Tcpdump - Revision history

Christoph: /* Filters */

2015-06-19T16:48:48Z

‎Filters

Christoph: /* Miscellaneous */

2015-06-12T21:31:30Z

‎Miscellaneous

Christoph: /* Miscellaneous */

2015-06-12T21:29:17Z

‎Miscellaneous

Christoph: /* Miscellaneous */

2015-06-11T17:31:09Z

‎Miscellaneous

Christoph: /* See also */

2015-06-11T16:08:58Z

‎See also

Christoph: /* Miscellaneous */

2015-03-10T23:39:15Z

‎Miscellaneous

Christoph at 00:15, 8 March 2015

2015-03-08T00:15:05Z

Christoph: /* External links */

2014-01-21T12:33:18Z

‎External links

Christoph: /* Example usage */

2014-01-04T02:04:22Z

‎Example usage

Christoph: New page: '''`tcpdump`''' is a common packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received ...

2014-01-03T20:27:42Z

New page: '''<code>tcpdump</code>''' is a common packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received ...

New page

'''<code>tcpdump</code>''' is a common packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached.

==Example usage==
''Note: In most of the following examples, I have replaced actual IP addresses with 192.x.x.x (or something similar) and domain names with example.com (or something similar). Otherwise, my example local hostname is "stine" and my example local IPv4 address is "192.168.0.14". Also, some of the output has been removed or modified for illustration purposes.''

* Capture packets from a particular Ethernet interface
$ tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:40:54.940904 IP stine.local.15342 > example.com.domain: 46527+ PTR? 14.0.168.192.in-addr.arpa. (42)
13:40:54.940918 IP stine.local.15342 > example.com.domain: 46527+ PTR? 14.0.168.192.in-addr.arpa. (42)
13:40:54.963406 IP example.com.domain > stine.local.15342: 46527 NXDomain* 0/1/0 (119)
13:40:54.964613 IP example.com.domain > stine.local.15342: 46527 NXDomain* 0/1/0 (119)
13:40:54.964656 IP stine.local > example.com: ICMP stine.local udp port 15342 unreachable, length 15
...
9 packets captured
32 packets received by filter
0 packets dropped by kernel

Note: When you execute <code>`tcpdump`</code> without any option, it will capture all the packets flowing through ''all'' the interfaces. The "<code>-i</code>" option, allows one to filter on a given Ethernet interface.

* Capture only N number of packets on the <code>eth0</code> interface:
$ tcpdump -c 2 -i eth0
14:05:49.749471 IP6 fe80::21a:d6ff:fe2b:4641 > ip6-allnodes: ICMP6, router advertisement, length 56
14:05:49.711275 IP stine.local.62198 > example.com.domain: 38572+ PTR? 1.4.6.4.2.6.e....0.8.e.f.ip6.arpa. (90)

* Display captured packets in ASCII:
$ tcpdump -A -i eth0

* Display captured packets in HEX and ASCII:
$ tcpdump -XX -i eth0

* Capture the packets and write output to a binary file (useful for later analysis in, for example, [[wireshark]]):
$ tcpdump -w tcpdump-20140103.pcap -i eth0

* Read the packets from a previously saved file (e.g., from the previous command):
$ tcpdump -tttt -r tcpdump-20140103.pcap

* Capture packets with their actual IP addresses (instead of the default rDNS lookup):
$ tcpdump -n -i eth0

* Capture packets with a full timestamp:
$ tcpdump -tttt -n -i eth0
2014-01-03 14:19:16.882379 IP6 fe80::21a:d6ff:fe2b:4641 > ff02::1: ICMP6, router advertisement, length 56
2014-01-03 14:19:19.882169 IP6 fe80::21a:d6ff:fe2b:4641 > ff02::1: ICMP6, router advertisement, length 56

* Capture packets with greater than N bytes:
$ tcpdump -i eth0 greater 1024

* Capture packets with less than N bytes:
$ tcpdump -i eth0 less 1024

* Capture only the packets of a specific protocol type (e.g., ip, ip6, arp, rarp, decnet, tcp, udp, fddi, tr, wlan, etc.):
$ tcpdump -i eth0 arp

* Capture packets flows on a particular port:
$ tcpdump -i eth0 port 22

* Capture packets for particular destination IP and port
$ tcpdump -i eth0 dst 192.x.x.x and port 22

* Capture all packets, but filter out given protocals (e.g, "arp" and "rarp"):
$ tcpdump -i eth0 not arp and not rarp
Note: You can pass combinations of "and", "or", and "not" conditions.

