Introduction to TCPDUMP

Twitter: @davidmahler
LinkedIn: / davidmahler
Links:
reference: www.tcpdump.org
reference: tcpdump man page!
tcpdump options used in this video:
Version check: -h
List interfaces: -D
Capture on eth0: -i eth0
Stop at 500 (or any #) of packets: -c500
No name resolution: -n
Change capture size (ex 96 Bytes): -s96
Max capture size: -s0
save to file capture.pcap: -w capture.pcap -v
Read from a capture file: -r capture.pcap
Filters:
IP: host (ip addr)
Source IP: src host (ip addr)
Dest. IP: dst host (ip addr)
port: port 80
MAC address: ether host (mac address)
protocol filters: tcp, udp, icmp, arp, rarp, ip6, (others)
SYN flag: "tcp[tcpflags] & tcp-syn != 0"
RST flag: "tcp[tcpflags] & tcp-rst != 0"
Output options:
View MAC info: -e
Include hex and ASCII: -XX
ASCII only: -A
max verbosity: -vvv
ignore checksum errors: -K
quiet: -q
timestamp options: -t, -tt, -ttt, etc...

[@eyalpery8470]

Never paused a video so many times, the longest 18 minutes of my life and it was totally worth it ! Very informative video!

[@DavidMahler]

Sorry? Or Thanks? Not sure :-). Thanks for the comment!

[@kacperpodgorski1195]

The best explanation in the world ! Respect from 2021

[@cesar.vasconcelos]

David, thank you so much for uploading these videos. They are specially useful for SDN novices. Again, thanks for sharing.

[@ManojKumar-rg8ez]

Hi David, Your whole series of videos are so great, and you are able to make other understand in much better way than any other person or sources on internet. These are by far the best videos on internet.

[@DavidMahler]

Thank you Manoj! I'm happy you like them!!!

[@fahimuel]

Excellent Content - To the point and comprehensive. Salute to you David for the great work.

[@DavidMahler]

Thanks a lot, Fahimuel!

[@derekplante7062]

Fantastic work, a clear and concise understanding of TCP Dump basics. Appreciate the video.

[@DavidMahler]

yw!

[@antdetan3252]

Very clear explanation about tcpdump. I learnt quite a lot from this video. Thanks David.

[@DavidMahler]

Awesome, thanks, Antde!

[@renzochepar]

One of the best tutorial I've seen ever Very comprehensive in just 18 minutes.

[@DavidMahler]

Thanks!

[@BryanChance]

I find Mr. Mahler's videos to be extrememly affective. Thank you sir!

[@DavidMahler]

Glad to hear that!

[@georgesmith9178]

Thank you for this excellent, brief and to-the-point video with super relevant, supporting examples.

[@DavidMahler]

You're very welcome!

[@edoloza1]

Excellent job David... well worth the time to go through this...

[@DavidMahler]

Thanks!!

[@mathewkargarzadeh3158]

David, the best illustration on TCPDUM I have ever seen. I would compare it like someone getting an orange and and juicing it and giving it to his viewers. I loved it . You must be a very nice person to spend your own personal time and sharing your know how with others.. Kudos to you !!!. Thank you !!

[@DavidMahler]

LOL, that is awesome, thanks for the feedback! I do just like to contribute to the community!

[@rodrigaodragao]

Congratulations. The best class about tcpdump ever. Thank so much, help me a lot. You won one more subscriber.

[@DavidMahler]

Nice, thanks!

[@jeetespey12]

Superb way to demonstrate use of TCPDUMP, I would like to recommend this video to anyone who wants to understand use of TCPDUMP. Many thanks [.]

[@DavidMahler]

+jeetespey12 You're welcome!

[@aroundyou7540]

Never seen a video with this small size and having so much info thank you please keep posting such type of vedios

[@DavidMahler]

Thanks!

[@manishayeshwanth]

Excellent video. Very clear and concise explanation.

[@DavidMahler]

Thanks a lot!

[@RohitVerma-eb9ms]

Great Video David. Really Appreciate your all efforts

[@DavidMahler]

Thanks Rohit!

[@stanleylevy477]

Good overview. Thank you. Will likely review this again.

