Packet captures with tcpdump
Tcpdump is a popular network analyzer.
It's pre-installed on many Linux distributions and can be installed on most Unix-like operating systems, like macOS.
You can easily capture and monitor network traffic such as TCP, IP, ICMP, and many more.
Tcpdump is a command line tool.
This means that it does not have a graphical user interface.
Earlier in the program, you learned that the command line is a very powerful and efficient tool, and we'll practice using it together.
With tcpdump, you can apply options and flags to your commands to easily filter network traffic so that you can find exactly what you're looking for.
You can filter for a specific IP address, protocol, or port number.
Let's examine a simple tcpdump command used to capture packets.
Keep in mind that your computer's traffic may appear different when you use this command.
At first glance, this looks like a lot of information.
Let's examine it line by line.
The command we ran is:
sudo tcpdump -i any -v -c 1.
We're using sudo because the Linux account we're logged in on doesn't have the permission to run tcpdump.
Then, we specify tcpdump to start tcpdump and -i to specify which interface we want to sniff traffic on.
The -v stands for verbose, which displays detailed packet information.
The -c stands for count, which specifies how many packets tcpdump will capture.
Here we've specified one.
Now let's examine the output.
Tcpdump has told us that it's listening on any available network interfaces, and it's also given us additional information, like the capture size.
The first field is the packet's timestamp, which details the specific time of the packet travel.
It begins with hours, minutes, seconds, and fractions of a second.
Timestamps are especially helpful during an incident investigation when you want to determine timelines and correlate traffic.
Next, IP is listed as the Version field.
It's listed as IP, which means it's IPv4.
The verbose option has given us more details about the IP packet fields, such as protocol type and the length of the packet. Let's check it out.
The first field, ToS stands for Type of Service.
Recall that this tells us if certain packets should be treated with different care.
This is represented by a value in hexadecimal.
The TTL field is Time to Live, which tells us how long a packet can travel across a network before it gets dropped.
The next three fields are Identification, Offset, and Flags, which provide three fields with information relating to fragmentation.
These fields provide instructions on how to reassemble packets in the correct order.
For example the DF, beside flags stands for Don't Fragment.
Next, the proto is the Protocol field.
It specifies the protocol in use and also provides us with the value that corresponds to the protocol.
Here the protocol is tcp, which is represented by the number 6.
The last field, length, is the Total Length of the packet, including the IP header.
Next, we can observe the IP addresses that are communicating with each other.
The direction of the arrow indicates the direction of the traffic flow.
The last piece of the IP address indicates the port number or name.
Next, the cksum or checksum field corresponds to the Header Checksum, which stores a value that's used to determine if
any errors have occurred in the header.
Here, it's telling us it's correct with no errors.
The remaining fields are related to TCP.
For example, Flags indicate TCP flags.
The P is the push flag, and the period indicates it's an ACK flag.
This means that the packet is pushing out data.
This is just one of many commands you can use in tcpdump to capture network traffic.
Isn't it fascinating to observe all the information contained within these invisible packets?
Go ahead and try it out for yourself!
No Comments