tcpdumpcapturing network traffic      Lev Walkin      @levwalkin
What is tcpdump?Capture[Save]FilterShow and explain
Why tcpdump?Universal file format (.pcap)Universal filter expressionCan work on remote hosts
Quick start     “No DNS”                 “Hex dump”    faster display           display payloadtcpdump -n -s 1500 -X      ...
Header    tcpdump -Xns0HEX                       ASCII(-X)                       (-A)...next
Workflow 1:     Online analysisFast (-n), full (-s0), with dump(-X), ...and filter:tcpdump -Xns0 port 80
Workflow 2:          Offline analysisFull (-s0), write to a file (-w),then read:tcpdump -s0 -w abc.pcap port 80tcpdump -nXr ab...
Architecture  tcpdump          tcpdump.exe  libpcap.so       BPF     libpcap.a  /dev/bpf0              ???BPF   BSD Kernel...
BPF: Berkeley Packet Filter The human readable filter is converted to a bytecode (-d), sent to kernel. Efficient. http://www....
Filter languageand, orport 80host nweb30‘src host localhost and dst port 80’
Timestamp                          L3 protocol (-tt, -ttt, -tttt)   Output        (IP, GRE, etc)                          ...
WTFs (0/3)tcpdump: no suitable devicefoundUse sudo or check /dev/bpf*permissions
WTFs (1/3)Output is laggy?Disable DNS resolution (-n)Or save to a file (-w)
WTFs (2/3)Nothing happens?Select a proper interface(-i ppp0)
WTFs (3/3)Want to cut-n-paste HTML?Use ASCII output (-A), or saveto .pcap (-r) and fire up vim.
RFCsIP: RFC791TCP: RFC793, 1122DNS: RFC1034, 1035Many short overviews exist!
See alsoWireShark (GUI)SSLdump (decrypt HTTPS)tcpflow (split by TCP flow)libpcap (C interface)lionet.info/ipcad
RTFMman pcap-filterman tcpdumpman pcapman bpf
Questions?
Upcoming SlideShare
Loading in...5
×

Introduction to tcpdump

1,789

Published on

Published in: Technology
0 Comments
6 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
1,789
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
62
Comments
0
Likes
6
Embeds 0
No embeds

No notes for slide

Introduction to tcpdump

  1. 1. tcpdumpcapturing network traffic Lev Walkin @levwalkin
  2. 2. What is tcpdump?Capture[Save]FilterShow and explain
  3. 3. Why tcpdump?Universal file format (.pcap)Universal filter expressionCan work on remote hosts
  4. 4. Quick start “No DNS” “Hex dump” faster display display payloadtcpdump -n -s 1500 -X “Packet size” fuller capture
  5. 5. Header tcpdump -Xns0HEX ASCII(-X) (-A)...next
  6. 6. Workflow 1: Online analysisFast (-n), full (-s0), with dump(-X), ...and filter:tcpdump -Xns0 port 80
  7. 7. Workflow 2: Offline analysisFull (-s0), write to a file (-w),then read:tcpdump -s0 -w abc.pcap port 80tcpdump -nXr abc.pcap host nweb30
  8. 8. Architecture tcpdump tcpdump.exe libpcap.so BPF libpcap.a /dev/bpf0 ???BPF BSD Kernel $OS Kernel
  9. 9. BPF: Berkeley Packet Filter The human readable filter is converted to a bytecode (-d), sent to kernel. Efficient. http://www.tcpdump.org/ papers/bpf-usenix93.pdf
  10. 10. Filter languageand, orport 80host nweb30‘src host localhost and dst port 80’
  11. 11. Timestamp L3 protocol (-tt, -ttt, -tttt) Output (IP, GRE, etc) Relative TCP ack numbersrc host src port dst host & port TCP Flags Relative TCP Advertised TCP (S, F, R) sequence number 1343949078.196214 IP window size 216.218.215.245.61966 > 50.18.0.102.80: Flags [P.], seq 1:473, ack 1, win 8265, options [nop,nop,TS val 808617737 ecr 1091126708], length 472 List of TCP Payload length options (e.g. wscale)
  12. 12. WTFs (0/3)tcpdump: no suitable devicefoundUse sudo or check /dev/bpf*permissions
  13. 13. WTFs (1/3)Output is laggy?Disable DNS resolution (-n)Or save to a file (-w)
  14. 14. WTFs (2/3)Nothing happens?Select a proper interface(-i ppp0)
  15. 15. WTFs (3/3)Want to cut-n-paste HTML?Use ASCII output (-A), or saveto .pcap (-r) and fire up vim.
  16. 16. RFCsIP: RFC791TCP: RFC793, 1122DNS: RFC1034, 1035Many short overviews exist!
  17. 17. See alsoWireShark (GUI)SSLdump (decrypt HTTPS)tcpflow (split by TCP flow)libpcap (C interface)lionet.info/ipcad
  18. 18. RTFMman pcap-filterman tcpdumpman pcapman bpf
  19. 19. Questions?
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×