OSCP Exam Training Program-6
OSCP Exam Training Program-6
1|Page
Comprehensive Guide to TCPDump
Contents
Introduc�on ............................................................................................................................................ 4
Introduc�on to TCPDump ....................................................................................................................... 4
Available Op�ons .................................................................................................................................... 4
List of interfaces ...................................................................................................................................... 4
Default Capture ....................................................................................................................................... 5
Capturing traffic of a par�cular interface ............................................................................................... 5
Packet count ............................................................................................................................................ 6
Verbose mode ......................................................................................................................................... 6
Prin�ng each packet in ASCII................................................................................................................... 7
Don’t convert address ............................................................................................................................. 7
Port filter ................................................................................................................................................. 8
Host filter ................................................................................................................................................ 8
The header of each packet ...................................................................................................................... 9
TCP sequence number .......................................................................................................................... 10
Packet filter ........................................................................................................................................... 11
Packet direc�ons ................................................................................................................................... 12
Live number count ................................................................................................................................ 12
Read and write in a file ......................................................................................................................... 13
Snapshot length .................................................................................................................................... 13
Dump mode .......................................................................................................................................... 14
Link Level Header .................................................................................................................................. 15
Parsing and Prin�ng .............................................................................................................................. 15
User scan ............................................................................................................................................... 17
Timestamp Precision ............................................................................................................................. 18
Force Packets......................................................................................................................................... 19
RADIUS .............................................................................................................................................. 20
AODV ................................................................................................................................................. 20
RPC .................................................................................................................................................... 20
CNFP .................................................................................................................................................. 21
LMP ................................................................................................................................................... 21
PGM .................................................................................................................................................. 22
RTP .................................................................................................................................................... 22
RTCP .................................................................................................................................................. 22
SNMP................................................................................................................................................. 23
2|Page
Comprehensive Guide to TCPDump
TFTP ................................................................................................................................................... 23
VAT .................................................................................................................................................... 23
WB ..................................................................................................................................................... 24
VXLAN................................................................................................................................................ 24
Promiscuous Mode ............................................................................................................................... 25
No Promiscuous Mode .......................................................................................................................... 26
Version Informa�on .............................................................................................................................. 26
Quick Mode ........................................................................................................................................... 27
Verbose Mode ....................................................................................................................................... 27
HTTP Requests ...................................................................................................................................... 28
User Agent............................................................................................................................................. 30
Port Range ............................................................................................................................................. 30
Des�na�on ............................................................................................................................................ 31
Source ................................................................................................................................................... 31
Network ................................................................................................................................................ 31
TCP Packets ........................................................................................................................................... 32
Tcpdump to Wireshark .......................................................................................................................... 33
Conclusion ............................................................................................................................................. 36
3|Page
Comprehensive Guide to TCPDump
Introduction
In this ar�cle, we are going to learn about tcpdump. It is a powerful command-line tool for network
packet analysis. Tcpdump helps us troubleshoot the network issues as well as help us analyze the
working of some security tools.
Introduction to TCPDump
Tcpdump was originally developed in 1988 by Van Jacobson, Sally Floyd, Vern Paxson, and Steven
McCanne. They worked at the Lawrence Berkeley Laboratory Network Research Group.
It allows its users to display the TCP/IP and other packets being received and transmited over the
network. Tcpdump works on most of the Linux based opera�ng systems. It uses the libpcap library to
capture packets, which is a C/C++ based library. Tcpdump has a windows equivalent as well. It is
named windump. It uses a winpcap for its library.
Available Options
We can use the following parameter to print the tcpdump and libpcap version strings. Also, we can
print a usage message that shows all the available op�ons.
tcpdump -h
tcpdump --help
List of interfaces
An interface is the point of interconnec�on between a computer and a network. We can use the
following parameter to print the list of the network interfaces available on the system. It can also
detect interfaces on which tcpdump can capture packets. For each network interface, a number is
assigned. This number can be used with the ‘-i’ parameter to capture packets on that par�cular
interface.
