TCPDUMP Beginner Guide

Originally, it was written in 1988 by four Network Research Group workers at Lawrence Berkeley Laboratory in California. It was organized eleven years later by Micheal Richardson and Bill Fenner in 1999, who created the tcpdump site. Tcpdump works on all Unix-like operating systems. The windows version of Tcpdump is called WinDump and uses WinPcap, the windows alternative for libpcap.

Use the snap to install tcpdump:

Use your package manager to install tcpdump:

Let’s see different usages and outputs as we explore tcpdump!

UDP

Tcpdump can dump UDP packets as well. We will use a netcat (nc) tool to send a UDP packet and then dump it.

In the above-given command, we send a UDP packet consisting of the string “tcpdumper” to the UDP port 1337 via localhost. Tcpdump captures the packet being sent over UDP port 1337 and will display it.

We will now dump this packet using tcpdump.

This command will capture and show the captured data from the packets in ASCII as well as hex form.

As we can see, the packet was sent to port 1337, and the length was 9 as the string tcpdumper is 9 bytes. We can also see that the packet has been displayed in hex format.

DHCP

Tcpdump can also carry out investigations on DHCP packets over the network. DHCP uses UDP port no 67 or 68, so we will define and limit tcpdump for only DHCP packets. Assume we are using a wifi network interface.
The command used here will be:

DNS

DNS, also known as Domain Name System, confirms to provide you with what you are looking for by matching the Domain name with the domain address. To inspect your device’s DNS level communication over the internet, you can use tcpdump in the following way. DNS uses UDP port 53 for communication.

ARP

Address Resolution Protocol is used for discovering the link-layer address, such as a MAC address. It is associated with a given internet layer address, typically an IPv4 address.

We are using tcpdump to capture and read the data carried in the arp packets. The command is as simple as:

ICMP

ICMP, also known as the Internet Control Message Protocol, is a supporting protocol in the Internet protocol suite. ICMP is used as an informational protocol.

To view all the ICMP packets on an interface, we can use this command:

NTP

NTP is a networking protocol designed specifically to synchronize the time on a network of machines. To capture traffic on ntp:

SMTP

SMTP or Simple Mail Transfer Protocol is mainly used for emails. Tcpdump can use this to extract useful email information. For example, to extract email recipients/senders:

IPv6

IPv6 is the “next generation” of IP, providing a wide range of IP addresses. IPv6 helps achieve the long-term health of the Internet.

To capture IPv6 traffic, use the ip6 filter specifying the TCP and UDP protocols using proto 6 and proto-17.

The ‘-c 4’ provides a packet count of up to 4 packets only. We can specify the number of packets to n and capture n packets.

HTTP

Hypertext Transfer Protocol is used for transferring data from a web server to a browser to view web pages. HTTP uses TCP form communication. Specifically, TCP port 80 is used.

To print all IPv4 HTTP packets to and from port 80:

HTTP Requests…

And responses are captured too

TCP

To capture TCP-only packets, this command will do all the good:

Normally TCP packet capture results in a lot of traffic; you can specify in detail your requirements by adding filters to the capture, such as:

Port
Specifies the port to monitor

Source IP
To view packets from a specified source

Destination IP
To view packets to a specified destination

Saving packet capture into files

To save the packet capture for doing analysis later, we can use the -w option of tcpdump that requires a filename parameter. These files are saved in a pcap (packet capture) file format, which can be used to save or send packet captures.

For example:

We can add filters as to if we want to capture TCP, UDP, or ICMP packets, etc.

Reading packet capture from files

Unfortunately, you cannot read the saved file via common ‘read file’ commands like cat, etc. The output is all but gibberish, and it is hard to tell what is in the file. ‘-r’ is used to read the packets saved in the .pcap file, stored earlier by ‘-w’ or other software storing pcaps:

This prints the data collected from captured packets on the terminal screen in a readable format.

Tcpdump cheatsheet

Tcpdump can be used with other Linux commands such as grep, sed, etc., to extract useful information. Here are some useful combinations and keywords amalgamated in use with tcpdump to get valuable information.

Extract HTTP User Agents:

The URLs requested over HTTP can be monitored using tcpdump such as:

You can also Extract HTTP Passwords in POST Requests

Server or Client-side cookies can be extracted using:

Capture DNS requests and responses by using:

Print all plain text passwords:

Common Tcpdump filters

• -A Shows packets in ASCII Format.
• -c Number of packets to capture.
• –count Print packet count only when reading a captured file.
• -e Print MAC addresses and link-level headers.
• -h or –help Prints version and usage information.
• –version Show the version information only.
• -i Specify the network interface to capture on.
• -K Prevent attempts to verify checksums of any packet. Adds speed.
• -m <module> Specify Module to use.
• -n Don’t convert addresses (i.e., host addresses, port numbers, etc.) to names.
• –number Print an optional packet number at the beginning of each line.
• -p Prohibit the interface from going into promiscuous mode.
• -Q Choose direction for the packets to be captured. Send or receive.
• -q Quiet/Quick Output. Prints Less information. Outputs are shorter.
• -r <file> Used to read packets from a pcap .
• -t Don’t print a timestamp on each dump line.
• -v Prints out more information regarding output.
• -w <file> Write the raw packets to file.
• -x Prints ASCII output.
• -X Prints ASCII with hex.
• –list-interfaces Shows all the network interfaces available where packets can be captured by tcpdump.

Cessation

Tcpdump has been a very widely used tool used in the research and applications of Security/Networking. The only drawback tcpdump has ‘No GUI,’ but it is too good to be kept out of the top charts. As Daniel Miessler writes, “Protocol Analyzers like Wireshark is great, but if you want to truly master packet-fu, you must become one with tcpdump first.”