dokucama

This is an old revision of the document!

TCPDUMP NOTES
tcp_notes
To write the tcpdump output in pcap format. If we Add capital W, that means rotate:

tcpdump -ni eth0 -s0 -w /var/tmp/capture.pcap
tcpdump -ni eth0 -w /var/tmp/trace -W 48 -G 1800 -C 100 -K    # 48 files, either every 1800 seconds (=30 minutes) or every 100 MB, -K don't verify checksum
tcpdump -nni bond1 -w /var/tmp/trace -W 1 -G 20 -C 100 -K

After capture, transfer example:

gk# scp root@slingshot2.nj.mycompany1.co.uk:/var/tmp/capture.pcap /home/jaime_santos/Downloads/
hm# scp root@gatekeeper.mycompany1.co.uk:/home/jaime_santos/Downloads/capture.pcap capture-ams.pcap
remote# rm /var/tmp/capture.pcap
gk# rm /var/tmp/capture.pcap

These are useful links:
link1 link2 link3

Check port, protocol and source or destination address:
host is for bidirectional flow. For source or destination IP , we use src and dst. For port: src port or dst port

tcpdump -nnvvi eth1 host 10.5.2.3 and dst port 3389 and tcp
tcpdump -nni any portrange 60000-60100
tcpdump -vv -e -nni any ether proto 0x8809   # LACP
tcpdump -n -i eth0 -A -x dst port 443 and greater 100  # packet lenght

To show mac address headers. Note that if we specify any as interface, we will miss one mac address, always try to specify the interface we are capturing data:

tcpdump -c10 -enni wlp2s0 # showd ETHERNET HEADERS and captures a FEW PACKETS.
tcpdump -e -nni  bond0  ether src host 00:00:5e:00:01:04 and not vrrp      # to show ETHERNET HEADERS

-S : To print absolute rather than relative TCP sequence numbers.

tcpdump -nnvvi bond0 'not (src net (10 or 172.16/12 or 192.168/16) and dst net (10 or 172.16/12 or 192.168/16))'   # EXCLUDE PRIVATE ADDRESSES
tcpdump -nni any 'not ((dst net (10 or 172.16/12 or 192.168/16 or 169.254/16)) or host 127.0.0.1)'   # EXCLUDE PRIVATE ADDRESSES and APIPA and loopback

A very simple check before tcpdump is the one below, showing which interface is passing the traffic:

cat /proc/net/dev

http://danielmiessler.com/study/tcpdump/ http://packetpushers.net/masterclass-tcpdump-expressions/
Examples

tcpdump -ni any port 5005 -s0 -A
tcpdump -nni eth1 -A -s 0  vlan 4000 and '(host 155.140.121.12 or (vlan and host 155.140.121.12))' -n # Spanned ports
tcpdump src port 1025 and tcp
tcpdump -nnvvS and src 10.5.2.3 and dst port 3389
tcpdump -w net75.out -s 0 net 65.192.0.0/10\\
\\

TOP TALKERS, or just iftop

sudo tcpdump -tnn -c 400000 -i bond0  | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | head

Capture any packets where the source or destination host is 192.168.1.1. Display IP addresses and port numbers:

tcpdump -n host 192.168.1.1

-S : To print absolute rather than relative TCP sequence numbers.

tcpdump -ni eth1 vlan 4001 and '(host 94.142.191.160 or (vlan and host 94.142.191.160))' -n -A -s 0 |grep FIX |sed 's/.*FIX/FIX/'
tcpdump -nr span-EAT-MDS-eth1-96 vlan and port 57462 or '(vlan and port 57462)' -s 0 -A > /tmp/out <-- This is to apply tcpdump ON A FILE
tcpdump -nr span-EAT-MDS-eth1-96 -s 0 -A |grep -B 1 -i  barct1md |head <-- to look for a string in the body  ; sed 's/\.\.*\././g' <-- to strip the point/dot trails ; | grep -B 1 -E '192.168.0.9.32933' <-- to follow  the flow ; grep -w '\[P.\]' <-- to find flags
tcpdump -nr span-PROD-OE-eth4-0573 -s 0 -A |grep -B 1 -E '155.195.219.196.25727' | grep --color '\[S\.\]\|\[R\.\]\|\[F\.\]'
tcpdump -nnr span-EAT-OE-eth1-86 vlan 4001 -s 0 -A |grep -B 1 dhubt2|head <-- to search for the source IP corresponding to an account name
tcpdump -nnr span-PROD-OE-eth4-0664 -A -s 0 |sed 's/.*FIfX/8=FIX/'| grep -v 35=0| grep -B 2 'msoe1\|10.39.145.1' | more
tcpdump -ni eth1 -s 0 -A  | grep FIX | sed -e 's/^.*8=FIX/8=FIX/g' -e 's/8=FIX/\n&/g' | egrep "269=[0-9].278=[0-9]*.270=[0-9]*.[0-9]*.271=[0-9]*." --color\\

This is to capture bidirectional flows in RSPAN tagged connection (tag separates different span points, in this case is 4000:

tcpdump -ni eth1 -A -s 0  vlan 4000 and '(host 155.140.121.12 or (vlan and host 155.140.121.12))' -n -A -s 0 |grep FIX |sed 's/.*FIX/FIX/'

Flags significance:

• “[X.]” means X plus ACK piggybacked
  
• “P” Seeing a PUSH flag is not necessary bad. For real time messages (as FIX prot). TCP presents to upper layers a simple socket which can be read from and written to. “pushing” data out immediately, rather than waiting for additional data to enter the buffer.
  

In the following example we extract packets only with the P flag:

tcpdump -nr span-EAT-MDS-eth1-96 -s 0 -A |grep -B 1 -i  barct1md |sed 's/\.\.*\././g' | grep -w '\[P.\]' \\

Formatting some FIX traffc:

tcpdump -ni eth1 -s 0 -A  | grep FIX | sed -e 's/^.*8=FIX/8=FIX/g' -e 's/8=FIX/\n&/g' | egrep "269=[0-9].278=[0-9]*.270=[0-9]*.[0-9]*.271=[0-9]*." --color

IPV6:

tcpdump -nni any icmp6 and '(ip6[40] == 128 or ip6[40] == 129)'   # ICMP request and reply
tcpdump -nni any icmp6 and '(ip6[40] == 135 or ip6[40] == 136)'   # NS and NA
tcpdump -nni any icmp6 and '(ip6[40] == 133 or ip6[40] == 134)'   # RS and RA

FOR RUNTIME STATISTICS:

tshark -i any -n -q -z 'io,stat,0,FRAMES()tcp.port==389,FRAMES()tcp.port==88,FRAMES()udp.port==53'

LIBCAP RELATED UTILITIES

tcprewrite -C --enet-dmac=64:9e:f3:7b:e8:c2 -i archer.pcap -o archer1.pcap
tcpreplay -i eth0 --loop 0 xxx.pcap