There might be a scenario where the machine that we are working on, is unable to list the network
interfaces it is running. This can be a compa�bility issue or something else hindering the execu�on of
some specific commands (ifconfig -a).
tcpdump –list-interface
tcpdump -D
4|Page
Comprehensive Guide to TCPDump
Default Capture
Before moving onto to advanced op�ons and parameters of this network traffic capture tool let's first
do a capture with the default configura�ons.
Tcpdump
tcpdump -i eth0
5|Page
Comprehensive Guide to TCPDump
Packet count
Tcpdump has some amazing features which we can use to make our traffic analysis more efficient.
We can access some of these features using various parameters. We use the -c parameter, it will help
us to capture the exact amount of data that we need and display those. It refines the amount of data
we captured.
Verbose mode
The verbose mode provides informa�on regarding the traffic scan. For example, �me to live(TTL),
iden�fica�on of data, total length and available op�ons in IP packets. It enables addi�onal packet
integrity checks such as verifying the IP and ICMP headers.
tcpdump -i eth0 -c 5 -v
6|Page
Comprehensive Guide to TCPDump
tcpdump -i eth0 -c 5 -A
tcpdump -i eth0 -c 5
tcpdump -i eth0 -c 5 -nn
7|Page
Comprehensive Guide to TCPDump
Port filter
Port filter helps us to analyze the data traffic of a par�cular port. It helps us to monitor the
des�na�on ports of the TCP/UDP or other port-based network protocols.
Host filter
This filter helps us to analyze the data traffic of a par�cular host. It also allows us to s�ck to a
par�cular host through which further makes our analyzing beter. Mul�ple parameters can also be
applied, such as -v, -c, -A, -n, to get extra informa�on about that host.
8|Page
Comprehensive Guide to TCPDump
tcpdump -i eth0 -c 3 -X
9|Page
Comprehensive Guide to TCPDump
10 | P a g e
Comprehensive Guide to TCPDump
Packet filter
Another feature that is provided by tcpdump is packet filtering. This helps us to see the packet
results on a par�cular data packet in our scan. If we want to apply this filter in our scan we just need
to add the desired packet in our scan.
11 | P a g e
Comprehensive Guide to TCPDump
Packet directions
To the direc�on of data flow in our traffic, we can use the following parameter :
To see all the requests which we are sending to the server following (- Q out) parameter can be
used:
12 | P a g e
Comprehensive Guide to TCPDump
the system captures in a live scan. We also compared packet count to live number count to see its
accuracy.
tcpdump -r file.pcap
Snapshot length
Snapshot length/snaplen is referred to as the bytes of data from each packet. It is by default set on
the 262144 bytes. With tcpdump, we can adjust this limit to our requirement to beter understand it
in each snap length. -s parameter helps us to do it just apply -s parameter along with the length of
bytes.
13 | P a g e
Comprehensive Guide to TCPDump
Dump mode
Dump mode has mul�ple parameters like -d, -dd, -ddd. To begin with, the -d parameter dumps the
compiled matching code into a readable output. Furthermore, the -dd parameter dumps the code as
a C program fragment. Finally, the -ddd parameter dumps the code as a decimal number with a
count. To see these results in our scan, we need to follow the steps below:
tcpdump -i eth0 -c 5 -d
tcpdump -i eth0 -c 5 -dd
tcpdump -i eth0 -c 5 -ddd
14 | P a g e
Comprehensive Guide to TCPDump
tcpdump -i eth0 -c 2 -x
tcpdump -i eth0 -c 2 -xx
15 | P a g e
Comprehensive Guide to TCPDump
If we want this informa�on provided by -x parameter along with their ASCII code then we need to
use -X parameter and if we want the results of -xx parameter along with their ASCII codes then we
need to use -XX parameter. To use these parameters in our Data analysis, use the following
commands:
tcpdump -i eth0 -c 2 -X
tcpdump -i eth0 -c 2 -XX
16 | P a g e
Comprehensive Guide to TCPDump
User scan
If we are running tcpdump as root then before opening any saved file for analysis, you will observe
that it changes the user ID to the user and the group IDs to the primary group of its users.
