non-IC

29、MP traffic destined for 192.168.0.2 from the 172.16 networktcpdump -nvvXSs 1514 dst 192.168.0.2andsrc netandnot icmp# Traffic originating from Mars or Pluto that isnt to the SSH porttcpdump -vv src marsandnotdst port 22As you can see, you can build queries to find just about anything you need. The k

30、ey is to first figure outpreciselywhat youre looking for and then to build the syntax to isolate that specific type of traffic.GroupingAlso keep in mind that when youre building complex queries you might have to group your options using single quotes. Single quotes are used in order to telltcpdumpto

31、 ignore certain special characters in this case the “( )” brackets. This same technique can be used to group using other expressions such ashost,port,net, etc. Take a look at the command below:# Traffic thats from 10.0.2.4 AND destined for ports 3389 or 22(incorrect)tcpdump src 10.0.2.4 and(dst port