Introduction to TCPDUMP

Twitter: @davidmahler
LinkedIn: / davidmahler
Links:
reference: www.tcpdump.org
reference: tcpdump man page!
tcpdump options used in this video:
Version check: -h
List interfaces: -D
Capture on eth0: -i eth0
Stop at 500 (or any #) of packets: -c500
No name resolution: -n
Change capture size (ex 96 Bytes): -s96
Max capture size: -s0
save to file capture.pcap: -w capture.pcap -v
Read from a capture file: -r capture.pcap
Filters:
IP: host (ip addr)
Source IP: src host (ip addr)
Dest. IP: dst host (ip addr)
port: port 80
MAC address: ether host (mac address)
protocol filters: tcp, udp, icmp, arp, rarp, ip6, (others)
SYN flag: "tcp[tcpflags] & tcp-syn != 0"
RST flag: "tcp[tcpflags] & tcp-rst != 0"
Output options:
View MAC info: -e
Include hex and ASCII: -XX
ASCII only: -A
max verbosity: -vvv
ignore checksum errors: -K
quiet: -q
timestamp options: -t, -tt, -ttt, etc...

[@eyalpery8470]

Never paused a video so many times, the longest 18 minutes of my life and it was totally worth it ! Very informative video!

[@DavidMahler]

Sorry? Or Thanks? Not sure :-). Thanks for the comment!

[@atypowy13]

The best explanation in the world ! Respect from 2021

[@ManojKumar-rg8ez]

Hi David, Your whole series of videos are so great, and you are able to make other understand in much better way than any other person or sources on internet. These are by far the best videos on internet.

[@DavidMahler]

Thank you Manoj! I'm happy you like them!!!

[@BryanChance]

I find Mr. Mahler's videos to be extrememly affective. Thank you sir!

[@DavidMahler]

Glad to hear that!

[@fahimuel]

Excellent Content - To the point and comprehensive. Salute to you David for the great work.

[@DavidMahler]

Thanks a lot, Fahimuel!

[@tpaullee330]

Watched it twice and pause-n-take notes many times second time around. It is a great investment as tcpdump is the only tool left for me to debug mysterious networking problems including "connection refused" and so on. Thank you!

[@DavidMahler]

Glad it was helpful!

[@renzochepar]

One of the best tutorial I've seen ever Very comprehensive in just 18 minutes.

[@DavidMahler]

Thanks!

[@derekplante7062]

Fantastic work, a clear and concise understanding of TCP Dump basics. Appreciate the video.

[@DavidMahler]

yw!

[@cesar.vasconcelos]

David, thank you so much for uploading these videos. They are specially useful for SDN novices. Again, thanks for sharing.

[@mathewkargarzadeh3158]

David, the best illustration on TCPDUM I have ever seen. I would compare it like someone getting an orange and and juicing it and giving it to his viewers. I loved it . You must be a very nice person to spend your own personal time and sharing your know how with others.. Kudos to you !!!. Thank you !!

[@DavidMahler]

LOL, that is awesome, thanks for the feedback! I do just like to contribute to the community!

[@jeetespey12]

Superb way to demonstrate use of TCPDUMP, I would like to recommend this video to anyone who wants to understand use of TCPDUMP. Many thanks [.]

[@DavidMahler]

+jeetespey12 You're welcome!

[@antdetan3252]

Very clear explanation about tcpdump. I learnt quite a lot from this video. Thanks David.

[@DavidMahler]

Awesome, thanks, Antde!

[@aroundyou7540]

Never seen a video with this small size and having so much info thank you please keep posting such type of vedios

[@DavidMahler]

Thanks!

[@georgesmith9178]

Thank you for this excellent, brief and to-the-point video with super relevant, supporting examples.

[@DavidMahler]

You're very welcome!

[@rodrigaodragao]

Congratulations. The best class about tcpdump ever. Thank so much, help me a lot. You won one more subscriber.

[@DavidMahler]

Nice, thanks!

[@edoloza1]

Excellent job David... well worth the time to go through this...