Tcpdump provides us -Z parameter, through which we can overcome this issue but we need to
provide the user name like the following:
17 | P a g e
Comprehensive Guide to TCPDump
There is one more way to do this, i.e. with the help of –relinquish-privileges= parameter.
Timestamp Precision
Timestamp is the �me registered to a file, log or no�fica�on that can record when data is added,
removed, modified or transmited. In tcpdump, there are plenty of parameters that move around
�mestamp values like -t, -t, -tt, -tt, -ttt, where each parameter has its unique working and
efficiency.
tcpdump -i eth0 -c 2
tcpdump -i eth0 -c 2 -t
tcpdump -i eth0 -c 2 -tt
tcpdump -i eth0 -c 2 -ttt
tcpdump -i eth0 -c 2 -tttt
tcpdump -i eth0 -c 2 -ttttt
18 | P a g e
Comprehensive Guide to TCPDump
Force Packets
In tcpdump, we can force our scan of data traffic to show some par�cular protocol. When using the
force packet feature, defined by selected any “expression” we can interpret specified type. With the
help of the -T parameter, we can force data packets to show only the desired protocol results.
The basic syntax of all force packets will remain the same as other parameters -T followed by the
desired protocol. The following are some protocols of force packets:
19 | P a g e
Comprehensive Guide to TCPDump
RADIUS
RADIUS stands for Remote Authen�ca�on Dial-in User Service. It is a network protocol, which has its
unique port number 1812, provides centralized authen�ca�on along with authoriza�on and
accoun�ng management for its users who connect and use the network services. We can use this
protocol for our scan.
AODV
Adhoc On-demand Distance Vector protocol is a rou�ng protocol for mobile ad hoc networks and
other wireless networks. It is a rou�ng protocol that is used for a low power and low data rate for
wireless networks. To see these results in our scan follow.
RPC
A remote procedure call, it is a protocol that one program can use to request service from a program
located in another computer on a network without having to understand the network details. A
procedure call is also known as a func�on call. For ge�ng this protocol in our scan use the following
command:
20 | P a g e
Comprehensive Guide to TCPDump
CNFP
Cisco NetFlow protocol, it is a network protocol developed by cisco for the collec�on and monitoring
of network traffic, flow data generated by NetFlow enabled routers and switches. It exports traffic
sta�s�cs as they record which are then collected by its collector. To get these detailed scans follow
this command.
LMP
Link Management Protocol, it is designed to ease the configura�on and management of op�cal
network devices. To understand the working of LMP in our network, we need to apply this protocol
in our scan.
21 | P a g e
Comprehensive Guide to TCPDump
PGM
Pragma�c general mul�cast, it is a reliable mul�cast network transport protocol. It can provide a
reliable sequence of packets to mul�ple recipients simultaneously. Which further makes it suitable
for a mul�-receiver file-transfer. To understand its working in our data traffic follows.
RTP
Real-�me applica�on protocol can code mul�media data streams such as audio or video. It divides
them into packets and transmits them over an IP network. To analyze this protocol in our traffic, we
need to follow this command:
RTCP
Real-�me applica�on control protocol. This protocol has all the capabili�es of RTP along with
addi�onal control. With the help of this feature, we can control its working in our network
environment. To understand the working of this protocol in our data traffic, apply these commands.
22 | P a g e
Comprehensive Guide to TCPDump
SNMP
Simple Network Management Protocol is an Internet standard protocol for collec�ng and organizing
informa�on about managed devices on IP networks for modifying that informa�on to change device
behavior. To see its working in our traffic, apply this command.
