Introduction to TCPDUMP

[@eyalpery8470]

Never paused a video so many times, the longest 18 minutes of my life and it was totally worth it ! Very informative video!

[@DavidMahler]

Sorry? Or Thanks? Not sure :-). Thanks for the comment!

[@atypowy13]

The best explanation in the world ! Respect from 2021

[@Master_Blaster-x]

10 years ago and still one of the best intro in tcpdump.

[@ManojKumar-rg8ez]

Hi David, Your whole series of videos are so great, and you are able to make other understand in much better way than any other person or sources on internet. These are by far the best videos on internet.

[@DavidMahler]

Thank you Manoj! I'm happy you like them!!!

[@BryanChance]

I find Mr. Mahler's videos to be extrememly affective. Thank you sir!

[@DavidMahler]

Glad to hear that!

[@tpaullee330]

Watched it twice and pause-n-take notes many times second time around. It is a great investment as tcpdump is the only tool left for me to debug mysterious networking problems including "connection refused" and so on. Thank you!

[@DavidMahler]

Glad it was helpful!

[@mathewkargarzadeh3158]

David, the best illustration on TCPDUM I have ever seen. I would compare it like someone getting an orange and and juicing it and giving it to his viewers. I loved it . You must be a very nice person to spend your own personal time and sharing your know how with others.. Kudos to you !!!. Thank you !!

[@DavidMahler]

LOL, that is awesome, thanks for the feedback! I do just like to contribute to the community!

[@fahimuel]

Excellent Content - To the point and comprehensive. Salute to you David for the great work.

[@DavidMahler]

Thanks a lot, Fahimuel!

[@derekplante7062]

Fantastic work, a clear and concise understanding of TCP Dump basics. Appreciate the video.

[@DavidMahler]

yw!

[@jeetespey12]

Superb way to demonstrate use of TCPDUMP, I would like to recommend this video to anyone who wants to understand use of TCPDUMP. Many thanks [.]

[@DavidMahler]

+jeetespey12 You're welcome!

[@renzochepar]

One of the best tutorial I've seen ever Very comprehensive in just 18 minutes.

[@DavidMahler]

Thanks!

[@amarpreetsingh3878]

Tcp Dump 1. Version check: - tcpdump -h 2. To check available interfaces on VM: - tcpdump -D 3. Checking tcpdump on all interfaces: - tcpdump -i any 4. Stop tcpdump after a specified number of packets: - tcpdump -i any -c 5 (This one stops the capture after generating 5 packets ) 5. Show tcpdump in form of IPs and not FODN names: - tcpdump -i any -c 5 -n (Using -n will show IP and port numbers. If not used then the utility will tigger reverse DNS lookups to determine IP) 6. To limit capture size use -s option: - tcpdump -i any -c 5 -n -s1024 7. To check with proper sequence number use this: - tcpdump -i any -c20 -n tcp and dst port 39952 -t 8. Save captures to a file: - tcpdump -i any -w capture.pcap 9. Use -v option while performing captures to a file to see wether filter is receiving any packets or not: - tcpdump -i any -w capture.pcap -v 10. Reading existing files: - tcpdump -n -r capture.pcap 11. Use pipe (|) and less while viewing pcap files so that you can scroll through them: - tcpdump -n -r capture.pcap | less 12. To check packets from one particular host only: - tcpdump -i eth1 -n host 10.0.0.4 -c10 13. To check packets from one particular host from one side either source or destination only: - tcpdump -i eth1 -n host src 10.0.0.4 -c10 - tcpdump -i eth1 -n host dst 10.0.0.4 -c10 14. Use “and port ” to filter traffic for that port only: - tcpdump -i eth1 -n host 10.0.0.4 and port 80 -c10 15. Between two host: - tcpdump -i eth1 -n host 10.0.0.4 and host 192.168.0.4 -c10 16. For composite types i.e. using “and-or”: - tcpdump -i eth0 -n “host 192.168.0.4 \ > and (port 80 or port443)” Use (“”) in such commands 17. Based on whole network: - tcpdump -i eth0 -n -c 50 “src net 192.168.00/16 \ > and not dst net 192.168.0.0/16 and not dst net 10.0.0.0/16” 18. Based on mac address: - tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c50 Here “ether host is used to refer mac addr” 19. Mac addr are not visible by default so we use “-e” to see mac addr: - tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c50 -e 20. To tcpdump ipV6 IPs use ip6 a th end - tcpdump -i any ip6 21. Capture based on flags: - tcpdump -i any “tcp[tcpflags] \ > & tcp-syn !=0” Or > &tcp-rst !=0” Adjusting seeing tcpdump outputs- 22. -XX option shows more details specifically in hex and ascii format - tcpdump -i eth0 port 80 -c50 -XX 23. In place of using -XX we can use -A to get only te ASCII value and not the hex value: - tcpdump -i eth0 port 80 -c50 -A 24. Increasing levels of details can we fetched from -v or -vv or -vvv: - tcpdump -i eth0 port 80 -c50 -vvv 25. To see minimal quiet display ouput use -q: - tcpdump -i eth0 port 80 -c50 -q Example: Time ip vm1.port > vm3.ssh: tcp0 Time ip vm3.ssh > vm1.port: tcp0 . . . 26. To remove time frame in any tcpdumps use “-t” - tcpdump -i eth0 port80 -c50 -q -t ip vm1.port > vm3.ssh: tcp0 ip vm3.ssh > vm1.port: tcp0 . . 27. Use 3 “-ttt” to check time difference between consecutive packets in the ouTput. This can be used to check spikes or latencies In packets: - tcpdump -i eth0 -c50 -q -ttt 28. Use 5 “-ttttt” shows the time since the first packet capture. Used to lookup how long does the certain transactions took to complete. - tcpdump -i eth0 -c50 -q -ttttt 29. For human readable format use “-tttt” - tcpdump -i eth0 -c50 -q -tttt # Traffic direction (*) Relation to Firewall Virtual Machine Name of inspection point Notion of inspection point 1 Inbound Before the inbound FW VM Pre-Inbound “i” 2 Inbound After the inbound FW VM Post-Inbound “I” 3 Outbound Before the outbound FW VM Pre-Outbound “o” 4 Outbound After the outbound FW VM Post-Outbound “O BR Amarpreet Singh

