Tcpdump - Revision history

Admin: /* Counting Packets */

2016-06-30T22:31:44Z

Counting Packets

← Older revision		Revision as of 22:31, 30 June 2016
Line 146:		Line 146:

	You can also use tcpdump to analyze a pcap file.		You can also use tcpdump to analyze a pcap file.

			==Reading Packets==

			To read packet data, run tcpdump with the <code>-r</code> flag (for read):

			<pre>
			$ tcpdump -r output.pcap
			</pre>

	==Counting Packets==		==Counting Packets==

Admin: /* Wireless Tcpdump */

2016-01-27T05:11:30Z

Wireless Tcpdump

← Older revision		Revision as of 05:11, 27 January 2016
Line 107:		Line 107:

	More instructions on capturing wireless packets with Tcpdump: [[Tcpdump/Wireless]]		More instructions on capturing wireless packets with Tcpdump: [[Tcpdump/Wireless]]

			[[Tcpdump/Wireless/Linux]]

			[[Tcpdump/Wireless/Mac]]

	=More Flags=		=More Flags=

Admin: /* G flag */

2016-01-27T05:10:54Z

G flag

← Older revision		Revision as of 05:10, 27 January 2016
Line 68:		Line 68:
	</pre>		</pre>

	If you use the G flag without the C flag (see below), you specify new filenames with strftime date/time format when you pass the filename to the -w flag. ~~Like this~~:		If you use the G flag without the C flag (see below), you specify new filenames with strftime date/time format when you pass the filename to the -w flag.

			This command makes a new pcap file every 100 seconds:

	<pre>		<pre>

Admin: /* Counting Packets */

2016-01-24T02:21:09Z

Counting Packets

← Older revision		Revision as of 02:21, 24 January 2016
Line 142:		Line 142:

	==Counting Packets==		==Counting Packets==

			Not sure if this will work:

	<pre>		<pre>
	$ tcpdump -nn -r output.pcap \| wc -l		$ tcpdump -n -r output.pcap \| wc -l
	</pre>		</pre>

Admin: /* Writing Packets To File */

2016-01-24T02:06:51Z

Writing Packets To File

← Older revision		Revision as of 02:06, 24 January 2016
Line 123:		Line 123:

	<pre>		<pre>
	-U If the -w option is not specified, make the printed packet output ``packet-buffered''; i.e., as the description of the contents of each packet is		-U If the -w option is not specified, make the printed packet output `
	printed, it will be written to the standard output, rather than, when not writing to a terminal, being written only when the output buffer fills.		`packet-buffered''; i.e., as the description of the contents of each packet is
			printed, it will be written to the standard output, rather than, when not writing
			to a terminal, being written only when the output buffer fills.

	If the -w option is specified, make the saved raw packet output ``packet-buffered''; i.e., as each packet is saved, it will be written to the output		If the -w option is specified, make the saved raw packet output
	file, rather than being written only when the output buffer fills.		``packet-buffered''; i.e., as each packet is saved, it will be written
			to the output file, rather than being written only when the output
			buffer fills.

	The -U flag will not be supported if tcpdump was built with an older version of libpcap that lacks the pcap_dump_flush() function.		The -U flag will not be supported if tcpdump was built with an
			older version of libpcap that lacks the pcap_dump_flush() function.
	</pre>		</pre>

Admin: /* Wireless Tcpdump */

2016-01-24T02:05:54Z

Wireless Tcpdump

← Older revision		Revision as of 02:05, 24 January 2016
Line 104:		Line 104:
	=Wireless Tcpdump=		=Wireless Tcpdump=

	~~If you want to capture~~ wireless packets~~, you need to know a bit more about a few things.~~		More instructions on capturing wireless packets with Tcpdump: [[Tcpdump/Wireless]]

	~~First is channels.~~		=More Flags=

	The 802.11 protocol allocates 12 channels for wireless (in the US), and your wireless card can only listen to one channel at a time. To listen to twelve channels, you need twelve wireless cards - or you need to hop from channel to channel with your single wireless card.

	~~If it is critical to capture all traffic, you will want to use multiple wireless cards - if you're hopping from channel 5 to channel 6, and traffic shows up on channel 4, you won't see it.~~

	Second is monitor mode. If your wireless card is not in monitor mode, your wireless card will be throwing away any packets that are not intended for itself, meaning you'll only be creating a pcap file of your own traffic.

	==Faster Packet Capture==		==Faster Packet Capture==
Line 122:		Line 116:
	</pre>		</pre>

	~~Further, if~~ you~~'re running~~ tcpdump ~~for a long period of time~~, you can use the ~~<code>-G</code>~~ flag ~~to create a new~~ .~~pcap file every N seconds (e~~.~~g., 3600 seconds or 1 file hourly)~~		==Writing Packets To File==

			If you want to force tcpdump to write every packet to the output file as it is received, rather than waiting until its input buffer is full, you can use the U flag. Note that this will be slower and should only be done when traffic is light - otherwise excessive disk writes will bog things down.