TFTP
Trivial File Transfer Protocol is a simple lockstep File transfer protocol that allows its client to get a file
from a remote host. It is used in the early stages of node boo�ng from a local area network. To
understand its traffic, follow this command.
VAT
Visual Audio Tool is developed by Van Jacobson and Steven McCanne. It is an electronic media
processing for both sound and visual components. To understand its data packets in our traffic we
need to apply these commands.
23 | P a g e
Comprehensive Guide to TCPDump
WB
The program allows its users to draw and type the messages onto the canvas in a distributed
whiteboard, synchronizing this to every other user on the same overlay network for the applica�ons.
New users also receive everything that other users have already stored on the whiteboard when they
connect. To understand its data packets, follow this command.
VXLAN
Virtual Xtensible Local Area Network is a network virtualiza�on tech that atempts to address the
scalability problems associated with a large cloud compu�ng area. It is a proposed Layer 3
encapsula�on protocol that will make it easier for network engineers to scale-out cloud compu�ng.
To understand its data traffic follows these commands.
24 | P a g e
Comprehensive Guide to TCPDump
These protocols use the forced packets parameter to get the fixed desired data traffic from the scan.
Promiscuous Mode
In computer networks, an interface controller uses promiscuous mode to cause tcpdump to pass on
the traffic it receives to the CPU rather than passing it to the promiscuous mode, and it normally
facilitates packet sniffing that can take place on a part of the LAN or router.
A�er enabling the promiscuous mode in our network, let us capture some packets with the help of
this by applying these commands.
tcpdump -i eth0 -c 10
25 | P a g e
Comprehensive Guide to TCPDump
No Promiscuous Mode
In the previous parameter, we learned about the promiscuous mode, which allows a network
interface card to pass all frames it receives to the OS for processing, unlike the tradi�onal opera�on,
where it only passes frames des�ned for the NIC’s MAC address or a broadcast address to the OS.
Generally, users u�lize promiscuous mode to “sniff” all traffic on the wire. But if we want to switch to
mul�cast mode instead of promiscuous mode. Then we need to use –no-promiscuous-mode
parameter, which helps us to which the mode without changing the network se�ngs.
Version Information
Let's begin with one of the simplest commands so that we can understand and relate all the
prac�cals during the ar�cle. We can use this parameter to print the tcpdump, libpcap and OpenSSL
string.
tcpdump –version
26 | P a g e
Comprehensive Guide to TCPDump
Quick Mode
Arguably if the network is very quiet, performing any opera�on during that �me will take more �me
than usual. The person who developed tcpdump thought of this conundrum and gave us the way to
speed up the process by using the “-q” parameter. It will print less informa�on about protocols and
data packets to save �me.
tcpdump -i eth0 -c 5
tcpdump -i eth0 -c 5 -q
Verbose Mode
The verbose mode is famous to provide extra informa�on regarding opera�ons. in TCPDump,
verbose mode provides such the informa�on too. For instance, �me to live, iden�fica�on, total
length. It can also enable addi�onal packet integrity checks such as verifying the IP and ICMP header
checksum values.`
TCPDump provides us with plenty of parameters that we move around this mode like -v, -vv, -vvv,
where each parameter has its unique efficiency.
tcpdump -i eth0 -c 2
tcpdump -i eth0 -c 2 -v
tcpdump -i eth0 -c 2 -vv
tcpdump -i eth0 -c 2 -vvv
27 | P a g e
Comprehensive Guide to TCPDump
HTTP Requests
As we all know, HTTP Requests is an informa�on message from the client to a server over the
hypertext transfer protocol (HTTP). It has various methods to deliver this informa�on. These
methods are case-sensi�ve and always men�oned in the UPPERCASE. Through tcpdump, we can
capture these requests to analyze the traffic sent over the said protocol traffic.
The methods which we can capture through tcpdump are the following:
• GET- This method is used to retrieve the informa�on from the given server using a given URL.
Requests using GET should only retrieve data and have no other effect on it. We can also
capture this request with the help of tcpdump.
