Tcpdump

From Grayhat cheatsheets
Jump to navigationJump to search

Tcpdump is a program similar to wireshwar, but in the command line. Can be useful when we have compromised a server in a network, and we want to sniff traffic there. It can import files saved by wireshark. For example, to get the IP and port that is sending packets, sort them, and display the first ones, we can do:   tcpdump -n -r file.pcap | awk­ -F  '{print $3}' | sort -u | head    The "-F" in awk indicates the field separator (awk -F " " is for using a blank space as a separator).

"sort -u" sorts and makes unique the output list, so we don't have repeated entries.   Filters can be applied:

To filter by source IP: tcpdump -n src host 172.16.40.10 -­r file.pcap 

To filter by destination IP: tcpdump -n dst host 172.16.40.10 -r file.pcap 

To filter by port:  tcpdump -n port 81 -r file.pcap    To get hexadecimal data, use the X parameter:   To filter by source IP: tcpdump -nX src host 172.16.40.10 -­r file.pcap   The flags ACK and PSH are in the 14th byte of the TCP header. Explained in pages 222 and 223 of Hacking the Art of Exploitation.

If we want to filter packets to only see those containing data, that have the flags ACK and PSH active (flags indicate the function of a packet):

tcpdump -A -n 'tcp[13] = 24' -r password_cracking_filtered.pcap

We set 24, which corresponds to the decimal number 24, 00011000 in binary, which indicates that only the flags ACK and PSH from the sequence CEUAPRSF are active. 13 refers to the value of the 13th binary byte (starting on 0) from the header, which is where these flags are specified.

With "tcpdump -i" we choose the interface to listen to, as in wireshark. con tcpdump -i se elige la interface a la que se quiere escuchar, como se hace en wireshark. For example, for a vpn we may use, if we have the tap0 interface assigned: tcpdump -i tap0

tcp -s snaplen is used to tell how many bites were captured from each packet, being snaplen the number of bytes.