The art of network debugging with tcpdump
Introduction
Tcpdump is powerful tool for network monitoring and data acquisition it’s working as Swiss knife for network troubleshooting. tcpdump simply powerful application dump traffic on a network this is what tcpdum created for it’s not creates to be analyzer like Wireshark however every application have it’s usage.
Tcpdump give you data without any prejudgment and let burden of analysis is placed directly on the user rather than the application this will sharp your skills and give you deep understand how the protocol work. i notes this happen in almost everything around us and this one of thing make Linux most powerful OS it’s not make user depend in application in the same time it give him tools this Linux beauty
Promiscuous mode
Promiscuous mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to, In Linux root privileges is require to enable promiscuous mode.
How Tcpdump work and howto use ?
Tcpdump must be able to put the interface (typically an Ethernet) into promiscuous mode to read all the network traffic and decode it. tcpdump is use like any other Linux command and it’s installed by default in many Linux distribution
Basic and essential options
The most essential options in tcpdump is -i option which tell tcpdump which interface to put in promiscuous mode and listen to the traffic will coming. another favorite option is -n, which requests that don’t convert addresses (i.e., host addresses, port numbers, etc.) to names this save time and run faster plus in most case we troubleshooting ip not the names. here is the full list for common used options:
| -D | Print the list of the network interfaces available on the system and on which tcpdump can capture packets. This can be useful on systems that don’t have a command to list them (e.g. Windows systems) |
| -i | Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback). |
| -vvv | Increase the amount of packet information you get |
| -c | Exit after receiving count packets. |
| -n | Don’t convert addresses (i.e., host addresses, port numbers, etc.) to names. |
| -C | Specifies the size the dump file must reach before a new one with a numeric extension is created. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes). |
| -F | Use file as input for the filter expression. An additional expression given on the command line is ignored. |
| -S | Print absolute sequence numbers. |
| -p | Don’t put the interface into promiscuous mode. |
| -r | Read packets from file (which was created with the -w option). Standard input is used if file is ‘‘-’’. |
| -t | Don’t print a timestamp on each dump line. |
| -X | When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header)
|
| -XX | When parsing and printing, in addition to printing the headers of each packet, print the data of each packet, including its link level
|
| -E | Print the link-level header on each dump line. |
| -z | Drops privileges (if root) and changes user ID to user and the group ID to the primary group of user. |
| List of supported NIC that can be used by tcpdump |
| [root@Machine ~]# tcpdump -D
|
| Capture all traffic path in eth0 then write it to file name tcpdumpfile and set the each file size to be around 3M without trying to resolve IP/Port name |
| [root@Machine ~]# tcpdump -nnxX -i eth0 -w tcpdumpfile -C 3
|
Expressions:
Searching in the Network traffic like searching in the ocean, you need to know exactly what you searching for. tcpdump can really collect huge a amount of traffic so you need to guide tcpdump which kind of traffic you intersing in this can be done with expression.
The expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more qualifiers.There are three different kinds of qualifier
type: Possible types are host, net , port and portrange. E.g., ‘host foo’, ‘net 128.3’, ‘port 20’, ‘portrange 6000-6008’. If there is no type qualifier, host is assumed.
dir: Possible directions are src, dst, src or dst and src and dst. E.g., ‘src foo’, ‘dst net 128.3’, ‘src or dst port ftp-data’. If there is no dir qualifier, src or dst is assumed.
proto: Possible protos are: ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, tcp and udp. E.g., ‘ether src foo’, ‘arp net 128.3’, ‘tcp port 21’, ‘udp portrange 7000-7009’. If there is no proto qualifier, all protocols are assumed.
