Wireshark and tcpdump: Packet Capture for Network Analysis Networking 2013: A Summit for Network Pros Dr. Charles J. Antonelli The University of Michigan
Wireshark 2
tcpdump 3
Roadmap libpcap pcapng tcpdump Interlude: recent advances in network sniffing wireshark, tshark capinfos, dump/edit/mergepcap 4
Please notice Wireshark and tcpdump are examples of packet sniffing tools You should obtain authorization before using these tools to inspect network traffic on any networks 5
libpcap Packet capture library Obtains packets from host platform Hardware-independent API Created at LBL Included in most distros Maintained at www.tcpdump.org Sources, no binaries Version 1.5.2 released December 3, 2013 6
pcap vs. pcapng pcap a header and a set of packet records file header: magic #, major/minor version, timezone offset, timestamp accuracy, snapshot length, link layer header type (http://www.tcpdump.org/linktypes.html) packet record: timestamp (s), timestamp (us/ns), packet length, packet data timestamps packets, not much else 7
pcap vs. pcapng pcapng one or more blocks section header block (file header) interface description block (file header) enhanced packet block simple packet block (packet record) name resolution block interface statistics block options for most blocks extensible, portable, mergeable/appendable http://www.winpcap.org/ntar/draft/pcap- DumpFileFormat.html#sectionepb 8
pcap vs. pcapng Tool support for pcapng increasing Conversions: tcpdump - r pcapng - w pcap editcap - F libpcap pcapng pcap editcap - F pcapng pcap pcapng wireshark Save As pcapng, pcap, 9
tcpdump Full-content packet capture and display Packet input Directly from network interface From libpcap-format file Packet output To screen To libpcap-format file Packet filtering Version 4.5.1 released November 20, 2013 at www.tcpdump.org 10
tcpdump /usr/sbin/tcpdump -D show available interfaces, and exit -i in listen on interface in -n don't convert host addresses to names -X dump packet in hex and ascii -e dump Ethernet header also -r fn read from pcap-format file -w fn write out pcap-format file -d output capture filter bytecode, and exit Documentation at www.tcpdump.org 11
Network sniffing Passive Reads network packets May be invisible Sniffing modes Classical Span port Tap Inline http://matthias.vallentin.net/papers/thesis-bsc.pdf 12
Network sniffing Usually in conjunction with some operating system or hardware tweaks Capture filter Berkeley Packet Filter (BPF) Interpreted/compiled kernel code At base of network stack Fast capture filter no copies from kernel -> userland 10 Gbps seems to be the max 13
Network sniffing Traffic mangling hacks Special-purpose hardware (2000) FPGAs, etc. Aggregate (2006) Hash network input to a bank of IDS http://matthias.vallentin.net/papers/thesisbsc.pdf Multi-core architectures (2013) http://www.icsi.berkeley.edu/pubs/ networking/multicore-sarnoff07.pdf 14
http://www.icsi.berkeley.edu/pubs/networking/multicore-sarnoff07.pdf 15
wireshark, tshark Full-content packet capture and display Built-in protocol dissectors Many, many protocols, fully dissected and displayed Packet input Directly from network interface From libpcap-format file, and many other formats Packet output Interactive, screen-oriented Packet filtering On capture On display 16
wireshark, tshark Other features capinfos dumpcap editcap mergecap text2pcap http://www.wireshark.org/ Wireshark Blog, Videos 17
capinfos Reads a capture file and displays header and statistical information Accepts multiple input capture file formats Outputs in "long" or "table" format CSV formatting 18
capinfos /usr/bin/capinfos -L long format (default) -T table format -m -Q CSV format -A show all infos (default) man capinfos to see individual infos options 19
dumpcap Captures packets from a live network and writes the packets to a file Output in pcapng (default) or libpcap format Can specify capture filter 20
dumpcap /usr/bin/dumpcap -D show available interfaces, and exit -i in listen on interface in -I put 802.11 Wi-Fi into monitor mode -w file write output to file in pcapng format -P output in libpcap format -f expr capture filter expression expr -a cond set autostop condition cond -b ring use ring buffer with criterion crit -d output capture filter bytecode, and exit -S print statistics once per second 21
editcap Reads packets from an input file, converts them, and writes them to an output file Accepts input in several capture file formats Output in several capture file formats Can remove duplicate packets Can randomly change packet data Can include or discard packets by date or packet number 22
editcap /usr/bin/dumpcap options infile outfile pkt#[-pkt#] -F show available output formats -F fmt set output file format fmt -A time save packets with timestamp after time -B time save packets with timestamp before time -d remove duplicate packets -E prob change output data with probability prob -H include IP->hostname mappings -I secs switch to new output file every secs seconds -t adj adjust packet timestamps by adj seconds -w win remove duplicate packets in win-second window 23
mergecap Merges packets from a set of input files into a single output file Accepts input in several capture file formats Output in several capture file formats Output merged chronologically 24
mergecap /usr/bin/mergecap options outfile infile -F show available output formats -F fmt set output file format fmt -a ignore timestamps when merging -s len set snapshot length to len when writing 25
text2pcap Converts a specially-formatted text file into a pcap file Writes only pcap format output files Expects od Ax tx1 -v format, e.g, lines of the form 000000 00 e0 1e a7 05 6f 00 10... 26
Questions? 27
References http://en.wikipedia.org/wiki/wireshark http://www.tcpdump.org/ http://www.tcpdump.org/linktypes.html http://www.tcpdump.org/manpages/pcap-savefile. 5.htmlhttp://www.winpcap.org/ntar/draft/PCAP- DumpFileFormat.html http://wiki.wireshark.org/development/pcapng http://stackoverflow.com/questions/17995186/convertpcap-pcap-ng-pcap-ng-tools-libraries http://matthias.vallentin.net/papers/thesis-bsc.pdf http://www.icsi.berkeley.edu/pubs/networking/multicoresarnoff07.pdf 28