[@8080VB]

what is net in tcpdump ?

[@amarpreetsingh3878]

@@8080VB network - “net”

[@8080VB]

@@amarpreetsingh3878 how to find mine , is that submask?

[@amarpreetsingh3878]

@@8080VB yes. The subnet for which u want to take dump. It could be ur port ip as well from where the traffic is going in and out or both

[@8080VB]

@@amarpreetsingh3878 ok ok how to find mine? look for eg my ip is 192.168.0.888 in this which is ?

[@aroundyou7540]

Never seen a video with this small size and having so much info thank you please keep posting such type of vedios

[@DavidMahler]

Thanks!

[@cesar.vasconcelos]

David, thank you so much for uploading these videos. They are specially useful for SDN novices. Again, thanks for sharing.

[@georgesmith9178]

Thank you for this excellent, brief and to-the-point video with super relevant, supporting examples.

[@DavidMahler]

You're very welcome!

[@antdetan3252]

Very clear explanation about tcpdump. I learnt quite a lot from this video. Thanks David.

[@DavidMahler]

Awesome, thanks, Antde!

[@rodrigaodragao]

Congratulations. The best class about tcpdump ever. Thank so much, help me a lot. You won one more subscriber.

[@DavidMahler]

Nice, thanks!

[@ihsanshah4862]

one of the best tutorials on SDN related stuff

[@DavidMahler]

Thanks so much!!

[@edoloza1]

Excellent job David... well worth the time to go through this...

[@DavidMahler]

Thanks!!

[@chris0234]

useful as the OSCP exam doesn't have a video on tcpdump and this clarifies a lot and teaches a lot of useful tricks.

[@DavidMahler]

Oh nice!

[@rommelechauri3901]

Awesome video! Thank you for the excellent tutorial.

[@DavidMahler]

You're welcome!

[@reggie9550]

Very well explained - I am going to see if you have more trainings available

[@DavidMahler]

Thanks Reggie!

[@RohitVerma-eb9ms]

Great Video David. Really Appreciate your all efforts

[@DavidMahler]

Thanks Rohit!

[@sharmapunit88]

Thanks David for this video really helpful

[@stanleylevy477]

Good overview. Thank you. Will likely review this again.

[@DavidMahler]

Great, thanks! I review them myself too when I forget ;-)

[@fudgetone]

If only all tutorials on KZbin were this good!

[@DavidMahler]

That's kind, thanks for that.

[@tedschafer339]

Wow. Going to have to watch that one more than a few times. A lot of info. Done very well and not too verbose.

[@DavidMahler]

Cool, thanks!

[@ala2ela373]

Very detailed explanation thankyou. Please make more videos

[@DavidMahler]

Thanks!

[@cecilyhewlett670]

Great video - especially the interpretation of the output. Thanks.

[@DavidMahler]

Very welcome!

[@toomajkarimi1131]

Clear and thorough explanation. Thanks

[@DavidMahler]

You're welcome!

[@sandeepjr7383]

video worth watching.. Thanks David

[@brackie1]

Thanks David...hits the spot...very good!!

[@DavidMahler]

yw!

[@manishayeshwanth]

Excellent video. Very clear and concise explanation.