| host ip-address/hostname | True if either the IPv4/v6 source or destination of the packet is ip-address/hostname also can be used with dst host and src host |
| port number/port-name | True if either the source or destination port of the packet is number/port-name also can be used with dst port and src port |
| portrange numbe1-number2 | True if either the source or destination port of the packet is between number1 and number2 also can be used with dst portrange and src portrange |
| ether host MAC | True if either the Ethernet source or destination address is MAC also can be used ether src and ether dst |
| ether broadcast | True if the packet is an Ethernet broadcast packet. and broadcast can be use directly |
| gateway ip-address | True if the packet used ip-address as a gateway |
| net network-address | True if either the IPv4/v6 source or destination address of the packet has a network number of network-address. also can be used with src net and dst net |
| ip broadcast | True if the packet is an IPv4 broadcast packet. |
| vlan vlan_id | True if the packet is an IEEE 802.1Q VLAN packet. If [vlan_id] is specified, only true if the packet has the specified vlan_id |
| mpls label_num | True if the packet is an MPLS packet. If [label_num] is specified, only true is the packet has the specified label_num |
| vpi /vci number | True if the packet is an ATM packet,with a virtual path/channel identifier of number |
| less/greater length | True if the packet has a length less/greater than or equal to length |
| To print all packets arriving from or departing to 10.0.2.2 |
| [root@server ~]# tcpdump -nnvvv -i eth0 host 10.0.2.2
|
| capture all traffic dst to http port and coming form my loop back interface |
| [root@server ~]# tcpdump -vvv -i lo dst port http
|
| capture all Address Resolution Protocol (ARP) packets |
| [root@server ~]# tcpdump -nnevvv -c 3 arp
|
| Try to capture icmp traffic AND to or from the host 10.0.2.2 |
| [root@server ~]# tcpdump -nn icmp host 10.0.2.2
|
In last example we was trying to use tow valid expressions with tcpdump but How come tcpdump know and differentiate this tow expressions ?? answer: with combine them
Expressions combination
Tcpdump understanding boolean operators (AND, NOT, OR). grouping this boolean operators between the expressions can create any rule limited only with your imagination.
Boolean operators define the relationships between expressions or groups of expressions. The relationship can be True or False and depend in this tcpdump will take the resolution to capture the packet or not
- AND (and == && ) Give True ONLY AND ONLY IF both expression True else give False
- NOT (not == !) Reverse the resolution if it was Ture it will be False and if it was False it will be True
- OR (or == ||) Give False ONLY AND ONLY IF both expression False else give True
| All IP packets between 10.0.2.15 and any host except 10.0.2.2 |
| [root@server ~]# tcpdump -c 10 ip host 10.0.2.15 and not 10.0.2.2
|
| Capture packets related with Mail , Web and FTP service |
| [root@server ~]# tcpdump -c 3 -i eth0 port smtp or http or ftp-data or ftp
|
| Capture only traffic from Internet |
| [root@server ~]# tcpdump -c 5 -nn -i eth0 ’src net not 192.168.0.0/16 and not 10.0.0.0/8′
|
| Capture ftp and http |
| [root@server ~]# tcpdump -nn -i eth0 src host 10.0.2.15 and ‘dst port 21 or 80′
6 packets captured
|
Problems and hints
No output
Check to make sure you’re specifying the correct network interface with the -i option, which I suggest you always use explicitly. If you’re having DNS problems, TCPdump might hang trying to lookup DNS names for IP addresses, try the -f or -n options to disable this feature. If you still see nothing, check the kernel interface – TCPdump might be mis-configured for your system.
Dropped packets
At the end of its run, TCPdump will inform you if any packets were dropped in the kernel. If this becomes a problem, it’s likely that your host can’t keep up with the network traffic and decode it at the same time. Try using TCPdump’s -w option to bypass the decoding and write the raw packets to a file, then come back later and decode the file with the -r switch. You can also try using -s to reduce the capture snapshot size.
Messages that end like [|rip] and [|domain]
Messages ending with [|proto] indicate that the packet couldn’t be completely decoded because the capture snapshot size (the so-called “snarf
length”) was too small. Increase it with the -s switch.
