Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tcpdump Examples

hackertarget.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Tcpdump Examples

#11

Post by berti »

cobbzilla wrote: post #5
sethammons wrote: post #3

I think a similar post on leveraging Wireshark would be neat. The deepest I tend to need to go is searching packets for a known substring and then following the TCP stream to see where something unexpected happened. Add to this the analyzing of the frames on this stream and you can diagnose tricky timeout issues, bad protocol usage, and much more.

Yeah, my workflow is generally to use tshark (wireshark's command-line tool) for server-side capture, then scp file to local and use wireshark gui to poke around. I find tshark's interface to be simpler than tcpdump. tcpdump feels like bringing a gun to a knife fight when all you want to do is look at application layer payloads/streams (http/etc). But it's good to know more about tcpdump than I did before, because wh…

You can also pipe tshark capture to the Wireshark GUI on your machine through ssh in realtime, e.g. `ssh host.example.com 'tshark -i eth0 -w - -F pcapng -f "not tcp port 22"' | wireshark -k -i -`

Re: Tcpdump Examples

#12

Post by andygrunwald »

GibBreakPls wrote: post #9
yedawg wrote: post #7

Earlier quoted context omitted.

Reading through a long man page in terminal to get to el' result and then find and use cmd extensions. vs 2s google "how to inurl: tcpdump http packet"

You are doing it wrong if you are "reading through a long man page".

What is the „correct“ way? (real question, I am curious)

Re: Tcpdump Examples

#13

Post by isostatic »

I use tcpdump continuously to analyse multiple RTP feeds coming in to our edge network. Found all sorts of issues with it, including packet reordering in Cisco and mikrotik routers (shouldn't be a problem with rtp - but tell that to ateme decoders), actual packet loss on juniper srx, and of course minor outages on international and even local links on the order of 100-200ms of loss.

Packet stream is dumped into some perl which keeps across the sequence number looking for out of sequence packets, summarise output every second into an elastic stack. Also have it comparing multiple streams for dual streaming and comparing skew.

Ironically I rarely use tcpdump to look at tcp packets - about the only interesting thing to me there is the SYN packets to see if the packet is getting through the firewall!

Re: Tcpdump Examples

#14

Post by berti »

andygrunwald wrote: post #12
GibBreakPls wrote: post #9

Earlier quoted context omitted.

You are doing it wrong if you are "reading through a long man page".

What is the „correct“ way? (real question, I am curious)

grep is pretty handy, -C 5 or so will get you a nice amount of context. Maybe GibBreakPls has better tricks.

Re: Tcpdump Examples

#15

Post by cobbzilla »

berti wrote: post #11
cobbzilla wrote: post #5

Earlier quoted context omitted.

Yeah, my workflow is generally to use tshark (wireshark's command-line tool) for server-side capture, then scp file to local and use wireshark gui to poke around. I find tshark's interface to be simpler than tcpdump. tcpdump feels like bringing a gun to a knife fight when all you want to do is look at application layer payloads/streams (http/etc). But it's good to know more about tcpdump than I did before, because wh…

You can also pipe tshark capture to the Wireshark GUI on your machine through ssh in realtime, e.g. `ssh host.example.com 'tshark -i eth0 -w - -F pcapng -f "not tcp port 22"' | wireshark -k -i -`

that is sweet. thanks

Re: Tcpdump Examples

#16

Post by emmelaich »

My tips:

1. Use `-i any` -- just in case the traffic you want to look at is not on the interface you think it is. Also doesn't put the interface(s) into promiscuous mode, which can be preferable.

2. Read the `pcap-filter` man page.

Re: Tcpdump Examples

#17

Post by yesenadam »

andygrunwald wrote: post #12
GibBreakPls wrote: post #9

Earlier quoted context omitted.

You are doing it wrong if you are "reading through a long man page".

What is the „correct“ way? (real question, I am curious)

You can search man pages by "/" then your search term, then press "n" to cycle forward, "N" to cycle back through occurrences.

Re: Tcpdump Examples

#18

Post by vbernat »

The "-nn" explanation seems wrong. Neither libpcap's tcpdump nor BSD's need more than one "-n" to not translate port. Even in their examples, we can spot that using a single "-n" do not translate port names.

Additionally, it's always better to always use "-p" if you don't want to accidentally attract additional traffic to the host (additional VLAN on a 802.1q interface, or additional multicast traffic).

Re: Tcpdump Examples

#19

Post by georgyo »

vbernat wrote: post #18

The "-nn" explanation seems wrong. Neither libpcap's tcpdump nor BSD's need more than one "-n" to not translate port. Even in their examples, we can spot that using a single "-n" do not translate port names. Additionally, it's always better to always use "-p" if you don't want to accidentally attract additional traffic to the host (additional VLAN on a 802.1q interface, or additional multicast traffic).

I have always had to use -nn to not translate ports. If what you say is true, it must be recent.

Re: Tcpdump Examples

#20

Post by isostatic »

georgyo wrote: post #19
vbernat wrote: post #18

The "-nn" explanation seems wrong. Neither libpcap's tcpdump nor BSD's need more than one "-n" to not translate port. Even in their examples, we can spot that using a single "-n" do not translate port names. Additionally, it's always better to always use "-p" if you don't want to accidentally attract additional traffic to the host (additional VLAN on a 802.1q interface, or additional multicast traffic).

I have always had to use -nn to not translate ports. If what you say is true, it must be recent.

I've always used -nn (or -n -n), it's really annoying - usually I want to resolve IPs, but not ports.
Post reply on HN