tcpdump: network traffic capture

Transcription

1 tcpdump: network traffic capture David Morgan The Big Daddy of Open Source Capture tcpdump is the core Open Source packet sniffer program simple, text based program many other programs (such as Ethereal) that use the same file-save format can be used to display or interpret tcpdump files 1

2 Many options Must be root to run Some of them Category what to capture where to capture what to show how to show save/restore Option -c -p -i -t -q -v -vv -vvv -x -n -nn -w -r Description count of packets to capture just mine (alternatively everyone s) interface specification omit timestamp quiet minimal output verbose loquacious blabby packet content as well as header no address-to-name conversion nor port/protocol-to-name conversion write capture to file replay previous capture from file 2

3 tcpdump -i i <interface> Are we in promiscuous mode here? Capturing a ping [root@rh clientserver]# tcpdump -i eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:24: vclient > rh: icmp: echo request (DF) 14:24: rh > vclient: icmp: echo reply While vclient pinged rh 3

4 Effect of -n clientserver]# tcpdump -i eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:24: vclient > rh: icmp: echo request (DF) 14:24: rh > vclient: icmp: echo reply clientserver]# tcpdump -ni eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:36: > : icmp: echo request (DF) 14:36: > : icmp: echo reply While vclient ( ) pinged rh ( ) Effect of -t clientserver]# tcpdump -i eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:24: vclient > rh: icmp: echo request (DF) 14:24: rh > vclient: icmp: echo reply clientserver]# tcpdump -ti eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 vclient > rh: icmp: echo request (DF) rh > vclient: icmp: echo reply While vclient pinged rh 4

5 Effect of -v clientserver]# tcpdump -i eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:24: vclient > rh: icmp: echo request (DF) 14:24: rh > vclient: icmp: echo reply clientserver]# tcpdump -vi eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:52: vclient > rh: icmp: echo request (DF) (ttl 64, id 0, len 84) 14:52: rh > vclient: icmp: echo reply (ttl 255, id 6268, len 84) While vclient pinged rh Effect of -x clientserver]# tcpdump -xi eth1 eth1: Setting promiscuous mode. tcpdump: listening on eth1 14:55: vclient > rh: icmp: echo request (DF) a6a1 c c c97c cd3e faf7 0e a0b 0c0d 0e0f a1b 1c1d 1e1f a2b 2c2d 2e2f :55: rh > vclient: icmp: echo reply d 0000 ff01 0f24 c c d17c cd3e faf7 0e a0b 0c0d 0e0f a1b 1c1d 1e1f a2b 2c2d 2e2f While vclient pinged rh 5

6 What to capture Category what to capture Option -c -p Description count of packets to capture just mine (alternatively everyone s) there s s more to it than that. Two what-to to-capture restrictions Voluntary: packet filter expressions Involuntary: can t capture what doesn t appear on the interface in the first place 6

7 Packet filter expressions using address primitives host src host dst host ip[16]>=224 ip[2:2]>512 ether[0]&1=1 Packet filter expressions using protocol primitives ip tcp udp icmp 7

8 Booleans and or not Filter example 8

9 Write to File -w <file name> will redirect output to a file Replay with -r r option tcpdump -r <rawfile> <text file> 9

10 -v v works on playback too View file with Wireshark too 10

11 Can't sniff across a switch? SWITCH? telnet and tcpdump Use telnet to start tcpdump on one of the stations writing to a file SWITCH Upload the trace file and replay with Ethereal 11

12 Analysis tools for dump files sanitize tcpdpriv tcpflow tcp-reduce tcpshow tcpslice trafshow sanitize 12

13 sanitize Collection of shell scripts sanitize-tcp sanitize-syn-fin sanitize-udp sanitize-encap sanitize-other Each filters out all packets except Rewrites remaining packets less info renumbered (not actual) addresses tcpflow 13

14 tcpflow apply to tcpdump-style capture file segregates traffic by TCP connection uniquely identified by quartet of 2 IP addresses and 2 ports extracts data only, from each connection stores it in separate files whose names reflect the connection tcp-reduce 14

15 tcp-reduce single-line summary, each TCP connection information fields time and duration protocol bytes sent, each side TCP state at termination tcpslice 15

16 tcpslice extract dump file parcels by timestamp interval glue them together browseclassweb: : a sample capture file contains session of browsing homepage.smc.edu/morgan_david entails 2 TCP conversations primary fetch html file for the page secondary fetch of enigma.jpg, referenced within the page 16

17 browseclassweb Target page enigma.jpg 17

18 tcpflow tcp-reduce 18

19 sanitize tcpslice 19