[@DavidMahler]

Great, thanks! I review them myself too when I forget ;-)

[@sukumarbhatnagar6630]

Great video David! The videos is very helpful. Thanks!

[@DavidMahler]

Sukumar Bhatnagar You're welcome!

[@tpaullee330]

Watched it twice and pause-n-take notes many times second time around. It is a great investment as tcpdump is the only tool left for me to debug mysterious networking problems including "connection refused" and so on. Thank you!

[@DavidMahler]

Glad it was helpful!

[@jb121993]

What a great explanation! I'm subscribing in order to learn more. Thanks.

[@DavidMahler]

+jb121993 Thanks!

[@ihsanshah4862]

one of the best tutorials on SDN related stuff

[@DavidMahler]

Thanks so much!!

[@jasontle]

Another great Video from David. Thanks!

[@DavidMahler]

Thanks Cal Cool!!

[@cecilyhewlett670]

Great video - especially the interpretation of the output. Thanks.

[@DavidMahler]

Very welcome!

[@chriswansli755]

Great explanation. Good sequencing and very clear.

[@DavidMahler]

+Chris Wansli Thanks!

[@toomajkarimi1131]

Clear and thorough explanation. Thanks

[@DavidMahler]

You're welcome!

[@brackie1]

Thanks David...hits the spot...very good!!

[@DavidMahler]

yw!

[@cadyjeanney.669]

Amazing video. Thank you so much David.

[@DavidMahler]

You're welcome Cady, thanks for commenting!

[@fudgetone]

If only all tutorials on KZbin were this good!

[@DavidMahler]

That's kind, thanks for that.

[@ibnomer342]

a Clear and concise review. Thanks!

[@DavidMahler]

You're very welcome!

[@rommelechauri3901]

Awesome video! Thank you for the excellent tutorial.

[@DavidMahler]

You're welcome!

[@tedschafer339]

Wow. Going to have to watch that one more than a few times. A lot of info. Done very well and not too verbose.

[@DavidMahler]

Cool, thanks!

[@megapode2648]

Thanks you, been looking for a good linux tcpdump video

[@DavidMahler]

Cool, glad you found this one!

[@ashwinshakya]

Very well explained. Thank you!

[@DavidMahler]

You're welcome! Thanks for supporting the video!

[@sam.kendrick]

Thank you for your work and knowledge!

[@DavidMahler]

You're welcome Sam!

[@fdghjvgf]

Superb! Highly helpful and handy

[@DavidMahler]

Great, thanks!!

[@chris0234]

useful as the OSCP exam doesn't have a video on tcpdump and this clarifies a lot and teaches a lot of useful tricks.

[@DavidMahler]

Oh nice!

[@ashrayr6193]

Thank you. Great video for beginners.

[@DavidMahler]

Great, thanks for the comment!

[@allen8299]

that was a great video, man. nice job

[@DavidMahler]

Thanks man!

[@TheZax85]

Very nice - Thank you for this video!

[@DavidMahler]

You're welcome, thanks for commenting Morten!

[@ala2ela373]

Very detailed explanation thankyou. Please make more videos

[@DavidMahler]

Thanks!

[@JeanLucLacroix]

Great video. Very informative. Thanks.

[@DavidMahler]

+Jean-Luc Lacroix You're welcome!

[@pwn0x80]

Thank you sir .. we need more vid pls keep uploading

[@DavidMahler]

Thanks!

[@vanax89]

Very helpful! Good job man ;)

[@DavidMahler]

+Fabio D'Onofrio Thanks!

[@InocenteSandoval]

Many thanks for the informative video!

[@DavidMahler]

Inocente Sandoval You're very welcome!

[@indrajitdj]

Very detailed and informative video

[@DavidMahler]

Thanks for watching Indrajeet!

[@cepesh1979]

Perfect explanation, thanks.

[@DavidMahler]

You're welcome, thanks!

[@origill1098]

An excellent video tutorial. ThanQ very much.

[@DavidMahler]

+Ori Gill You're welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@narendrasinghnegi6631]

very informative video. Thanks

[@DavidMahler]

You're welcome!

[@updateswithpree5693]

very informative video . clearly explained !!

