‫TCPDUMP is a free, open source, very common and fast packet analyzer that runs under the command line.
‫It prints out a description of the contents of packets on a network interface that matched the Boolean
‫expression given as a parameter.
‫TCPDUMP has a lot of filtering options.
‫We'll discuss some of them in the next slide.
‫It can be preferred to the other pack it analyze, such as Wireshark, because it's so fast.
‫It also supports some of the most common network traffic capturing format pcap.
‫You can say the result as raw ASCII text in a document as well.
‫So have a look at this.
‫These are some of the parameters you can use with the tcpdump command D or list interfaces, prints
‫the list of the network interfaces available in the system and on which tcpdump can capture packets.
‫I or interface listens in on the interface.
‫If unspecified tcpdump searches, the system interface list for the lowest numbered configured interface,
‫excluding loopback, which may turn out to be, for example, if zero.
‫In means do not convert addresses, that is host addresses, port numbers, et cetera, to names.
‫V produces verbose output when parsing and printing.
‫The more V, the more detailed W writes the raw packet to specified file rather than parsing and printing
‫them out.
‫Are reads packets from the file, which was created with the option or by other tools that write PCAP
‫or P capping files.
‫A prince.
‫Each packet in ASCII.
‫Handy for capturing Web pages when parsing and printing, in addition to printing the headers of each
‫packet.
‫Capital X prints the data of each packet in Hex and ASCII.
‫It's very handy for analyzing new protocol.
‫So if you use the X option, the data of each packet is printed in Hex.
‫In addition to these options, you can filter the results in several ways.
‫If you would like to monitor a specific protocol such as TCP, you can use its name as the filter.
‫You can capture packets to or from an endpoint residing in the network using net filter or use host
‫filter to see the packets of a host as a source destination or either one.
‫Use the port to filter TCP or UDP packets sent to or from a specified port use port range to listen
‫to ports in any given range.
‫Now, if you use the R C option, you can see only the packets where the target system is the source
‫of the packet.
‫Similarly, DSD is used to specify the destination system.
‫So, of course, you can use more than one filter and a command and set up the relation using and and
‫or as logical operators, for example, host is one that 1.1.1 and Port is 80.
‫Now, before running several tcpdump commands, let's examine the fields of a typical tcpdump output
‫row, the rows shown in the slide is a TCP packet.
‫The first field is the time when the packet arrived with the time stamp as hour, minute, second and,
‫well, the fractions of a second.
‫So the second field is a protocol running atop the link layer, in this case IPV four.
‫Now for IP packets, the third field is the IP address, her hostname of the host sending the packet
‫along with four TCP and UDP packets, the source port.
‫The packet on the slide came from Port 80 of the system, one seven two one six nine nine eight one
‫three nine.
‫Now the fourth field is the IP address or hostname of the host receiving the packet, along with four
‫TCP and UDP packets.
‫The destination port flags is the TCP segment flag.
‫The packet on the slide doesn't have any flag, said, other than ACH.
‫Ach is the acknowledgment number in the packet.
‫TCPDUMP shows sequence and acknowledgement numbers relative to the initial sequence number by default.
‫When is the source hosts TCP window and you see the options field length is the length of the data in
‫the TCP segment.
‫Mike here is zero, so that means that no data is exchanged yet.
‫So that's enough for now.
‫Let's see tcpdump in action.
‫Time for hands on.