===Examples derived from the <code>tcpdump</code> [http://www.tcpdump.org/manpages/tcpdump.1.html man page]===

* Print all packets arriving at or departing from <code>sundown</code>:
$ tcpdump host sundown

* Print traffic between <code>helios</code> and either <code>hot</code> or <code>ace</code>:
$ tcpdump host helios and $ hot or ace $

* Print all IP packets between <code>ace</code> and any host except <code>helios</code>:
$ tcpdump ip host ace and not helios

* Print all traffic between local hosts and hosts at Berkeley:
$ tcpdump net ucb-ether

* Print all FTP traffic through Internet gateway <code>snup</code> (note that the expression is quoted to prevent the shell from (mis-)interpreting the parentheses):
$ tcpdump 'gateway snup and (port ftp or ftp-data)'

* Print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net):
$ tcpdump ip and not net localnet

* Print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host:
$ tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

* Print all IPv4 HTTP packets to and from port 80 (i.e., print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets; IPv6 is left as an exercise for the reader):
$ tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

* Print IP packets longer than 576 bytes sent through gateway <code>snup</code>:
$ tcpdump 'gateway snup and ip[2:2] > 576'

* Print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
$ tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'

* Print all ICMP packets that are not echo requests/replies (i.e., not <code>`ping`</code> packets):
$ tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'

==See also==
* <code>[[ethtool]]</code>

==External links==
* [http://www.tcpdump.org/ Official website]

[[Category:Linux Command Line Tools]]

@@ Line 100: / Line 100: @@
 ===Filters===
 Note the following mnemonics:
 * The [[:wikipedia:OSI model|OSI Model]]: '''A'''ll '''P'''eople '''S'''eem '''T'''o '''N'''eed '''D'''ata '''P'''rocessing
@@ Line 118: / Line 153: @@
   $ tcpdump 'tcp[13] & 2 != 0'
-Read the <code>SYN</code> capture <code>`tcpdump 'tcp[13] & 2 != 0'`</code> as: Find the '''13'''th byte in the TCP header and only grab packets where the flag in the '''2'''nd bit is not zero. The "2" is found by reading from right to left in the "<code>UAPRSF</code>" string above (i.e., <code>SYN = S = 2). So that command only captures <code>SYN</code> packets.
+Read the <code>SYN</code> capture <code>`tcpdump 'tcp[13] & 2 != 0'`</code> as: Find the '''13'''th byte in the TCP header and only grab packets where the flag in the '''2'''nd bit is not zero. The "2" is found by reading from right to left in the "<code>UAPRSF</code>" string above (i.e., <code>SYN = S = 2</code>). So that command only captures <code>SYN</code> packets.
 * Filter/capture by various "U A P R S F" packets (i.e., TCP packets with the XXX flag set):

@@ Line 99: / Line 99: @@
   $ tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
-===Miscellaneous===
+===Filters===
 Note the following mnemonics:
 * The [[:wikipedia:OSI model|OSI Model]]: '''A'''ll '''P'''eople '''S'''eem '''T'''o '''N'''eed '''D'''ata '''P'''rocessing