28 | P a g e
Comprehensive Guide to TCPDump
• POST- This request is used to send data to the server. Like customer informa�on, file upload,
etc. using HTML forms. Traffic over this protocol can analyzed using the following command :
29 | P a g e
Comprehensive Guide to TCPDump
it would create a connec�on to port 80 of the host and send the request. These requests can
be captured using the following commands:
User Agent
With TCPDump, you can also see which traffic is generated from which applica�on. We can also find
the user agents in our data traffic by using the following command :
Port Range
Some ordinary port filters help us to analyze the traffic on a par�cular port. But in tcpdump, we give
our scan a range of ports through which it can monitor the des�na�on of TCP/UDP or other port-
based network protocols.
30 | P a g e
Comprehensive Guide to TCPDump
Destination
To check the flow of data in network traffic towards a par�cular des�na�on, use the following
command for this:
Source
To check the data traffic coming from a par�cular source, we can follow the command given below :
Network
To find the packets going to or from in a par�cular network, we can use the following func�on to
analyze this traffic:
31 | P a g e
Comprehensive Guide to TCPDump
TCP Packets
TCP packet is the format consists of the fields such as source port and des�na�on port field. Through
these fields, we can iden�fy the endpoints of the connec�ons and can also capture these TCP
packets in its various flag format. i.e. SYN, RST and ACK.
• SYN- The SYN flag synchronizes sequence numbers to ini�ate a TCP connec�on. We can
capture this packet from traffic with the help of tcpdump.
• RST- The system knows the RST flag as the reset flag. If a packet is sent to a par�cular host
that expects it, the receiver sends this flag to the sender. The system uses the RST flag to re-
establish a TCP end-to-end connec�on. We can capture this flag from our data traffic with
the help of tcpdump.
32 | P a g e
Comprehensive Guide to TCPDump
• ACK- The Acknowledgement flag refers to the ACK flag. We use this flag to acknowledge that
our data packet has been successfully received. We can capture these flags with tcpdump to
study our data traffic.
Tcpdump to Wireshark
The only difference between the Wireshark and TCPDump is that Wireshark is GUI while tcpdump is
a command-line tool. But with the help of a few sources, we use a command on tcpdump and view
our data traffic results in Wireshark which, we find is the best way to analyze our traffic. This can be
done using the following command :
A�er running this command, it will immediately open the Wireshark and will ask a few ques�ons
about our scan. Press OK to move further.
33 | P a g e
Comprehensive Guide to TCPDump
A�er this, it will ask you which network interface we want to capture the data packets. In our case it
will be eth0, so we are selec�ng that network interface.
34 | P a g e
Comprehensive Guide to TCPDump
A�er comple�ng all the formali�es our live data capture screen will appear with our captured data
packets.
By following these steps, we can run a command for tcpdump and capture its results in Wireshark.
35 | P a g e
Comprehensive Guide to TCPDump
Conclusion
In conclusion, Tcpdump is a powerful command-line tool for network packet analysis, allowing users
to troubleshoot network issues and analyze security tools. With its various parameters and op�ons,
Tcpdump provides a wide range of features, including capturing traffic on specific interfaces, filtering
packets, and prin�ng packet contents in ASCII. Addi�onally, Tcpdump can be used to capture HTTP
requests, analyze TCP packets, and even export data to Wireshark for further analysis. Overall,
Tcpdump is a valuable tool for network administrators and security professionals, providing detailed
insight into network traffic and helping to iden�fy and resolve issues.
36 | P a g e
JOIN OUR
TRAINING PROGRAMS
H ERE
CLICK BEGINNER
Network Pentest
Wireless Pentest
ADVANCED
Advanced CTF
Android Pentest Metasploit
EXPERT
Privilege Escalation
APT’s - MITRE Attack Tactics
Windows
Active Directory Attack
Linux
MSSQL Security Assessment
www.ignitetechnologies.in