Tcpdump

Cross-compilation TCPDUMP Prepare Confirm target platform: ARM-Linux, MIPS-Linux Confirm the target compile chain: *** - GCC 1. Download TCPDUMP source code and libpcap source code tcpdump libpcap 2. Unzip tar -zxvf tcpdump-4.99.1.tar.gztar -zxvf libpcap-1.10.1.tar.gz 3. Compile LibPCAP cd libpcap-1.10.1./configure --prefix = (directory path) / tcpdump --host = arm-linux --target = arm-linux cc = *** - gcc --with-pcap = Linuxmake make install (-Prefix Specifies the target file generation path (Target storage path in Makefile), - Host, -target is written to the target platform, for example: arm-liux or mips-linux, CC for cross-compiled chains, you need to use you Your own compile chain, then compile Makefile (directly Make), last make install 4. Compile TCPDUMP cd tcpdump-1.10.1 ./configure --prefix = (directory path) / tcpdump --host = arm-linux --target = arm-linux cc = *** - GCCmake make install (-Prefix Specifies the target file generation path (Target storage path in Makefile), - Host, -target is written to the target platform, for example: arm-liux or mips-linux, CC for cross-compiled chains, you need to use you Your own compile chain, then compile Makefile (directly Make), last make install 5. TCPDump executable under the target folder

IP don't fragment flag is marked with a trailing (DF). Timestamps By default, all output lines are preceded by a timestamp. The timestamp is the current clock time in the form hh:mm:ss.frac and is as accurate as the kernel's clock. The timestamp reflects the time the kernel first saw the packet. No attempt is made to account for the time lag between when the Ethernet interface removed the packet from the wire and when the kernel serviced the 'new packet' interrupt. Examples tcpdump host sundown Prints all packets arriving at or departing from host sundown. tcpdump host helios and \( hot or ace \) Prints traffic between host helios and either hot or ace. tcpdump ip host ace and not helios Prints all IP packets between ace and any host except helios. tcpdump 'gateway snup and (port ftp or ftp-data)' Prints all ftp traffic through Internet gateway snup. Note that the expression is quoted to prevent the shell from interpreting the parentheses. tcpdump ip and not net localnet Prints traffic neither sourced from nor destined for local hosts. If you gateway to another network, this stuff should never make it onto your local network. tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet' Prints the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host. tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)>2)) != 0)' Prints all IPv4 HTTP packets to and from port 80. tcpdump prints only packets that contain data; not, for example, SYN and FIN packets and ACK-only packets. tcpdump 'gateway snup and ip[2:2] > 576' Prints IP packets longer than 576 bytes sent through gateway snup. tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224' Prints IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast. tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply' Prints all ICMP packets that are not echo requests/replies (i.e., not ping packets). ip — Display and manipulate information about routing, devices, policy routing and tunnels.stty — Set options for your terminal display.

Step by Step to install TCPdump (Capture Packets) on Ubuntu 20.04 LTS TCPdump is a free & open-source packet analyzer tool & command-line utility. It is used for capturing the packets & inspect the network traffic going to & from our system. It is basic used for troubleshooting network issues & security testing. We can capture Non-TCP traffic such as UDP, ARP or ICMP.There are some steps to install TCPdump on system:Step 1: Update the System.apt-get updateStep 2: Install TCPdump on system.apt-get install tcpdumpCheck the TCPdump version.tcpdump --versionHere is the command output.Step 3: TCPdump syntax & Examples.tcpdump [options] [expression]To capture all packets.tcpdumpHere is the command output.To capture packets from a specific interface.tcpdump -i eth0To capture only 10 packets.tcpdump -c 10Here is the command output.To list all the available interface.tcpdump -DHere is the command output.To capture packets from any interface.tcpdump -i anyTo use -n option to disable the translation.tcpdump -nHere is the command output.To store capture network interface packets into a file.tcpdump -n -i any > file.outTo display the capture packets while saving to a file .tcpdump -n -l | tee file.outTo capture packect from a specific port number.tcpdump -n port 22Here is the command output.To capture packets from a source ip.tcpdump -n src host ip-addressTo capture the traffic coming from any source to port 80.tcpdump -n dst port 80To capture all HTTP traffic coming from a source IP address.tcpdump -n src ip-address and tcp port 80To capture traffic in a range of ports.tcpdump -n portrange 110-150To capture packets only packets related to 10.10.0.0/16.tcpdump -n net 10.10To show each packet in ASCII.tcpdump -n -ATo show each packets in HEX and ASCII.tcpdump -n -X