			From the man page:

	<pre>		<pre>
	~~tcpdump~~ -~~G 3600~~ -~~I -n~~ -i ~~wlan1 -w output_pcap_file_%H~~.~~pcap~~		-U If the -w option is not specified, make the printed packet output ``packet-buffered''; i.e., as the description of the contents of each packet is
	~~</pre>~~		printed, it will be written to the standard output, rather than, when not writing to a terminal, being written only when the output buffer fills.

	~~Link with more info:~~		If the -w option is specified, make the saved raw packet output ``packet-buffered''; i.e., as each packet is saved, it will be written to the output
			file, rather than being written only when the output buffer fills.

	~~http://stackoverflow~~.~~com/questions/16084699~~/~~scapy-how-to-get-the-statistics~~		The -U flag will not be supported if tcpdump was built with an older version of libpcap that lacks the pcap_dump_flush() function.
			</pre>

	=Analysis=		=Analysis=

Admin: /* W flag */

2016-01-24T01:55:26Z

W flag

← Older revision		Revision as of 01:55, 24 January 2016
Line 85:		Line 85:

	===W flag===		===W flag===

			The W flag will limit the number of output files, so that tcpdump will begin to overwrite the first file once it has finished writing to the Nth file:

	<pre>		<pre>

Admin: /* Wireless Tcpdump */

2016-01-23T21:18:25Z

Wireless Tcpdump

@@ Line 101: / Line 101: @@
 =Wireless Tcpdump=
 If you want to capture wireless packets, you need to know a bit more about a few things.
@@ Line 115: / Line 111: @@
 Second is monitor mode. If your wireless card is not in monitor mode, your wireless card will be throwing away any packets that are not intended for itself, meaning you'll only be creating a pcap file of your own traffic.
 ==Faster Packet Capture==

Admin: /* Controlling Yer Output */

2016-01-23T21:12:43Z

Controlling Yer Output

← Older revision		Revision as of 21:12, 23 January 2016
Line 218:		Line 218:

	http://stackoverflow.com/questions/16084699/scapy-how-to-get-the-statistics		http://stackoverflow.com/questions/16084699/scapy-how-to-get-the-statistics

	~~=Controlling Yer Output=~~

	~~Tcpdump can dump out looooots of stuff, so it is important to know how to use tcpdump flags to limit the size of pcap files.~~

	~~==G Flag==~~

	~~Use the <code>-G</code> flag to dump out pcap files at specified time intervals. You can specify the filename with a time format using the same format as strftime (see man strftime).~~

	~~<pre>~~
	~~-G rotate_seconds~~
	~~If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name specified by -w which should include~~
	~~a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous.~~
	~~</pre>~~

	~~With strftime, the most common parameters are hour/minute/second <code>%H-%M-%S</code>.~~

	=Analysis=		=Analysis=

Admin: /* Controlling Output */

2016-01-23T21:11:24Z

Controlling Output

← Older revision		Revision as of 21:11, 23 January 2016
Line 58:		Line 58:
	==Controlling Output==		==Controlling Output==

	~~You~~ can ~~set~~ tcpdump to create new ~~files on a specified time interval or specific~~ file ~~size.~~		To control output, you can have tcpdump create a new pcap file every N seconds, or every N megabytes.

			===G flag===

			Use the G flag to create a new pcap file every N seconds:

	<pre>		<pre>
	-G [seconds]		-G [seconds]
	</pre>		</pre>

	~~G flag sets the time~~

	If you use the G flag without the C flag (see below), you specify new filenames with strftime date/time format when you pass the filename to the -w flag. Like this:		If you use the G flag without the C flag (see below), you specify new filenames with strftime date/time format when you pass the filename to the -w flag. Like this:
Line 72:		Line 74:
	</pre>		</pre>

	-C sets the maximum pcap file size		===C flag===

			The C flag sets the maximum pcap file size, in millions of bytes. New files will have a common name with an incrementing number at the end. From the man page:

			<pre>
			-C

			Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number after it, starting at 1 and continuing upward. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes).
			</pre>

			===W flag===

			<pre>
			-W Used in conjunction with the -C option, this will limit the
			number of files created to the specified number, and begin
			overwriting files from the beginning, thus creating a 'rotat-
			ing' buffer. In addition, it will name the files with enough
			leading 0s to support the maximum number of files, allowing
			them to sort correctly.

			Used in conjunction with the -G option, this will limit the
			number of rotated dump files that get created, exiting with
			status 0 when reaching the limit. If used with -C as well, the
			behavior will result in cyclical files per timeslice.
			</pre>

	=Wireless Tcpdump=		=Wireless Tcpdump=