[@DavidMahler]

Thanks Preeti!

[@reggie9550]

Very well explained - I am going to see if you have more trainings available

[@DavidMahler]

Thanks Reggie!

[@laseru]

I really appreciate your video!

[@DavidMahler]

Thanks for commenting!

[@valarfuckulis]

You're great David... SDN is an amazing approach to computer networking, and you are explaining it very well... Do you think you can do some videotutorials on how to correctly build a custom controller as a switch/router, say using POX?... there are some guides on how one could do it, but the documentation itself is very poor... Thank you very much for your videos ;)

[@DavidMahler]

Hello Pavel. Thanks for the comment and suggestion. I actually don't have any immediate plans to put up a video like that but might in the distant future. Right now I'm looking at covering some network automation first, probably Ansible. Have you checked out Dr. Nick Feamster's Coursera class - programming Pox is a topic in that class - it's not currently active - perhaps you can see the archives though.

[@rineeshnallatath7421]

Very good video. Thank you very much.

[@DavidMahler]

Rineesh Nallatath You're welcome, thanks for commenting!

[@sibinkuttan]

Hi David , Nicely explained... :)

[@DavidMahler]

+sibin k Thank you sir!

[@taoakinbo7480]

Nice one! Thanks for uploading.

[@DavidMahler]

+Tao Akinbo You are very welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@zezoahmed4729]

Great video, thanks!

[@DavidMahler]

Tthanks!

[@tusharpatil-wi7gb]

Thank you for sharing very informative 👍

[@DavidMahler]

yw!

[@zhiyizhu3040]

Thank you for your clear explanation!

[@DavidMahler]

yw!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@peshalnayak]

This is an excellent tutorial! I do have a question regarding the time stamps in the output. Do these time stamps denote the time when the packet transmission is complete, has started or when the packet was queued for transmission? Exactly when are these packet details picked up? Thanks a lot again.

[@DavidMahler]

Hi Peshal - I don't know the answer to this, but questions like this highlight gaps in my knowledge, so thanks! I'll be learning more about it in relationship to linux queuing etc.

[@ahrhoades]

This is a well done tutorial.

[@DavidMahler]

+Andrew Rhoades Thanks!

[@massimilianoausili6666]

Fenomenal!

[@DavidMahler]

Thank you Massimilano!

[@LGU-ih5pr]

Your videos about networking topics are amazing. Do come back and make more videos.

[@DavidMahler]

Thank you, I will when I can!

[@srinivaspithani7645]

Great content , thanks

[@DavidMahler]

My pleasure!

[@ercancataltepe17]

Thanks David!

[@DavidMahler]

ercan cataltepe YW

[@harishm7331]

good explanations. Need some more videos which shows troubleshooting using commands.

[@DavidMahler]

+Harish M Thanks!

[@pathikvsharma]

That was a great video. Thanks!

[@DavidMahler]

You're welcome!

[@bettycole9233]

I bought a cc from @Darkteckh on telegram best vendor I know and very trustworthy.He sell cc,fullz,Ban

[@jczhang5247]

It's helpful!Thanks.

[@DavidMahler]

You're welcome Jason!

[@rahulshah-ml4ob]

Excellent job

[@DavidMahler]

Thank you!

[@madukonnamdi3022]

Fantastic video Thanks alot

[@DavidMahler]

You're quite welcome!

[@SK-ju8si]

thank you

[@karanjadriver5472]

Excellent!!!!

[@DavidMahler]

TY!

[@arvindgupta8991]

So useful.

[@DavidMahler]

Glad you think so!

[@allenhuai6153]

perfect! thanks

[@DavidMahler]

No, thank you ! ;-)

[@bharatishpuranik2164]

Nice, super easy!

[@DavidMahler]

Thanks!

[@jopaki]

Ty!

[@DavidMahler]

yw!!

[@ATR-ur5ov]

Thanks a lot!

[@DavidMahler]

yw!

[@nagamallareddyk8390]

thank you so much

[@DavidMahler]

You're welcome!

[@husseinoda1672]

very nice

[@DavidMahler]

+hussein oda Thanks!

