Welcome!

Linux Containers Authors: Plutora Blog, SmartBear Blog, Cloud Best Practices Network, Toddy Mladenov, Mehdi Daoudi

Blog Feed Post

The Ins and Outputs of TCPDUMP

The Ins and Outputs of TCPDUMP
By: Nicholas Beris

As a Network Engineer, I spend a lot of time on, in, and around the terminal. Many of the systems that I work with are remote and taking the time to download a packet capture in the middle of an emergency call and waiting for Wireshark to get the necessary details is just too much of a hassle. (Plus, it makes me feel like I’m an operator in the Matrix with the scrolling code.) Now don’t get me wrong, Wireshark is a great tool and has many uses, but a lot of times it’s just not practical. Besides, are you really going to download the packets from a snort alert and pump them into Wireshark? This my friends is where Tcpdump comes into play and shines.

What is Tcpdump?

Tcpdump is the most commonly and widely used tool to analyze and intercept various types of Ethernet traffic. A network administrator, security auditor, or anyone else dealing in the end to end connectivity of their infrastructure will find this tool pre-installed most of time. Many times when working with third party vendors, sometimes you have to prove that its isn’t your network, firewall, or NAT causing the issue with the application and its just poor coding on their end.

First we will look at some simple traffic and in this case will be an apt install of 2 packages.

The following is the command that I used to to ‘capture’ or record this network traffic.

tcpdump -s 1500 -Avvvn -i wlan0 -w package.pcap host 208.100.4.53

Command Breakdown

tcpdump: Name of the application.

-s 1500: Snap length is how much of the packet to get. The default is 65535 bytes. Setting the snap length to 0 sets it to it’s default. (According to the man page for my version)

-A: Prints the packet in ASCII. Useful for plain text traffic and application troubleshooting.

-vvv: Very very verbose – Prints more information about the packet such as TTL and a lot more

-n: Won’t convert address to human names

-i: Which interface to listen and capture on

-w: Write the packet to said file name

host: The remote peer

Now that we have successfully written the packets to a file we can now analyze the traffic. In any type of troubleshooting situation you have to start at square one. Lets open this file and pipe it into something useful instead of filling the scroll back buffer and missing the first essential connection details.

Since the TCP/IP stack has retransmission as part of the protocol if the first few packets fail then the rest of the connection is doomed.

tcpdump -s 1500 -Avvvn -r package.pcap | less

The -r switch reads the file instead of writing it. Since we already filtered out any other traffic with the host argument we don’t need to be as detailed in our command. The | (pipe) means direct the standard output (console screen) to another application, in the case “less”. This give us the ability to scroll through the whole .pcap file.

The first the 3 packets represent the 3 way-handshake which every TCP connection must go through to set up the connection.

12:26:58.632628 IP (tos 0x0, ttl 64, id 20547, offset 0, flags [DF]
, proto TCP (6), length 60)
10.0.1.38.59181 > 208.100.4.53.80: Flags [S], cksum 0xb5e9 (cor
rect), seq 1526109302, win 5840, options [mss 1460,sackOK,TS val 68
00437 ecr 0,nop,wscale 7], length 0
E.. .
..&.d.5.-.PZ..v...................
.g.5........

12:26:58.663268 IP (tos 0x0, ttl 51, id 0, offset 0, flags [DF], pr
oto TCP (6), length 60)
208.100.4.53.80 > 10.0.1.38.59181: Flags [S.], cksum 0x7075 (co
rrect), seq 2554095472, ack 1526109303, win 5792, options [mss 1460
,sackOK,TS val 2580458519 ecr 6800437,nop,wscale 7], length 0
E..<..@.3.g..d.5
..&.P.-. .....g.5....

12:26:58.663321 IP (tos 0x0, ttl 64, id 20548, offset 0, flags [DF]
, proto TCP (6), length 52)
10.0.1.38.59181 > 208.100.4.53.80: Flags [.], cksum 0xb5ab (cor
rect), ack 1, win 46, options [nop,nop,TS val 6800445 ecr 258045851
9], length 0
E..4PD@.@.
.
..&.d.5.-.PZ..w. .g.=....

And now my host is sending its HTTP GET request to the remote HTTP server. Remember when I said in the beginning that I was going to install two packages? Well you can see two GET requests made to the server in the output below. Can you tell what I was installing?

12:26:58.663524 IP (tos 0x0, ttl 64, id 20549, offset 0, flags [DF]
, proto TCP (6), length 435)
10.0.1.38.59181 > 208.100.4.53.80: Flags [P.], cksum 0x0d68 (correct), seq 1:384, ack 1, win 46, options [nop,nop,TS val 6800445 ecr 2580458519], length 383
E...PE@.@. A
..&.d.5.-.PZ..w. .g.=....GET /debian/pool/main/a/awn-extras-applets/awn-applets-c-extras_0.4.0-3_amd64.deb HTTP/1.1
Host: mirror.steadfast.net
Connection: keep-alive
User-Agent: Debian APT-HTTP/1.3 (0.8.10.3)

GET /debian/pool/main/a/awn-extras-applets/awn-applets-python-extras_0.4.0-3_all.deb HTTP/1.1
Host: mirror.steadfast.net
Connection: keep-alive
User-Agent: Debian APT-HTTP/1.3 (0.8.10.3)

How do we know that the server even received our request? TCP will always send an ACK, or in the case of a corrupt packet, a reset (RST) the last packet. As you can see in the following output there is the acknowledge of the GET request and then the server’s HTTP 200 OK response.

