Tcpdump

De Linuxmemo.

(Différences entre les versions)

Aller à : Navigation, rechercher

Version du 11 septembre 2017 à 17:05

Sommaire

1 Basic syntax :
2 Output
3 Interprétation
4 Astuces

Basic syntax :

Filtering hosts :

- Match any traffic involving 192.168.1.1 as destination or source

tcpdump -i eth1 host 192.168.1.1

- As soure only

tcpdump -i eth1 src host 192.168.1.1

- As destination only

tcpdump -i eth1 dst host 192.168.1.1

Filtering ports :

- Match any traffic involving port 25 as source or destination

tcpdump -i eth1 port 25

- Source

tcpdump -i eth1 src port 25

- Destination

tcpdump -i eth1 dst port 25

Network filtering :

tcpdump -i eth1 net 192.168
tcpdump -i eth1 src net 192.168
tcpdump -i eth1 dst net 192.168

Protocol filtering :

tcpdump -i eth1 arp
tcpdump -i eth1 ip
tcpdump -i eth1 not ip6

tcpdump -i eth1 tcp
tcpdump -i eth1 udp
tcpdump -i eth1 icmp

Let's combine expressions :

Negation : ! or "not" (without the quotes)

Concatanate : && or "and"

Alternate : || or "or"

- This rule will match any TCP traffic on port 80 (web) with 192.168.1.254 or 192.168.1.200 as destination host

tcpdump -i eth1 '((tcp) and (port 80) and ((dst host 192.168.1.254) or (dst host 192.168.1.200)))'

- Will match any ICMP traffic involving the destination with physical/MAC address 00:01:02:03:04:05

tcpdump -i eth1 '((icmp) and ((ether dst host 00:01:02:03:04:05)))'

- Will match any traffic for the destination network 192.168 except destination host 192.168.1.200

tcpdump -i eth1 '((tcp) and ((dst net 192.168) and (not dst host 192.168.1.200)))'

Output

tcpdump -w capture.pcap -s 0 -i eth0

Interprétation

type de paquets:

   [S] - SYN (Start Connection)
   [S.] - SYN-ACK packet
   [.] - No Flag Set
   [P] - PSH (Push Data)
   [F] - FIN (Finish Connection)
   [R] - RST (Reset Connection)

Astuces

DNS

tcpdump -pni eth0 'port domain'