[@DavidMahler]

Thanks!!

[@chris0234]

useful as the OSCP exam doesn't have a video on tcpdump and this clarifies a lot and teaches a lot of useful tricks.

[@DavidMahler]

Oh nice!

[@ihsanshah4862]

one of the best tutorials on SDN related stuff

[@DavidMahler]

Thanks so much!!

[@reggie9550]

Very well explained - I am going to see if you have more trainings available

[@DavidMahler]

Thanks Reggie!

[@stanleylevy477]

Good overview. Thank you. Will likely review this again.

[@DavidMahler]

Great, thanks! I review them myself too when I forget ;-)

[@fudgetone]

If only all tutorials on KZbin were this good!

[@DavidMahler]

That's kind, thanks for that.

[@LGU-ih5pr]

Your videos about networking topics are amazing. Do come back and make more videos.

[@DavidMahler]

Thank you, I will when I can!

[@toomajkarimi1131]

Clear and thorough explanation. Thanks

[@DavidMahler]

You're welcome!

[@RohitVerma-eb9ms]

Great Video David. Really Appreciate your all efforts

[@DavidMahler]

Thanks Rohit!

[@cecilyhewlett670]

Great video - especially the interpretation of the output. Thanks.

[@DavidMahler]

Very welcome!

[@manishayeshwanth]

Excellent video. Very clear and concise explanation.

[@DavidMahler]

Thanks a lot!

[@infraday5023]

I wonder if it's possible to automate monitoring vs malicious traffic on machine with gui

[@jasontle]

Another great Video from David. Thanks!

[@DavidMahler]

Thanks Cal Cool!!

[@rommelechauri3901]

Awesome video! Thank you for the excellent tutorial.

[@DavidMahler]

You're welcome!

[@brackie1]

Thanks David...hits the spot...very good!!

[@DavidMahler]

yw!

[@chriswansli755]

Great explanation. Good sequencing and very clear.

[@DavidMahler]

+Chris Wansli Thanks!

[@tedschafer339]

Wow. Going to have to watch that one more than a few times. A lot of info. Done very well and not too verbose.

[@DavidMahler]

Cool, thanks!

[@ala2ela373]

Very detailed explanation thankyou. Please make more videos

[@DavidMahler]

Thanks!

[@jb121993]

What a great explanation! I'm subscribing in order to learn more. Thanks.

[@DavidMahler]

+jb121993 Thanks!

[@amarpreetsingh3878]

