Welcome!

Linux Containers Authors: Pat Romanski, Lori MacVittie, Liz McMillan, Flint Brenton, Miska Kaipiainen

Blog Feed Post

The Ins and Outputs of TCPDUMP

The Ins and Outputs of TCPDUMP
By: Nicholas Beris

As a Network Engineer, I spend a lot of time on, in, and around the terminal. Many of the systems that I work with are remote and taking the time to download a packet capture in the middle of an emergency call and waiting for Wireshark to get the necessary details is just too much of a hassle. (Plus, it makes me feel like I’m an operator in the Matrix with the scrolling code.) Now don’t get me wrong, Wireshark is a great tool and has many uses, but a lot of times it’s just not practical. Besides, are you really going to download the packets from a snort alert and pump them into Wireshark? This my friends is where Tcpdump comes into play and shines.

What is Tcpdump?

Tcpdump is the most commonly and widely used tool to analyze and intercept various types of Ethernet traffic. A network administrator, security auditor, or anyone else dealing in the end to end connectivity of their infrastructure will find this tool pre-installed most of time. Many times when working with third party vendors, sometimes you have to prove that its isn’t your network, firewall, or NAT causing the issue with the application and its just poor coding on their end.

First we will look at some simple traffic and in this case will be an apt install of 2 packages.

The following is the command that I used to to ‘capture’ or record this network traffic.

tcpdump -s 1500 -Avvvn -i wlan0 -w package.pcap host 208.100.4.53

Command Breakdown

tcpdump: Name of the application.

-s 1500: Snap length is how much of the packet to get. The default is 65535 bytes. Setting the snap length to 0 sets it to it’s default. (According to the man page for my version)

-A: Prints the packet in ASCII. Useful for plain text traffic and application troubleshooting.

-vvv: Very very verbose – Prints more information about the packet such as TTL and a lot more

-n: Won’t convert address to human names

-i: Which interface to listen and capture on

-w: Write the packet to said file name

host: The remote peer

Now that we have successfully written the packets to a file we can now analyze the traffic. In any type of troubleshooting situation you have to start at square one. Lets open this file and pipe it into something useful instead of filling the scroll back buffer and missing the first essential connection details.

Since the TCP/IP stack has retransmission as part of the protocol if the first few packets fail then the rest of the connection is doomed.

tcpdump -s 1500 -Avvvn -r package.pcap | less

The -r switch reads the file instead of writing it. Since we already filtered out any other traffic with the host argument we don’t need to be as detailed in our command. The | (pipe) means direct the standard output (console screen) to another application, in the case “less”. This give us the ability to scroll through the whole .pcap file.

The first the 3 packets represent the 3 way-handshake which every TCP connection must go through to set up the connection.

12:26:58.632628 IP (tos 0x0, ttl 64, id 20547, offset 0, flags [DF]
, proto TCP (6), length 60)
10.0.1.38.59181 > 208.100.4.53.80: Flags [S], cksum 0xb5e9 (cor
rect), seq 1526109302, win 5840, options [mss 1460,sackOK,TS val 68
00437 ecr 0,nop,wscale 7], length 0
E.. .
..&.d.5.-.PZ..v...................
.g.5........

12:26:58.663268 IP (tos 0x0, ttl 51, id 0, offset 0, flags [DF], pr
oto TCP (6), length 60)
208.100.4.53.80 > 10.0.1.38.59181: Flags [S.], cksum 0x7075 (co
rrect), seq 2554095472, ack 1526109303, win 5792, options [mss 1460
,sackOK,TS val 2580458519 ecr 6800437,nop,wscale 7], length 0
E..<..@.3.g..d.5
..&.P.-. .....g.5....

12:26:58.663321 IP (tos 0x0, ttl 64, id 20548, offset 0, flags [DF]
, proto TCP (6), length 52)
10.0.1.38.59181 > 208.100.4.53.80: Flags [.], cksum 0xb5ab (cor
rect), ack 1, win 46, options [nop,nop,TS val 6800445 ecr 258045851
9], length 0
E..4PD@.@.
.
..&.d.5.-.PZ..w. .g.=....

And now my host is sending its HTTP GET request to the remote HTTP server. Remember when I said in the beginning that I was going to install two packages? Well you can see two GET requests made to the server in the output below. Can you tell what I was installing?

12:26:58.663524 IP (tos 0x0, ttl 64, id 20549, offset 0, flags [DF]
, proto TCP (6), length 435)
10.0.1.38.59181 > 208.100.4.53.80: Flags [P.], cksum 0x0d68 (correct), seq 1:384, ack 1, win 46, options [nop,nop,TS val 6800445 ecr 2580458519], length 383
E...PE@.@. A
..&.d.5.-.PZ..w. .g.=....GET /debian/pool/main/a/awn-extras-applets/awn-applets-c-extras_0.4.0-3_amd64.deb HTTP/1.1
Host: mirror.steadfast.net
Connection: keep-alive
User-Agent: Debian APT-HTTP/1.3 (0.8.10.3)

GET /debian/pool/main/a/awn-extras-applets/awn-applets-python-extras_0.4.0-3_all.deb HTTP/1.1
Host: mirror.steadfast.net
Connection: keep-alive
User-Agent: Debian APT-HTTP/1.3 (0.8.10.3)

How do we know that the server even received our request? TCP will always send an ACK, or in the case of a corrupt packet, a reset (RST) the last packet. As you can see in the following output there is the acknowledge of the GET request and then the server’s HTTP 200 OK response.

