TCPDump: Difference between revisions
Content added Content deleted
| Line 4: | Line 4: | ||
= Basics = |
|||
== TCPDump Filters== |
|||
* TCPDump done with "-i any" will result in packets with No Ethernet Headers captured in wireshark. |
|||
tcpdump -i eth0 |
|||
= Filters = |
|||
Source: [[http://www.thegeekstuff.com/2010/08/tcpdump-command-examples/ thegeekstuff.com]] |
Source: [[http://www.thegeekstuff.com/2010/08/tcpdump-command-examples/ thegeekstuff.com]] |
||
| Line 47: | Line 51: | ||
<br /> |
<br /> |
||
= Reading PCAPs = |
|||
{| class="wikitable" |
{| class="wikitable" |
||
| Line 60: | Line 64: | ||
|} |
|} |
||
= TCPDump Parameters = |
|||
| ⚫ | |||
| ⚫ | |||
{| class="wikitable" style="width: 20%" |
{| class="wikitable" style="width: 20%" |
||
|- |
|- |
||
| Line 74: | Line 79: | ||
|} |
|} |
||
== |
== Examples == |
||
{| class="wikitable" |
{| class="wikitable" |
||
! Filter !! Description |
! Filter !! Description |
||
| Line 85: | Line 91: | ||
|} |
|} |
||
== |
== Protocol keywords == |
||
{| class="wikitable" style="width: 30%" |
{| class="wikitable" style="width: 30%" |
||
!colspan="3"|Keywords |
!colspan="3"|Keywords |
||
| Line 98: | Line 105: | ||
|} |
|} |
||
== |
== TCP Flags == |
||
{| class="wikitable" style="width: 30%" |
{| class="wikitable" style="width: 30%" |
||
!colspan="3"|Flag Keywords |
!colspan="3"|Flag Keywords |
||
| Line 109: | Line 117: | ||
|} |
|} |
||
== |
== Capture Filter Primitives == |
||
{| class="wikitable" |
{| class="wikitable" |
||
|- |
|- |
||
| Line 145: | Line 154: | ||
|} |
|} |
||
= |
= Command Line Options = |
||
-A Print frame payload in ASCII |
-A Print frame payload in ASCII |
||
| Line 170: | Line 179: | ||
<br /> |
<br /> |
||
= Advanced Packet Filtering = |
|||
List interesting traffic from all the PCAP files: |
*List interesting traffic from all the PCAP files: |
||
<pre style="width: 2000px; overflow-x: scroll;"> |
<pre style="width: 2000px; overflow-x: scroll;"> |
||
for i in `find . -type f | egrep "All.pcap"`; do echo $i; tcpdump -r $i '((host 1.1.1.1 or host 2.2.2.2) and host 3.3.3.3) and port 445' ; echo -e "\n"; done |
for i in `find . -type f | egrep "All.pcap"`; do echo $i; tcpdump -r $i '((host 1.1.1.1 or host 2.2.2.2) and host 3.3.3.3) and port 445' ; echo -e "\n"; done |
||