Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tcpdump Examples

hackertarget.com

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Tcpdump Examples

#21

Post by heinrichhartman »

It's pretty sad, that the best way of analyzing HTTP traffic from the command line appears to be comparing payload bytes:

  ~$ sudo tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
There should be a better way to do that. Ideally I would want a tool shows Request Method, Headers, Query String, POST Payload of requests as they come in (and let's me filter on those). It should support HTTP2 and know how to stitch together the payload from multiple packets.

HTTPS is a difficult topic. I think it's fair for a tool like this, not to mess with encrpytion. Usually you don't want to had a precious private key file to a command line tool for debugging. A better way seems to be to terminate SSL on a separate host, and analyze the un-encrypted traffic.

Re: Tcpdump Examples

#22

Post by chatmasta »

heinrichhartman wrote: post #21

It's pretty sad, that the best way of analyzing HTTP traffic from the command line appears to be comparing payload bytes: ~$ sudo tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' There should be a better way to do that. Ideally I would want a tool shows Request Method, Headers, Query String, POST Payload of requests as they come in (and let's me filter on those). It should support HTTP2 and know ho…

Lots of tools can do this. I use mitmproxy personally. You can easily customize it by using it as a python library.

Re: Tcpdump Examples

#23

Post by chatmasta »

Shameless plug, but if you’re interested in this sort of thing, I published a proof of concept docker container that makes packet analysis with scapy very easy. [0] The trick is to leverage iptables nfqueue to filter packets you’re interested in, and have scapy listen to the queue.

[0] https://github.com/milesrichardson/docker-nfqueue-scapy

Re: Tcpdump Examples

#24

Post by carlosvega »

I recently presented my tool HTTPanalyzer at RIPE76. It's a C tool I developed in 2016 available at Github for processing HTTP traffic up to 10Gbps from PCAP files or straight from the interface. I recommend the branch "revisited", much better coded in my opinion. Of course, it's limited to the first packet of the request and first packet of the response. It's aimed to aggregated statistics like response codes, user agents, response time (immediate one, not full load of the resource) etc. More info here: https://carlosvega.github.io/httpDissector/

Only HTTP traffic, you can process decrypted HTTPS traffic (like some devices do, i.e. IXIA network devices) which is transformed into HTTP traffic. Regarding HTTPS or HTTP2 etc. The current approach is to correlate the application information from log events against traffic measurements.

Re: Tcpdump Examples

#26

Post by peterwwillis »

Using Tcpdump to analyze HTTP won't always work. Unless I'm mistaken, Tcpdump doesn't decode packet fragments into a stream, so if the request is fragmented, your grep won't work. If there are multiple HTTP requests in one TCP stream, it's less likely they are aligned completely in one packet, also fragmenting the request. And if it's a request to Google it could be in QUIC rather than TCP. You may wonder what on your network is broken because you can't see the requests, but it's just the network fragmenting packets.

Tshark (nee Wireshark) I believe does decode packet fragments into streams, and allows you to use more advanced Wireshark protocol filters. My suggestion is to start a pcap capture, and at the same time replay it using Tshark with the filters you want. This way you can re-analyze the same live traffic both now and later.

Re: Tcpdump Examples

#28

Post by Jakob »

sethammons wrote: post #3

I think a similar post on leveraging Wireshark would be neat. The deepest I tend to need to go is searching packets for a known substring and then following the TCP stream to see where something unexpected happened. Add to this the analyzing of the frames on this stream and you can diagnose tricky timeout issues, bad protocol usage, and much more.

The website references its Wireshark article under "Wrapping Up": https://hackertarget.com/wireshark-tutorial-and-cheat-sheet/

Re: Tcpdump Examples

#29

Post by jjrh »

I can't count the number of times tcpdump has made debugging a problem a zillion times faster. It's my go to tool for any network related issue.

I tend to end up using wireshark for analysis of more complicated SIP issues but I always start with tcpdump.

Re: Tcpdump Examples

#30

Post by heinrichhartman »

chatmasta wrote: post #22
heinrichhartman wrote: post #21

It's pretty sad, that the best way of analyzing HTTP traffic from the command line appears to be comparing payload bytes: ~$ sudo tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' There should be a better way to do that. Ideally I would want a tool shows Request Method, Headers, Query String, POST Payload of requests as they come in (and let's me filter on those). It should support HTTP2 and know ho…

Lots of tools can do this. I use mitmproxy personally. You can easily customize it by using it as a python library.

Looks like this requires me to redirect all traffic through a proxy server. This sounds very different from what I want to do.

I don't want to change the data path in any way. I just want to listen in.

Post reply on HN