[@DavidMahler]

Thanks a lot!

[@jasontle]

Another great Video from David. Thanks!

[@DavidMahler]

Thanks Cal Cool!!

[@jb121993]

What a great explanation! I'm subscribing in order to learn more. Thanks.

[@DavidMahler]

+jb121993 Thanks!

[@chriswansli755]

Great explanation. Good sequencing and very clear.

[@DavidMahler]

+Chris Wansli Thanks!

[@megapode2648]

Thanks you, been looking for a good linux tcpdump video

[@DavidMahler]

Cool, glad you found this one!

[@pwn0x80]

Thank you sir .. we need more vid pls keep uploading

[@DavidMahler]

Thanks!

[@ibnomer342]

a Clear and concise review. Thanks!

[@DavidMahler]

You're very welcome!

[@sukumarbhatnagar6630]

Great video David! The videos is very helpful. Thanks!

[@DavidMahler]

Sukumar Bhatnagar You're welcome!

[@cadyjeanney.669]

Amazing video. Thank you so much David.

[@DavidMahler]

You're welcome Cady, thanks for commenting!

[@origill1098]

An excellent video tutorial. ThanQ very much.

[@DavidMahler]

+Ori Gill You're welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@fdghjvgf]

Superb! Highly helpful and handy

[@DavidMahler]

Great, thanks!!

[@LGU-ih5pr]

Your videos about networking topics are amazing. Do come back and make more videos.

[@DavidMahler]

Thank you, I will when I can!

[@infraday5023]

I wonder if it's possible to automate monitoring vs malicious traffic on machine with gui

[@indrajitdj]

Very detailed and informative video

[@DavidMahler]

Thanks for watching Indrajeet!

[@rineeshnallatath7421]

Very good video. Thank you very much.

[@DavidMahler]

Rineesh Nallatath You're welcome, thanks for commenting!

[@updateswithpree5693]

very informative video . clearly explained !!

[@DavidMahler]

Thanks Preeti!

[@laseru]

I really appreciate your video!

[@DavidMahler]

Thanks for commenting!

[@JeanLucLacroix]

Great video. Very informative. Thanks.

[@DavidMahler]

+Jean-Luc Lacroix You're welcome!

[@tusharpatil-wi7gb]

Thank you for sharing very informative 👍

[@DavidMahler]

yw!

[@TheZax85]

Very nice - Thank you for this video!

[@DavidMahler]

You're welcome, thanks for commenting Morten!

[@HarishmVHM]

good explanations. Need some more videos which shows troubleshooting using commands.

[@DavidMahler]

+Harish M Thanks!

[@ashrayr6193]

Thank you. Great video for beginners.

[@DavidMahler]

Great, thanks for the comment!

[@sayantanmukherjeemukherjee8805]

Your Video helped me out a few hours back...Inspite of having Telnet and TCP connectivity I was unable to connect with a Ora NoSQL Node from my VH. The tcpdump -i eth0 -w ora.pcap showed its trying to connect with Default ports in Orcale intalled VM so was able to define servicerange ports and can connect it now.. Got the result from your clip specifically.. Although I used Wireshark to analyze the pcap file as was not aware of the reading option from the Linux option itself. So If I use the commnd (from root access) in the VM > tcpdump -r ora.pcap it should serve the purpose I hope.

[@DavidMahler]

Thats great neal. Thanks for sharing the details on how this video was of use to you! !

[@sam.kendrick]

Thank you for your work and knowledge!

[@DavidMahler]

You're welcome Sam!

[@vicronychen]

Very well explained. Thank you!

[@DavidMahler]

You're welcome! Thanks!

[@ahrhoades]

This is a well done tutorial.

[@DavidMahler]

+Andrew Rhoades Thanks!

[@allen8299]

that was a great video, man. nice job

[@DavidMahler]

Thanks man!

[@taoakinbo7480]

Nice one! Thanks for uploading.

[@DavidMahler]

+Tao Akinbo You are very welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@sibinkuttan]

Hi David , Nicely explained... :)

[@DavidMahler]

+sibin k Thank you sir!

[@InocenteSandoval]

Many thanks for the informative video!

[@DavidMahler]

Inocente Sandoval You're very welcome!

[@cepesh1979]

Perfect explanation, thanks.

[@DavidMahler]

You're welcome, thanks!

[@vanax89]

Very helpful! Good job man ;)

[@DavidMahler]

+Fabio D'Onofrio Thanks!

[@narendrasinghnegi6631]

very informative video. Thanks

[@DavidMahler]

You're welcome!

[@peshalnayak]

This is an excellent tutorial! I do have a question regarding the time stamps in the output. Do these time stamps denote the time when the packet transmission is complete, has started or when the packet was queued for transmission? Exactly when are these packet details picked up? Thanks a lot again.