Tcp Dump 1. Version check: - tcpdump -h 2. To check available interfaces on VM: - tcpdump -D 3. Checking tcpdump on all interfaces: - tcpdump -i any 4. Stop tcpdump after a specified number of packets: - tcpdump -i any -c 5 (This one stops the capture after generating 5 packets ) 5. Show tcpdump in form of IPs and not FODN names: - tcpdump -i any -c 5 -n (Using -n will show IP and port numbers. If not used then the utility will tigger reverse DNS lookups to determine IP) 6. To limit capture size use -s option: - tcpdump -i any -c 5 -n -s1024 7. To check with proper sequence number use this: - tcpdump -i any -c20 -n tcp and dst port 39952 -t 8. Save captures to a file: - tcpdump -i any -w capture.pcap 9. Use -v option while performing captures to a file to see wether filter is receiving any packets or not: - tcpdump -i any -w capture.pcap -v 10. Reading existing files: - tcpdump -n -r capture.pcap 11. Use pipe (|) and less while viewing pcap files so that you can scroll through them: - tcpdump -n -r capture.pcap | less 12. To check packets from one particular host only: - tcpdump -i eth1 -n host 10.0.0.4 -c10 13. To check packets from one particular host from one side either source or destination only: - tcpdump -i eth1 -n host src 10.0.0.4 -c10 - tcpdump -i eth1 -n host dst 10.0.0.4 -c10 14. Use “and port ” to filter traffic for that port only: - tcpdump -i eth1 -n host 10.0.0.4 and port 80 -c10 15. Between two host: - tcpdump -i eth1 -n host 10.0.0.4 and host 192.168.0.4 -c10 16. For composite types i.e. using “and-or”: - tcpdump -i eth0 -n “host 192.168.0.4 \ > and (port 80 or port443)” Use (“”) in such commands 17. Based on whole network: - tcpdump -i eth0 -n -c 50 “src net 192.168.00/16 \ > and not dst net 192.168.0.0/16 and not dst net 10.0.0.0/16” 18. Based on mac address: - tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c50 Here “ether host is used to refer mac addr” 19. Mac addr are not visible by default so we use “-e” to see mac addr: - tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c50 -e 20. To tcpdump ipV6 IPs use ip6 a th end - tcpdump -i any ip6 21. Capture based on flags: - tcpdump -i any “tcp[tcpflags] \ > & tcp-syn !=0” Or > &tcp-rst !=0” Adjusting seeing tcpdump outputs- 22. -XX option shows more details specifically in hex and ascii format - tcpdump -i eth0 port 80 -c50 -XX 23. In place of using -XX we can use -A to get only te ASCII value and not the hex value: - tcpdump -i eth0 port 80 -c50 -A 24. Increasing levels of details can we fetched from -v or -vv or -vvv: - tcpdump -i eth0 port 80 -c50 -vvv 25. To see minimal quiet display ouput use -q: - tcpdump -i eth0 port 80 -c50 -q Example: Time ip vm1.port > vm3.ssh: tcp0 Time ip vm3.ssh > vm1.port: tcp0 . . . 26. To remove time frame in any tcpdumps use “-t” - tcpdump -i eth0 port80 -c50 -q -t ip vm1.port > vm3.ssh: tcp0 ip vm3.ssh > vm1.port: tcp0 . . 27. Use 3 “-ttt” to check time difference between consecutive packets in the ouTput. This can be used to check spikes or latencies In packets: - tcpdump -i eth0 -c50 -q -ttt 28. Use 5 “-ttttt” shows the time since the first packet capture. Used to lookup how long does the certain transactions took to complete. - tcpdump -i eth0 -c50 -q -ttttt 29. For human readable format use “-tttt” - tcpdump -i eth0 -c50 -q -tttt # Traffic direction (*) Relation to Firewall Virtual Machine Name of inspection point Notion of inspection point 1 Inbound Before the inbound FW VM Pre-Inbound “i” 2 Inbound After the inbound FW VM Post-Inbound “I” 3 Outbound Before the outbound FW VM Pre-Outbound “o” 4 Outbound After the outbound FW VM Post-Outbound “O BR Amarpreet Singh

[@8080VB]

what is net in tcpdump ?

[@amarpreetsingh3878]

@@8080VB network - “net”

[@8080VB]

@@amarpreetsingh3878 how to find mine , is that submask?

[@amarpreetsingh3878]

@@8080VB yes. The subnet for which u want to take dump. It could be ur port ip as well from where the traffic is going in and out or both

[@8080VB]

@@amarpreetsingh3878 ok ok how to find mine? look for eg my ip is 192.168.0.888 in this which is ?

[@ibnomer342]

a Clear and concise review. Thanks!

[@DavidMahler]

You're very welcome!

[@cadyjeanney.669]

Amazing video. Thank you so much David.

[@DavidMahler]

You're welcome Cady, thanks for commenting!

[@fdghjvgf]

Superb! Highly helpful and handy

[@DavidMahler]

Great, thanks!!

[@sukumarbhatnagar6630]

Great video David! The videos is very helpful. Thanks!

[@DavidMahler]

Sukumar Bhatnagar You're welcome!

[@harishm7331]

good explanations. Need some more videos which shows troubleshooting using commands.

[@DavidMahler]

+Harish M Thanks!

[@megapode2648]

Thanks you, been looking for a good linux tcpdump video

[@DavidMahler]

Cool, glad you found this one!

[@pwn0x80]

Thank you sir .. we need more vid pls keep uploading

[@DavidMahler]

Thanks!