[@mandirdarshanarti]

easy short amazing

[@DavidMahler]

Thanks for the comment!

[@adityajain1989]

This is best video

[@DavidMahler]

Thanks!

[@RajivVermaNZ]

Thanks David, It was excellent tutorial. Is there a way to us -i any option at HP-UX or I can use "-i lan0 -i lan1"?

[@DavidMahler]

Hey - sorry I'm not familiar with the issue you have, sorry!

[@sayantanmukherjeemukherjee8805]

Your Video helped me out a few hours back...Inspite of having Telnet and TCP connectivity I was unable to connect with a Ora NoSQL Node from my VH. The tcpdump -i eth0 -w ora.pcap showed its trying to connect with Default ports in Orcale intalled VM so was able to define servicerange ports and can connect it now.. Got the result from your clip specifically.. Although I used Wireshark to analyze the pcap file as was not aware of the reading option from the Linux option itself. So If I use the commnd (from root access) in the VM > tcpdump -r ora.pcap it should serve the purpose I hope.

[@DavidMahler]

Thats great neal. Thanks for sharing the details on how this video was of use to you! !

[@rohanmhatre2980]

Nice...Thank You... :D

[@DavidMahler]

You're welcome!

[@infraday5023]

I wonder if it's possible to automate monitoring vs malicious traffic on machine with gui

[@mayrinvarkey9134]

hello sir, Is tcpdump analysis or capture purpose tool only or Could tcpdump be used for generation of packets to a specific dst ip address from a source machine just like an attack.

[@DavidMahler]

Capturing tool, thanks for the comment.

[@engineersworkshop6936]

11:11 host keyword 14:59 protocol type filters

[@khawarabbasi5006]

David, if my machine has many interfaces and i don't know by which interface i will capture traffic. i need to use "-i any" to see if my machine is getting any traffic or not. If my machine is getting traffic then how would i know the exact interface??

[@DavidMahler]

I find that tricky too. Personally, I use the "-e" option which should show destination MAC address of packets, then "ip link" or the equivalent to see which interface on the target system owns that MAC address. This doesn't work with broadcasts though.

[@tommyc9720]

Is TCPDUMP an active or passive network sniffer?

[@allanng78]

Hi, Do u have anything able tcprewrite and tcpreplay?

[@DavidMahler]

Allan NG Hi Allan, no I don't but thanks for the idea :-)

[@varigondaphanibhargav3990]

Pls share all tcpdump commands...it could be helpful for us if you have an document.

[@tango2olo]

Plz make more videos on networking.. thanks..

[@DavidMahler]

Hi Tango - thanks for that. I wish I had more time in the day, I certainly would. I do hope to get back to some networking topics eventually.

[@amarpreetsingh3878]

