When it comes to sniffing traffic using a command line tool tcpdump is the tool of choice for both
its power and simplicity. It’s compatible with wireshark and that means that you can save the captured
packets to a file and later open
that file in wireshark on the same or another machine for a visual inspection.
Let’s see how it works! Tcpdump is installed by default on any Linux distribution. The following commands
will be executed as root.
If you want to see what’s hitting your interface you execute: tcpdump -i
and the name of the interface
In this case eth0. Let's generate some traffic!
These are the captured packets. I'm stopping the capture by pressing on control
+c. If you want to see only the packets to or from an IP address you add the host option tcpdump
-i and the interface host and an IP address
let's say 8.8.8.8 and in another terminal all I'm going to ping that IP address.
It's capturing only the packets to or from the IP address.
And if you only want to see traffic in one direction or the other you can use a src or dst like this
dst medium.com -n option is used not to convert addresses to names, you can use an IP
address or a domain name that will be translated to an IP address by your DNS server.
And these are the packets to medium.com; to capture packets going to or from a particular network
or subnet
use the Net option:
net and the sumnet address
and if you want to see packets of a specific application use the port option.
For example I want to see only https packets
port443 -vv -n To produce more verbose output and print additional
files
I’ve used the -vv . This is https traffic. If you want to see traffic going to or coming from
a specific port
use src port or dst port options. For example
I'll sniff only DNS queries and that means udp packets going to port 53:
dst port 53 -vv -n
You see, these are DNS queries!
Adding -A option will have the output include ascii strings from the capture.
This allows easy reading and the ability to parse the output using using grep or other commands.
Let's try this filter: dst port80 -a -n (-n is optional)
and I'll visit an http site, for example
Info.cern.sch
By the way
this is the home of the first website!
See the capture! If you use -x instead -a you'll see both ASCII and hexadecimal data. I'm
reloading the page.
This is the captured packet, its contents as a string and here on the left side as hexadecimal data.
Let's go ahead and see how to save the capture data to a file.It's often useful to save packets
captures into a file for analyses in the future. These files are known as PCAP (PEE-cap) files and can be opened in
Wireshark or other packet analysis tools including tcpdump itself. To write to a file use
-w option, like this! In the next example I want to save all http packets to a file so tcpdump -
i
the name of the interface - etho port80 cern.ch -w and the name of the file
cern.ch.pacp It will save the packets to this file;and I 'm generating some traffic, some
http traffic. When you want to stop the capture you simply press on control +c. 27 packets
have been captured and saved to that file. To read the file at a later time with tcpdump use -r
like this
I've read the file! Note that when reading the file all options we have seen are still available for
example -n -w an - X (an uppercase X).
At the the end of this lecture I want to show you some more advanced features of tcpdump which are
a logical end and or operators. Let's
suppose you want to capture only icmp packets going to a specific IP address, for example tcpdump -
eth0 icmp - the protocol - and host and the IP address; it will capture only icmp packets to or
from this IP address.
okay!
A ping was running in the background.
These are the packets; but if I ping another IP address, let's say stackoverflow.com,
you'll notice that the packets are not captured. And a last example,
I'll captere http or https traffic. For that
I have to use the logical or operator, like this: port 80 or port 443.