[@DavidMahler]

Hi Peshal - I don't know the answer to this, but questions like this highlight gaps in my knowledge, so thanks! I'll be learning more about it in relationship to linux queuing etc.

[@pathikvsharma]

That was a great video. Thanks!

[@DavidMahler]

You're welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@srinivaspithani7645]

Great content , thanks

[@DavidMahler]

My pleasure!

[@khawarabbasi5006]

David, if my machine has many interfaces and i don't know by which interface i will capture traffic. i need to use "-i any" to see if my machine is getting any traffic or not. If my machine is getting traffic then how would i know the exact interface??

[@DavidMahler]

I find that tricky too. Personally, I use the "-e" option which should show destination MAC address of packets, then "ip link" or the equivalent to see which interface on the target system owns that MAC address. This doesn't work with broadcasts though.

[@mayrinvarkey9134]

hello sir, Is tcpdump analysis or capture purpose tool only or Could tcpdump be used for generation of packets to a specific dst ip address from a source machine just like an attack.

[@DavidMahler]

Capturing tool, thanks for the comment.

[@jczhang5247]

It's helpful!Thanks.

[@DavidMahler]

You're welcome Jason!

[@madukonnamdi3022]

Fantastic video Thanks alot

[@DavidMahler]

You're quite welcome!

[@RajivVermaNZ]

Thanks David, It was excellent tutorial. Is there a way to us -i any option at HP-UX or I can use "-i lan0 -i lan1"?

[@DavidMahler]

Hey - sorry I'm not familiar with the issue you have, sorry!

[@varigondaphanibhargav3990]

Pls share all tcpdump commands...it could be helpful for us if you have an document.

[@arvindgupta8991]

So useful.

[@DavidMahler]

Glad you think so!

[@engineersworkshop6936]

11:11 host keyword 14:59 protocol type filters

[@rahulshah-ml4ob]

Excellent job

[@DavidMahler]

Thank you!

[@bharatishpuranik2164]

Nice, super easy!

[@DavidMahler]

Thanks!

[@ATR-ur5ov]

Thanks a lot!

[@DavidMahler]

yw!

[@ercancataltepe17]

Thanks David!

[@DavidMahler]

ercan cataltepe YW

[@massimilianoausili6666]

Fenomenal!

[@DavidMahler]

Thank you Massimilano!

[@SK-ju8si]

thank you

[@DavidMahler]

yw!

[@nagamallareddyk8390]

thank you so much

[@DavidMahler]

You're welcome!

[@mandirdarshanarti]

easy short amazing

[@DavidMahler]

Thanks for the comment!

[@adityajain1989]

This is best video

[@DavidMahler]

Thanks!

[@tommyc9720]

Is TCPDUMP an active or passive network sniffer?

[@karanjadriver5472]

Excellent!!!!

[@DavidMahler]

TY!

[@allanng78]

Hi, Do u have anything able tcprewrite and tcpreplay?

[@DavidMahler]

Allan NG Hi Allan, no I don't but thanks for the idea :-)

[@husseinoda1672]

very nice

[@DavidMahler]

+hussein oda Thanks!

[@allenhuai6153]

perfect! thanks

[@DavidMahler]

No, thank you ! ;-)

[@jopaki]

Ty!

[@DavidMahler]

yw!!

[@tango2olo]

Plz make more videos on networking.. thanks..

[@DavidMahler]

Hi Tango - thanks for that. I wish I had more time in the day, I certainly would. I do hope to get back to some networking topics eventually.

[@rohanmhatre2980]

Nice...Thank You... :D

[@DavidMahler]

You're welcome!

[@IshanJain]

sudo is not necessary. All tcp dump needs is CAP_NET_RAW. Run sudo setcap cap_net_raw=eip /usr/bin/tcpdump to set net_raw capability for tcpdump binary and then you can run it without root permissions.

[@DavidMahler]

Thanks!

[@jovictor3007]

what was the point of this video ? was it to show off or to teach ? you go through it very fast barely explaining anything as if you are reading a script , I watched other videos that are on a slower pace where they take time to explain things then I understood tcpdump.

[@DavidMahler]

I'm glad you found videos that worked for you!

[@pwn0x80]

Thank you sir .. we need more vid pls keep uploading

[@DavidMahler]

I know, thanks!

[@johnsonsmith3976]

I won’t stop testifying for *mikeskyler* on telegram, I’m always happy to deal with him

[@zhiyizhu3040]

Thank you for your clear explanation!

[@DavidMahler]

yw!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@ashwinshakya]

Very well explained. Thank you!

[@DavidMahler]

You're welcome! Thanks for supporting the video!

[@zezoahmed4729]

Great video, thanks!

[@DavidMahler]

Tthanks!