Tcp Dump 1. Version check: - tcpdump -h 2. To check available interfaces on VM: - tcpdump -D 3. Checking tcpdump on all interfaces: - tcpdump -i any 4. Stop tcpdump after a specified number of packets: - tcpdump -i any -c 5 (This one stops the capture after generating 5 packets ) 5. Show tcpdump in form of IPs and not FODN names: - tcpdump -i any -c 5 -n (Using -n will show IP and port numbers. If not used then the utility will tigger reverse DNS lookups to determine IP) 6. To limit capture size use -s option: - tcpdump -i any -c 5 -n -s1024 7. To check with proper sequence number use this: - tcpdump -i any -c20 -n tcp and dst port 39952 -t 8. Save captures to a file: - tcpdump -i any -w capture.pcap 9. Use -v option while performing captures to a file to see wether filter is receiving any packets or not: - tcpdump -i any -w capture.pcap -v 10. Reading existing files: - tcpdump -n -r capture.pcap 11. Use pipe (|) and less while viewing pcap files so that you can scroll through them: - tcpdump -n -r capture.pcap | less 12. To check packets from one particular host only: - tcpdump -i eth1 -n host 10.0.0.4 -c10 13. To check packets from one particular host from one side either source or destination only: - tcpdump -i eth1 -n host src 10.0.0.4 -c10 - tcpdump -i eth1 -n host dst 10.0.0.4 -c10 14. Use “and port ” to filter traffic for that port only: - tcpdump -i eth1 -n host 10.0.0.4 and port 80 -c10 15. Between two host: - tcpdump -i eth1 -n host 10.0.0.4 and host 192.168.0.4 -c10 16. For composite types i.e. using “and-or”: - tcpdump -i eth0 -n “host 192.168.0.4 \ > and (port 80 or port443)” Use (“”) in such commands 17. Based on whole network: - tcpdump -i eth0 -n -c 50 “src net 192.168.00/16 \ > and not dst net 192.168.0.0/16 and not dst net 10.0.0.0/16” 18. Based on mac address: - tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c50 Here “ether host is used to refer mac addr” 19. Mac addr are not visible by default so we use “-e” to see mac addr: - tcpdump -i eth0 ether host 28:16:2e:1f:25:49 -n -c50 -e 20. To tcpdump ipV6 IPs use ip6 a th end - tcpdump -i any ip6 21. Capture based on flags: - tcpdump -i any “tcp[tcpflags] \ > & tcp-syn !=0” Or > &tcp-rst !=0” Adjusting seeing tcpdump outputs- 22. -XX option shows more details specifically in hex and ascii format - tcpdump -i eth0 port 80 -c50 -XX 23. In place of using -XX we can use -A to get only te ASCII value and not the hex value: - tcpdump -i eth0 port 80 -c50 -A 24. Increasing levels of details can we fetched from -v or -vv or -vvv: - tcpdump -i eth0 port 80 -c50 -vvv 25. To see minimal quiet display ouput use -q: - tcpdump -i eth0 port 80 -c50 -q Example: Time ip vm1.port > vm3.ssh: tcp0 Time ip vm3.ssh > vm1.port: tcp0 . . . 26. To remove time frame in any tcpdumps use “-t” - tcpdump -i eth0 port80 -c50 -q -t ip vm1.port > vm3.ssh: tcp0 ip vm3.ssh > vm1.port: tcp0 . . 27. Use 3 “-ttt” to check time difference between consecutive packets in the ouTput. This can be used to check spikes or latencies In packets: - tcpdump -i eth0 -c50 -q -ttt 28. Use 5 “-ttttt” shows the time since the first packet capture. Used to lookup how long does the certain transactions took to complete. - tcpdump -i eth0 -c50 -q -ttttt 29. For human readable format use “-tttt” - tcpdump -i eth0 -c50 -q -tttt # Traffic direction (*) Relation to Firewall Virtual Machine Name of inspection point Notion of inspection point 1 Inbound Before the inbound FW VM Pre-Inbound “i” 2 Inbound After the inbound FW VM Post-Inbound “I” 3 Outbound Before the outbound FW VM Pre-Outbound “o” 4 Outbound After the outbound FW VM Post-Outbound “O BR Amarpreet Singh

[@8080VB]

what is net in tcpdump ?

[@amarpreetsingh3878]

@@8080VB network - “net”

[@8080VB]

@@amarpreetsingh3878 how to find mine , is that submask?

[@amarpreetsingh3878]

@@8080VB yes. The subnet for which u want to take dump. It could be ur port ip as well from where the traffic is going in and out or both

[@8080VB]

@@amarpreetsingh3878 ok ok how to find mine? look for eg my ip is 192.168.0.888 in this which is ?

[@IshanJain]

sudo is not necessary. All tcp dump needs is CAP_NET_RAW. Run sudo setcap cap_net_raw=eip /usr/bin/tcpdump to set net_raw capability for tcpdump binary and then you can run it without root permissions.

[@DavidMahler]

Thanks!

[@jovictor3007]

what was the point of this video ? was it to show off or to teach ? you go through it very fast barely explaining anything as if you are reading a script , I watched other videos that are on a slower pace where they take time to explain things then I understood tcpdump.

[@DavidMahler]

I'm glad you found videos that worked for you!

[@vicronychen]

Very well explained. Thank you!

[@DavidMahler]

You're welcome! Thanks!

[@pwn0x80]

Thank you sir .. we need more vid pls keep uploading

[@DavidMahler]

I know, thanks!

[@johnsonsmith3976]

I won’t stop testifying for *mikeskyler* on telegram, I’m always happy to deal with him