@@ Line 120: / Line 120: @@
 Read the <code>SYN</code> capture <code>`tcpdump 'tcp[13] & 2 != 0'`</code> as: Find the '''13'''th byte in the TCP header and only grab packets where the flag in the '''2'''nd bit is not zero. The "2" is found by reading from right to left in the "<code>UAPRSF</code>" string above (i.e., <code>SYN = S = 2). So that command only captures <code>SYN</code> packets.
-* Capture various "U A P R S F" packets:
+* Filter/capture by various "U A P R S F" packets (i.e., TCP packets with the XXX flag set):
-  $ tcpdump 'tcp[13] & 32!=0' # Capture all URG (URGENT) packets
+  $ tcpdump 'tcp[13] & 32!=0' # OR: 'tcp[13] & 32 == 32' # Capture all URG (URGENT) packets
-  $ tcpdump 'tcp[13] & 16!=0' # Capture all ACK (ACKNOWLEDGE) packets
+  $ tcpdump 'tcp[13] & 16!=0' # OR: 'tcp[13] & 16 == 16' # Capture all ACK (ACKNOWLEDGE) packets
-  $ tcpdump 'tcp[13] & 8!=0'  # Capture all PSH (PUSH) packets
+  $ tcpdump 'tcp[13] & 8!=0'  # OR: 'tcp[13] & 8 == 8'   # Capture all PSH (PUSH) packets
-  $ tcpdump 'tcp[13] & 4!=0'  # Capture all RST (RESET) packets
+  $ tcpdump 'tcp[13] & 4!=0'  # OR: 'tcp[13] & 4 == 4'   # Capture all RST (RESET) packets
-  $ tcpdump 'tcp[13] & 2!=0'  # Capture all SYN (SYNCHRONIZE) packets
+  $ tcpdump 'tcp[13] & 2!=0'  # OR: 'tcp[13] & 2 == 2'   # Capture all SYN (SYNCHRONIZE) packets
-  $ tcpdump 'tcp[13] & 1!=0'  # Capture all FIN (FINISH) packets
+  $ tcpdump 'tcp[13] & 1!=0'  # OR: 'tcp[13] & 1 == 1'   # Capture all FIN (FINISH) packets
-  $ tcpdump 'tcp[13]=18'      # Capture all SYNACK (SYNCHRONIZE/ACKNOWLEDGE) packets
+  $ tcpdump 'tcp[13]=18'      # OR: 'tcp[13] == 18'      # Capture all SYNACK (SYNCHRONIZE/ACKNOWLEDGE) packets
 * Find all packets with both the RST and SYN flags set (R+S = 4+2 = 6):

@@ Line 134: / Line 134: @@
 * Capture TCP Flags:
   $ tcpdump 'tcp[tcpflags] & tcp-syn != 0'
 ==See also==

@@ Line 120: / Line 120: @@
 Read the <code>SYN</code> capture <code>`tcpdump 'tcp[13] & 2 != 0'`</code> as: Find the '''13'''th byte in the TCP header and only grab packets where the flag in the '''2'''nd bit is not zero. The "2" is found by reading from right to left in the "<code>UAPRSF</code>" string above (i.e., <code>SYN = S = 2). So that command only captures <code>SYN</code> packets.
-* Find all RST packets
+* Capture various "U A P R S F" packets:
-  $ tcpdump 'tcp[13] & 4 != 0'
+ $ tcpdump 'tcp[13] & 32!=0' # Capture all URG (URGENT) packets
+  $ tcpdump 'tcp[13] & 16!=0' # Capture all ACK (ACKNOWLEDGE) packets
-* Find all ACK packets
+ $ tcpdump 'tcp[13] & 8!=0'  # Capture all PSH (PUSH) packets
-  $ tcpdump 'tcp[13] & 16 != 0'
+ $ tcpdump 'tcp[13] & 4!=0'  # Capture all RST (RESET) packets
 * Find all packets with both the RST and SYN flags set (R+S = 4+2 = 6):
   $ tcpdump 'tcp[13] = 6'
 * Capture TCP Flags:

@@ Line 137: / Line 137: @@
 ==See also==
 * <code>[[ethtool]]</code>
 ==External links==

@@ Line 98: / Line 98: @@
 * Print all ICMP packets that are not echo requests/replies (i.e., not <code>`ping`</code> packets):
   $ tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
 ==See also==
@@ Line 105: / Line 141: @@
 * [http://www.tcpdump.org/ Official website]
 * [http://www.danielmiessler.com/study/tcpdump/ A good intro/primer to tcpdump]
 [[Category:Linux Command Line Tools]]

@@ Line 54: / Line 54: @@
   $ tcpdump -i eth0 arp
-* Capture packets flows on a particular port:
+* Capture packet flows on a particular port:
   $ tcpdump -i eth0 port 22

Tcpdump - Revision history

Christoph: /* Filters */

Christoph: /* Miscellaneous */

Christoph: /* Miscellaneous */

Christoph: /* Miscellaneous */

Christoph: /* See also */

Christoph: /* Miscellaneous */

Christoph at 00:15, 8 March 2015

Christoph: /* External links */

Christoph: /* Example usage */

Christoph: New page: '''tcpdump''' is a common packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received ...

Christoph: New page: '''`tcpdump`''' is a common packet analyzer that runs under the command line. It allows the user to intercept and display TCP/IP and other packets being transmitted or received ...