tcpdump

sec/ex-2_iptables.adoc

@@ -138,21 +138,120 @@ It’s All About the Combinations
 Being able to do these various things individually is powerful, but the real magic of tcpdump comes from the ability to combine options in creative ways in order to isolate exactly what you’re looking for. There are three ways to do combinations, and if you’ve studied programming at all they’ll be pretty familiar to you.
 
 - AND
+
     **and** or **&&**
+
 - OR
+
     **or** or **||**
+
 - EXCEPT
+
     **not** or **!**
 ====
 
 
+=== From specific IP and destined for a specific Port
+
+Let’s find all traffic from 10.5.2.3 going to any host on port 3389.
+
+[source,bash]
+----
+tcpdump -nnvvS src 10.5.2.3 and dst port 3389
+----
+
+
+=== From One Network to Another
 
+Let’s look for all traffic coming from 192.168.x.x and going to the 10.x or 172.16.x.x networks, and we’re showing hex output with no hostname resolution and one level of extra verbosity.
+
+[source,bash]
+----
+tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16
+----
 
 
+=== Isolate TCP Flags
 
+You can also use filters to isolate packets with specific TCP flags set.
 
+==== Isolate TCP RST flags.
 
+The filters below find these various packets because tcp[13] looks at offset 13 in the TCP header, the number represents the location within the byte, and the !=0 means that the flag in question is set to 1, i.e. it’s on.
 
+[source,bash]
+----
+tcpdump 'tcp[13] & 4!=0'
+tcpdump 'tcp[tcpflags] == tcp-rst'
+----
+
+==== Isolate TCP SYN flags.
+
+[source,bash]
+----
+tcpdump 'tcp[13] & 2!=0'
+tcpdump 'tcp[tcpflags] == tcp-syn'
+----
+
+==== Isolate packets that have both the SYN and ACK flags set.
+
+tcpdump 'tcp[13]=18'
+
+Only the PSH, RST, SYN, and FIN flags are displayed in tcpdump‘s flag field output. URGs and ACKs are displayed, but they are shown elsewhere in the output rather than in the flags field.
+
+==== Isolate TCP URG flags.
+
+[source,bash]
+----
+tcpdump 'tcp[13] & 32!=0'
+tcpdump 'tcp[tcpflags] == tcp-urg'
+----
+
+==== Isolate TCP ACK flags.
+
+[source,bash]
+----
+tcpdump 'tcp[13] & 16!=0'
+tcpdump 'tcp[tcpflags] == tcp-ack'
+----
+
+==== Isolate TCP PSH flags.
+
+[source,bash]
+----
+tcpdump 'tcp[13] & 8!=0'
+tcpdump 'tcp[tcpflags] == tcp-psh'
+----
+
+==== Isolate TCP FIN flags.
+
+[source,bash]
+----
+tcpdump 'tcp[13] & 1!=0'
+tcpdump 'tcp[tcpflags] == tcp-fin'
+----
+
+
+=== Find Traffic With Evil Bit
+
+There’s a bit in the IP header that never gets set by legitimate applications, which we call the “Evil Bit”. Here’s a fun filter to find packets where it’s been toggled.
+
+[source,bash]
+----
+tcpdump 'ip[6] & 128 != 0'
+----
+
+=== Summary
+
+Here are the takeaways.
+
+.Reminder
+[NOTE]
+====
+- **tcpdump** is a valuable tool for anyone looking to get into networking or **information security**.
+- The raw way it interfaces with traffic, combined with the precision it offers in inspecting packets make **it the best possible tool** for learning TCP/IP.
+- Protocol Analyzers like **Wireshark** are great, but if you want to truly master **packet-fu**, you must become one with tcpdump 
+====
 
 
 [appendix]
@@ -161,6 +260,7 @@ Being able to do these various things individually is powerful, but the real mag
 
 This exercise will show you how to isolate traffic in various ways—from IP, to port, to protocol, to application-layer traffic—to make sure you find exactly what you need as quickly as possible.
 
+https://danielmiessler.com/study/tcpdump[Origin]