12:26:58.693420 IP (tos 0x0, ttl 51, id 52036, offset 0, flags [DF]
, proto TCP (6), length 52)
208.100.4.53.80 > 10.0.1.38.59181: Flags [.], cksum 0xb406 (cor
rect), ack 384, win 54, options [nop,nop,TS val 2580458549 ecr 6800
445], length 0
E..4.D@.3....d.5
..&.P.-. ...5.g.=
12:26:58.750220 IP (tos 0x0, ttl 51, id 52037, offset 0, flags [DF]
, proto TCP (6), length 1500)
208.100.4.53.80 > 10.0.1.38.59181: Flags [.], seq 1:1449, ack 3
84, win 54, options [nop,nop,TS val 2580458605 ecr 6800445], length
1448
E....E@.3....d.5
..&.P.-. ...m.g.=HTTP/1.1 200 OK
Date: Sun, 18 Mar 2012 16:27:03 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 19 Jul 2010 07:02:03 GMT
ETag: "2ae23c67-1e17e-48bb8254eb0c0"
Accept-Ranges: bytes
Content-Length: 123262
Connection: close
Content-Type: text/plain; charset=UTF-8

And as they say “the rest is history”. Well, technically the rest is of the TCP stream for my packages, but if you are troubleshooting further than the initial connections you are going to need to roll up your sleeves and have a firm grasp of the TCP protocol. If you’re not as strong at reading packet captures or understanding how the whole TCP/IP stacks work, then this is the best way to learn with simple, easy to define and read traffic. In my next entry I plan on going more in depth with situational examples.

Read the original blog entry...

More Stories By Hurricane Labs

Christina O’Neill has been working in the information security field for 3 years. She is a board member for the Northern Ohio InfraGard Members Alliance and a committee member for the Information Security Summit, a conference held once a year for information security and physical security professionals.

@ThingsExpo Stories
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...
There are 66 million network cameras capturing terabytes of data. How did factories in Japan improve physical security at the facilities and improve employee productivity? Edge Computing reduces possible kilobytes of data collected per second to only a few kilobytes of data transmitted to the public cloud every day. Data is aggregated and analyzed close to sensors so only intelligent results need to be transmitted to the cloud. Non-essential data is recycled to optimize storage.
"I think that everyone recognizes that for IoT to really realize its full potential and value that it is about creating ecosystems and marketplaces and that no single vendor is able to support what is required," explained Esmeralda Swartz, VP, Marketing Enterprise and Cloud at Ericsson, in this SYS-CON.tv interview at @ThingsExpo, held June 7-9, 2016, at the Javits Center in New York City, NY.
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
SYS-CON Events announced today that IoT Now has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. IoT Now explores the evolving opportunities and challenges facing CSPs, and it passes on some lessons learned from those who have taken the first steps in next-gen IoT services.
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex softw...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
What sort of WebRTC based applications can we expect to see over the next year and beyond? One way to predict development trends is to see what sorts of applications startups are building. In his session at @ThingsExpo, Arin Sime, founder of WebRTC.ventures, will discuss the current and likely future trends in WebRTC application development based on real requests for custom applications from real customers, as well as other public sources of information,
As businesses adopt functionalities in cloud computing, it’s imperative that IT operations consistently ensure cloud systems work correctly – all of the time, and to their best capabilities. In his session at @BigDataExpo, Bernd Harzog, CEO and founder of OpsDataStore, will present an industry answer to the common question, “Are you running IT operations as efficiently and as cost effectively as you need to?” He will expound on the industry issues he frequently came up against as an analyst, and...
Keeping pace with advancements in software delivery processes and tooling is taxing even for the most proficient organizations. Point tools, platforms, open source and the increasing adoption of private and public cloud services requires strong engineering rigor - all in the face of developer demands to use the tools of choice. As Agile has settled in as a mainstream practice, now DevOps has emerged as the next wave to improve software delivery speed and output. To make DevOps work, organization...
Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, represent...
My team embarked on building a data lake for our sales and marketing data to better understand customer journeys. This required building a hybrid data pipeline to connect our cloud CRM with the new Hadoop Data Lake. One challenge is that IT was not in a position to provide support until we proved value and marketing did not have the experience, so we embarked on the journey ourselves within the product marketing team for our line of business within Progress. In his session at @BigDataExpo, Sum...
Things are changing so quickly in IoT that it would take a wizard to predict which ecosystem will gain the most traction. In order for IoT to reach its potential, smart devices must be able to work together. Today, there are a slew of interoperability standards being promoted by big names to make this happen: HomeKit, Brillo and Alljoyn. In his session at @ThingsExpo, Adam Justice, vice president and general manager of Grid Connect, will review what happens when smart devices don’t work togethe...
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From ...
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, will posit that disruption is inevitable for c...
The explosion of new web/cloud/IoT-based applications and the data they generate are transforming our world right before our eyes. In this rush to adopt these new technologies, organizations are often ignoring fundamental questions concerning who owns the data and failing to ask for permission to conduct invasive surveillance of their customers. Organizations that are not transparent about how their systems gather data telemetry without offering shared data ownership risk product rejection, regu...
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buyers...
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.