TCPDUMP. Chia-Tien Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University

Transcription

1 TCPDUMP Chia-Tien Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University

2 PURPOSE Dump the content of a packet Analyze network traffic You have to be root to run it

3 SAMPLE OUTPUT sudo tcpdump tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 14:40: IP Lo-Ubuntu.local.ssh > campus-dhcp spsu.edu.2243: P : (112) ack win :40: IP Lo-Ubuntu.local.ssh > campus-dhcp spsu.edu.2243: P 112:224(112) ack 1 win :40: IP campus-dhcp spsu.edu.2243 > Lo-Ubuntu.local.ssh:. ack 224 win :40: IP Lo-Ubuntu.local > einstein.spsu.edu.domain: PTR? in-addr.arpa. (41) 14:40: IP einstein.spsu.edu.domain > Lo-Ubuntu.local.36440: 23697* 1/2/2 (158) 14:40: IP Lo-Ubuntu.local > einstein.spsu.edu.domain: PTR? in-addr.arpa. (45) 14:40: IP einstein.spsu.edu.domain > Lo-Ubuntu.local.48231: NXDomain 0/1/0 (122) ^C14:40: IP Lo-Ubuntu.local.mdns > mdns: 0 PTR (QM)?

4 OUTPUT FORMAT 14:40: IP Lo-Ubuntu.local.ssh > campusdhcp spsu.edu.2243: P : (112) ack win time stamp: 14:40: source host name: Lo-Ubuntu.local Source port: ssh (22) Direction: > Destination hostname: campus-dhcp spsu.edu Destination port: 2243 P: TCP flag PUSH Beginning SEQ and ending SEQ with byte sent: : (112) Note: bseq + bytesent = eseq Acknowledge number: ack Receiving buffer size for Lo-Ubuntu.local: win 65535

5 OPTIONS tcpdump [ -AdDeflLnNOpqRStuUvxX ] [ -c count ] [ -C file_size ] [ -F file ] [ -i interface ] [ -m module ] [ -M secret ] [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ] [ -W filecount ] [ -E spi@ipaddr algo:secret,... ] [ -y datalinktype ] [ -Z user ] [ expression ]

6 BINARY DUMP Tcpdump w filename Tcpdump r filename

7 -N -n, which requests that names are not resolved-- resulting in the IPs themselves always being displayed. 14:46: IP > : P :133808(128) ack 1521 win :46: IP > :. ack win 64431

8 -X -X, which displays both hex and ascii content within the packet 14:46: IP Lo-Ubuntu.local.ssh > campus-dhcp spsu.edu.2243: P 30368:31488(1120) ack 321 win x0000: cc c0a8 2c8c E...I@.@.q...,. 0x0010: 0a05 01e c3 3a6c bf68 e233 2cd5...:l.h.3,. 0x0020: 5018 ffff e7 48c9 0d35 398e P...#...w.H x0030: 3f52 7a88 bf70 01fe f5 758b 5369?Rz..p..Se7.u.Si 0x0040: 2fa2 18fb 85a9 c5e2 789e 97e4 /...x...

9 -S -S, which changes the display of sequence numbers to absolute rather than relative. 14:51: IP campus-dhcp spsu.edu.2243 > Lo-Ubuntu.local.ssh:. ack win :51: IP campus-dhcp spsu.edu.2243 > Lo-Ubuntu.local.ssh:. ack win 64911

10 -S SNAPLEN 68 bytes of data from a packet by default. If you would like to look at more, add the -s number option to the mix, where number is the number of bytes you want to capture. -s 1514

11 FREQUENTLY USED OPTIONS -i any : Listen on all interfaces just to see if you're seeing any traffic. -n : Don't resolve hostnames. -nn : Don't resolve hostnames or port names. -X : Show the packet's contents in both hex and ASCII. -v, -vv, -vvv : Increase the amount of packet information you get back. -c : Only get x number of packets and then stop. -S : Print absolute sequence numbers. -e : Get the ethernet header as well. -q : Show less protocol information.

12 COMBINATION OPTIONS Basic communication // see the basics without many options tcpdump -ns Basic communication (very verbose) // see a good amount of traffic, with verbosity and no name help tcpdump -nnvvs A deeper look at the traffic // adds -X for payload but doesn't grab any more of the packet tcpdump -nnvvxs Heavy packet viewing // the final "s" increases the snaplength, grabbing the whole packet tcpdump -nnvvxss 1514

13 EXPRESSIONS Type options are host, net, and port. Direction is indicated by dir, and there you can have src, dst, src or dst, and src and dst. look for traffic based on IP address tcpdump host find traffic from only a source or destination tcpdump src tcpdump dst capture an entire network using CIDR notation tcpdump net /24 works for tcp, udp, and icmp. tcpdump icmp see only traffic to or from a certain port tcpdump port 3389 filter based on the source or destination port tcpdump src port 1025 tcpdump dst port 3389

14 BOOLEAN EXPRESSIONS AND and or && OR or or EXCEPT not or!

15 EXAMPLES TCP traffic from destined for port 3389: tcpdump -nnvvs tcp and src and dst port 3389 Traffic originating from the network headed for the 10 or networks: tcpdump -nvx src net /16 and dst net /8 or /16 Non-ICMP traffic destined for from the network tcpdump -nvvxss 1514 dst and src net /16 and not icmp Traffic originating from Mars or Pluto that isn't to the SSH port tcpdump -vv src mars or pluto and not dst port 22

16 SINGLE QUOTES Traffic that's from AND destined for ports 3389 or 22 tcpdump 'src and (dst port 3389 or 22)' Or: fix this by escaping the parenthesis

17 ADVANCED FILTERS Show me all URG packets tcpdump 'tcp[13] & 32!= 0' Show me all ACK packets # tcpdump 'tcp[13] & 16!= 0' Show me all PSH packets # tcpdump 'tcp[13] & 8!= 0' Show me all RST packets # tcpdump 'tcp[13] & 4!= 0' Show me all SYN packets # tcpdump 'tcp[13] & 2!= 0' Show me all FIN packets # tcpdump 'tcp[13] & 1!= 0' Show me all SYN-ACK packets # tcpdump 'tcp[13] = 18'

18 MORE Display all IPv6 Traffic: # tcpdump ip6 Show all traffic with both SYN and RST flags set: (should never happen) # tcpdump 'tcp[13] = 6 Show all traffic with the "evil bit" set: # tcpdump 'ip[6] & 128!= 0'

19 FOR MORE INFORMATION man tcpdump