Tcpdump Examples

#1

Post by thewanderer1999 » Tue, May 29, 2018, 10:49 AM UTC

Re: Tcpdump Examples

#2

Post by rdtsc » Wed, May 30, 2018, 3:10 AM UTC

Good stuff, thanks for sharing. I always forget you can do indexing into the packet itself as in tcp[((tcp[12:1] & 0xf0) >> 2):4].

Also sometimes I reach for ngrep if it is installed:

https://github.com/jpr5/ngrep/blob/master/EXAMPLES.md

Re: Tcpdump Examples

#3

Post by sethammons » Wed, May 30, 2018, 3:50 AM UTC

I think a similar post on leveraging Wireshark would be neat. The deepest I tend to need to go is searching packets for a known substring and then following the TCP stream to see where something unexpected happened. Add to this the analyzing of the frames on this stream and you can diagnose tricky timeout issues, bad protocol usage, and much more.

Re: Tcpdump Examples

#4

Post by okket » Wed, May 30, 2018, 5:02 AM UTC

Nitpick: The HTTP examples will only catch v1 traffic, not HTTP2

Re: Tcpdump Examples

#5

Post by cobbzilla » Wed, May 30, 2018, 5:27 AM UTC

sethammons wrote: post #3

I think a similar post on leveraging Wireshark would be neat. The deepest I tend to need to go is searching packets for a known substring and then following the TCP stream to see where something unexpected happened. Add to this the analyzing of the frames on this stream and you can diagnose tricky timeout issues, bad protocol usage, and much more.

Yeah, my workflow is generally to use tshark (wireshark's command-line tool) for server-side capture, then scp file to local and use wireshark gui to poke around. I find tshark's interface to be simpler than tcpdump. tcpdump feels like bringing a gun to a knife fight when all you want to do is look at application layer payloads/streams (http/etc). But it's good to know more about tcpdump than I did before, because when things get complicated it's good to have more options.

Re: Tcpdump Examples

#6

Post by GibBreakPls » Wed, May 30, 2018, 5:52 AM UTC

There is a whole industry for distilling manpages down to stupid chunks and making blog posts it seems.

Re: Tcpdump Examples

#7

Post by yedawg » Wed, May 30, 2018, 6:01 AM UTC

GibBreakPls wrote: post #6

There is a whole industry for distilling manpages down to stupid chunks and making blog posts it seems.

Reading through a long man page in terminal to get to el' result and then find and use cmd extensions. vs 2s google "how to inurl: tcpdump http packet"

Re: Tcpdump Examples

#8

Post by rubberduck123 » Wed, May 30, 2018, 6:04 AM UTC

how practical are examples ignoring https?... or am I mis-understanding target use case?

Re: Tcpdump Examples

#9

Post by GibBreakPls » Wed, May 30, 2018, 6:08 AM UTC

yedawg wrote: post #7

GibBreakPls wrote: post #6

There is a whole industry for distilling manpages down to stupid chunks and making blog posts it seems.

Reading through a long man page in terminal to get to el' result and then find and use cmd extensions. vs 2s google "how to inurl: tcpdump http packet"

You are doing it wrong if you are "reading through a long man page".

Re: Tcpdump Examples

#10

Post by therein » Wed, May 30, 2018, 6:34 AM UTC

rdtsc wrote: post #2

Good stuff, thanks for sharing. I always forget you can do indexing into the packet itself as in tcp[((tcp[12:1] & 0xf0) >> 2):4]. Also sometimes I reach for ngrep if it is installed: https://github.com/jpr5/ngrep/blob/master/EXAMPLES.md

This is one of my favorite oneliners:

  sudo stdbuf -oL -eL /usr/sbin/tcpdump -A -s 10240 \
   "tcp port 4080 and (((ip[2:2] - ((ip[0]&0xf)>2)) != 0)" | \
    grep -a --line-buffered ".+(GET |HTTP\/|POST )|^[A-Za-z0-9-]+: " | \
    perl -nle 'BEGIN{$|=1} { s/.*?(GET |HTTP\/[0-9.]* |POST )/\n$1/g; print }'