[@indrajitdj]

Very detailed and informative video

[@DavidMahler]

Thanks for watching Indrajeet!

[@origill1098]

An excellent video tutorial. ThanQ very much.

[@DavidMahler]

+Ori Gill You're welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@peshalnayak]

This is an excellent tutorial! I do have a question regarding the time stamps in the output. Do these time stamps denote the time when the packet transmission is complete, has started or when the packet was queued for transmission? Exactly when are these packet details picked up? Thanks a lot again.

[@DavidMahler]

Hi Peshal - I don't know the answer to this, but questions like this highlight gaps in my knowledge, so thanks! I'll be learning more about it in relationship to linux queuing etc.

[@laseru]

I really appreciate your video!

[@DavidMahler]

Thanks for commenting!

[@massimilianoausili6666]

Fenomenal!

[@DavidMahler]

Thank you Massimilano!

[@TheZax85]

Very nice - Thank you for this video!

[@DavidMahler]

You're welcome, thanks for commenting Morten!

[@rineeshnallatath7421]

Very good video. Thank you very much.

[@DavidMahler]

Rineesh Nallatath You're welcome, thanks for commenting!

[@sam.kendrick]

Thank you for your work and knowledge!

[@DavidMahler]

You're welcome Sam!

[@updateswithpree5693]

very informative video . clearly explained !!

[@DavidMahler]

Thanks Preeti!

[@tusharpatil-wi7gb]

Thank you for sharing very informative 👍

[@DavidMahler]

yw!

[@JeanLucLacroix]

Great video. Very informative. Thanks.

[@DavidMahler]

+Jean-Luc Lacroix You're welcome!

[@ashrayr6193]

Thank you. Great video for beginners.

[@DavidMahler]

Great, thanks for the comment!

[@vicronychen]

Very well explained. Thank you!

[@DavidMahler]

You're welcome! Thanks!

[@InocenteSandoval]

Many thanks for the informative video!

[@DavidMahler]

Inocente Sandoval You're very welcome!

[@sibinkuttan]

Hi David , Nicely explained... :)

[@DavidMahler]

+sibin k Thank you sir!

[@allen8299]

that was a great video, man. nice job

[@DavidMahler]

Thanks man!

[@cepesh1979]

Perfect explanation, thanks.

[@DavidMahler]

You're welcome, thanks!

[@taoakinbo7480]

Nice one! Thanks for uploading.

[@DavidMahler]

+Tao Akinbo You are very welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@ahrhoades]

This is a well done tutorial.

[@DavidMahler]

+Andrew Rhoades Thanks!

[@sayantanmukherjeemukherjee8805]

Your Video helped me out a few hours back...Inspite of having Telnet and TCP connectivity I was unable to connect with a Ora NoSQL Node from my VH. The tcpdump -i eth0 -w ora.pcap showed its trying to connect with Default ports in Orcale intalled VM so was able to define servicerange ports and can connect it now.. Got the result from your clip specifically.. Although I used Wireshark to analyze the pcap file as was not aware of the reading option from the Linux option itself. So If I use the commnd (from root access) in the VM > tcpdump -r ora.pcap it should serve the purpose I hope.

[@DavidMahler]

Thats great neal. Thanks for sharing the details on how this video was of use to you! !

[@vanax89]

Very helpful! Good job man ;)

[@DavidMahler]

+Fabio D'Onofrio Thanks!

[@narendrasinghnegi6631]

very informative video. Thanks

[@DavidMahler]

You're welcome!

[@srinivaspithani7645]

Great content , thanks

[@DavidMahler]

My pleasure!

[@khawarabbasi5006]

David, if my machine has many interfaces and i don't know by which interface i will capture traffic. i need to use "-i any" to see if my machine is getting any traffic or not. If my machine is getting traffic then how would i know the exact interface??

[@DavidMahler]

I find that tricky too. Personally, I use the "-e" option which should show destination MAC address of packets, then "ip link" or the equivalent to see which interface on the target system owns that MAC address. This doesn't work with broadcasts though.

