Tcpdump

Installing

Linux

tcpdump should come with your distro, but if it doesn't, use aptitude or your package manager to install:

apt-get install tcpdump

Once you've done that, you can list your network devices:

iwconfig

Pick out which ones you want to listen to.

Mac

tcpdump comes with Mac. Man page for tcpdump: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/tcpdump.1.html

List your network devices:

ifconfig

Pick out which ones you want to listen to.

Basic Usage

You may need to run tcpdump as sudo to access certain information from the hardware.

Tcpdump options can vary from platform to platform (e.g. mac vs linux) but this guide will cover some universal usage.

The simplest way to use tcpdump is to do an unfiltered packet capture - no filters on packets, so everything is captured.

The bare minimum you'll have to specify is a network interface. You may want to specify a file, too.

The -i and -w flags

To specify a network device you want to listen to, use the -i flag (for interface). Also specify an output file with the -w flag:

tcpdump -i en0 -w output_file.pcap

-w prevents your computer from having a meltdown trying to print every single packet in a busy place.

You can monitor multiple interfaces by specifying a list: -i en0,en1

If you are using wireless, you'll need to use additional commands to control the channel your wireless card is listening to.

Controlling Output

You can set tcpdump to create new files on a specified time interval or specific file size.

-G [seconds]

G flag sets the time

If you use the G flag without the C flag (see below), you specify new filenames with strftime date/time format when you pass the filename to the -w flag. Like this:

tcpdump -G 100 -w filename_%H-%M-%S.pcap

-C sets the maximum pcap file size

Wireless Tcpdump

If you want to capture wireless packets, you need to know a bit more about a few things.

First is channels.

The 802.11 protocol allocates 12 channels for wireless (in the US), and your wireless card can only listen to one channel at a time. To listen to twelve channels, you need twelve wireless cards - or you need to hop from channel to channel with your single wireless card.

If it is critical to capture all traffic, you will want to use multiple wireless cards - if you're hopping from channel 5 to channel 6, and traffic shows up on channel 4, you won't see it.

Second is monitor mode. If your wireless card is not in monitor mode, your wireless card will be throwing away any packets that are not intended for itself, meaning you'll only be creating a pcap file of your own traffic.

Monitor Mode in Mac

To put the wireless card into monitor mode, you can use the capital I flag -I with tcpdump.

Alternatively, you can use the airport utility, located at:

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport.

conveniently symlinked to /usr/local/bin:

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport

You can also use the -n flag to make things more readable.

sudo tcpdump -In -i en1 -w save.pcap

More information over at Unix Stack Exhange.

Channel-Hopping on Mac

When you run tcpdump with the -I flag, it will put the card in monitor mode and automatically cycle through all the channels. This will significantly boost the amount of traffic you dump to your pcap file!

Note that you can also use airport to monitor a single channel, e.g., channel 7:

sudo airport en1 sniff 7

Monitor Mode in Linux

Put your card into monitor mode with these steps:

iwconfig # list all devices
ifconfig wlan1 down # assuming wlan1 is wireless
iwconfig wlan1 mode monitor # put into monitor mode
ifconfig wlan1 up # bring wlan1 online

Channel-Hopping on Linux

Once you've put the card into monitor mode, you can run airodump-ng, which will automatically channel-hop unless you specify a specific channel. Once airodump is channel-hopping, you can run tcpdump.

Alternatively, you can set airodump to listen on a single channel.

Setting Channel from Shell Script

Another way to set the channel of the wireless card uses iwconfig, which means you can control the channel from a shell script:

iwconfig en1 channel 3

You can also use iwlist to view available channels and see the current channel of the wireless card:

root@kali:~# iwlist frequency
wlan0     14 channels in total; available frequencies :
          Channel 01 : 2.412 GHz
          Channel 02 : 2.417 GHz
          Channel 03 : 2.422 GHz
          Channel 04 : 2.427 GHz
          Channel 05 : 2.432 GHz
          Channel 06 : 2.437 GHz
          Channel 07 : 2.442 GHz
          Channel 08 : 2.447 GHz
          Channel 09 : 2.452 GHz
          Channel 10 : 2.457 GHz
          Channel 11 : 2.462 GHz
          Channel 12 : 2.467 GHz
          Channel 13 : 2.472 GHz
          Channel 14 : 2.484 GHz
lo        no frequency information.

eth0      no frequency information.

Faster Packet Capture

To minimize overhead processing packets and maximize the number of packets captured, you can turn off host name resolution with the -n flag. This also makes things slightly more readable.

tcpdump -I -n -i wlan1 -w output_pcap_file.pcap

Further, if you're running tcpdump for a long period of time, you can use the -G flag to create a new .pcap file every N seconds (e.g., 3600 seconds or 1 file hourly)

tcpdump -G 3600 -I -n -i wlan1 -w output_pcap_file_%H.pcap

Link with more info:

http://stackoverflow.com/questions/16084699/scapy-how-to-get-the-statistics

Controlling Yer Output

Tcpdump can dump out looooots of stuff, so it is important to know how to use tcpdump flags to limit the size of pcap files.

G Flag

Use the -G flag to dump out pcap files at specified time intervals. You can specify the filename with a time format using the same format as strftime (see man strftime).

       -G rotate_seconds
              If specified, rotates the dump file specified with the -w option every rotate_seconds seconds.  Savefiles will have the name specified by -w which should  include
              a time format as defined by strftime(3).  If no time format is specified, each new file will overwrite the previous.

With strftime, the most common parameters are hour/minute/second %H-%M-%S.

Analysis

You can also use tcpdump to analyze a pcap file.

Counting Packets

$ tcpdump -nn -r output.pcap | wc -l 

This will give you a count of the total number of packets in the pcap file.

Parsing Information

You can parse information by column using the cut utility.

$ tcpdump -n -r output.pcap

The output has the fields:

[timestamp] [network protocol] [source IP] . [source port] > [destination IP] . [destination port]

[1]