[@pathikvsharma]

That was a great video. Thanks!

[@DavidMahler]

You're welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@RajivVermaNZ]

Thanks David, It was excellent tutorial. Is there a way to us -i any option at HP-UX or I can use "-i lan0 -i lan1"?

[@DavidMahler]

Hey - sorry I'm not familiar with the issue you have, sorry!

[@rahulshah-ml4ob]

Excellent job

[@DavidMahler]

Thank you!

[@varigondaphanibhargav3990]

Pls share all tcpdump commands...it could be helpful for us if you have an document.

[@ercancataltepe17]

Thanks David!

[@DavidMahler]

ercan cataltepe YW

[@arvindgupta8991]

So useful.

[@DavidMahler]

Glad you think so!

[@jczhang5247]

It's helpful!Thanks.

[@DavidMahler]

You're welcome Jason!

[@madukonnamdi3022]

Fantastic video Thanks alot

[@DavidMahler]

You're quite welcome!

[@adityajain1989]

This is best video

[@DavidMahler]

Thanks!

[@mayrinvarkey9134]

hello sir, Is tcpdump analysis or capture purpose tool only or Could tcpdump be used for generation of packets to a specific dst ip address from a source machine just like an attack.

[@DavidMahler]

Capturing tool, thanks for the comment.

[@karanjadriver5472]

Excellent!!!!

[@DavidMahler]

TY!

[@bharatishpuranik2164]

Nice, super easy!

[@DavidMahler]

Thanks!

[@tommyc9720]

Is TCPDUMP an active or passive network sniffer?

[@nagamallareddyk8390]

thank you so much

[@DavidMahler]

You're welcome!

[@SK-ju8si]

thank you

[@DavidMahler]

yw!

[@ATR-ur5ov]

Thanks a lot!

[@DavidMahler]

yw!

[@mandirdarshanarti]

easy short amazing

[@DavidMahler]

Thanks for the comment!

[@husseinoda1672]

very nice

[@DavidMahler]

+hussein oda Thanks!

[@allenhuai6153]

perfect! thanks

[@DavidMahler]

No, thank you ! ;-)

[@jopaki]

Ty!

[@DavidMahler]

yw!!

[@tango2olo]

Plz make more videos on networking.. thanks..

[@DavidMahler]

Hi Tango - thanks for that. I wish I had more time in the day, I certainly would. I do hope to get back to some networking topics eventually.

[@allanng78]

Hi, Do u have anything able tcprewrite and tcpreplay?

[@DavidMahler]

Allan NG Hi Allan, no I don't but thanks for the idea :-)

[@rohanmhatre2980]

Nice...Thank You... :D

[@DavidMahler]

You're welcome!

[@engineersworkshop6936]

11:11 host keyword 14:59 protocol type filters

[@IshanJain]

sudo is not necessary. All tcp dump needs is CAP_NET_RAW. Run sudo setcap cap_net_raw=eip /usr/bin/tcpdump to set net_raw capability for tcpdump binary and then you can run it without root permissions.

[@DavidMahler]

Thanks!

[@jovictor3007]

what was the point of this video ? was it to show off or to teach ? you go through it very fast barely explaining anything as if you are reading a script , I watched other videos that are on a slower pace where they take time to explain things then I understood tcpdump.

[@DavidMahler]

I'm glad you found videos that worked for you!

[@pwn0x80]

Thank you sir .. we need more vid pls keep uploading

[@DavidMahler]

I know, thanks!

[@johnsonsmith3976]

I won’t stop testifying for *mikeskyler* on telegram, I’m always happy to deal with him

[@zhiyizhu3040]

Thank you for your clear explanation!

[@DavidMahler]

yw!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@ashwinshakya]

Very well explained. Thank you!

[@DavidMahler]

You're welcome! Thanks for supporting the video!

[@zezoahmed4729]

Great video, thanks!

[@DavidMahler]

Tthanks!