12:26:58.693420 IP (tos 0x0, ttl 51, id 52036, offset 0, flags [DF]
, proto TCP (6), length 52)
208.100.4.53.80 > 10.0.1.38.59181: Flags [.], cksum 0xb406 (cor
rect), ack 384, win 54, options [nop,nop,TS val 2580458549 ecr 6800
445], length 0
E..4.D@.3....d.5
..&.P.-. ...5.g.=
12:26:58.750220 IP (tos 0x0, ttl 51, id 52037, offset 0, flags [DF]
, proto TCP (6), length 1500)
208.100.4.53.80 > 10.0.1.38.59181: Flags [.], seq 1:1449, ack 3
84, win 54, options [nop,nop,TS val 2580458605 ecr 6800445], length
1448
E....E@.3....d.5
..&.P.-. ...m.g.=HTTP/1.1 200 OK
Date: Sun, 18 Mar 2012 16:27:03 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 19 Jul 2010 07:02:03 GMT
ETag: "2ae23c67-1e17e-48bb8254eb0c0"
Accept-Ranges: bytes
Content-Length: 123262
Connection: close
Content-Type: text/plain; charset=UTF-8

And as they say “the rest is history”. Well, technically the rest is of the TCP stream for my packages, but if you are troubleshooting further than the initial connections you are going to need to roll up your sleeves and have a firm grasp of the TCP protocol. If you’re not as strong at reading packet captures or understanding how the whole TCP/IP stacks work, then this is the best way to learn with simple, easy to define and read traffic. In my next entry I plan on going more in depth with situational examples.

Read the original blog entry...

More Stories By Hurricane Labs

Christina O’Neill has been working in the information security field for 3 years. She is a board member for the Northern Ohio InfraGard Members Alliance and a committee member for the Information Security Summit, a conference held once a year for information security and physical security professionals.

@ThingsExpo Stories
As ridesharing competitors and enhanced services increase, notable changes are occurring in the transportation model. Despite the cost-effective means and flexibility of ridesharing, both drivers and users will need to be aware of the connected environment and how it will impact the ridesharing experience. In his session at @ThingsExpo, Timothy Evavold, Executive Director Automotive at Covisint, will discuss key challenges and solutions to powering a ride sharing and/or multimodal model in the a...
Is your aging software platform suffering from technical debt while the market changes and demands new solutions at a faster clip? It’s a bold move, but you might consider walking away from your core platform and starting fresh. ReadyTalk did exactly that. In his General Session at 19th Cloud Expo, Michael Chambliss, Head of Engineering at ReadyTalk, will discuss why and how ReadyTalk diverted from healthy revenue and over a decade of audio conferencing product development to start an innovati...
WebRTC adoption has generated a wave of creative uses of communications and collaboration through websites, sales apps, customer care and business applications. As WebRTC has become more mainstream it has evolved to use cases beyond the original peer-to-peer case, which has led to a repeating requirement for interoperability with existing infrastructures. In his session at @ThingsExpo, Graham Holt, Executive Vice President of Daitan Group, will cover implementation examples that have enabled ea...
SYS-CON Events announced today that Numerex Corp, a leading provider of managed enterprise solutions enabling the Internet of Things (IoT), will exhibit at the 19th International Cloud Expo | @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Numerex Corp. (NASDAQ:NMRX) is a leading provider of managed enterprise solutions enabling the Internet of Things (IoT). The Company's solutions produce new revenue streams or create operating...
Fifty billion connected devices and still no winning protocols standards. HTTP, WebSockets, MQTT, and CoAP seem to be leading in the IoT protocol race at the moment but many more protocols are getting introduced on a regular basis. Each protocol has its pros and cons depending on the nature of the communications. Does there really need to be only one protocol to rule them all? Of course not. In his session at @ThingsExpo, Chris Matthieu, co-founder and CTO of Octoblu, walk you through how Oct...
"My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
If you’re responsible for an application that depends on the data or functionality of various IoT endpoints – either sensors or devices – your brand reputation depends on the security, reliability, and compliance of its many integrated parts. If your application fails to deliver the expected business results, your customers and partners won't care if that failure stems from the code you developed or from a component that you integrated. What can you do to ensure that the endpoints work as expect...
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lea...
IoT is fundamentally transforming the auto industry, turning the vehicle into a hub for connected services, including safety, infotainment and usage-based insurance. Auto manufacturers – and businesses across all verticals – have built an entire ecosystem around the Connected Car, creating new customer touch points and revenue streams. In his session at @ThingsExpo, Macario Namie, Head of IoT Strategy at Cisco Jasper, will share real-world examples of how IoT transforms the car from a static p...
Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is expected in the amount of information being processed, managed, analyzed, and acted upon by enterprise IT. This amazing is not part of some distant future - it is happening today. One report shows a 650% increase in enterprise data by 2020. Other estimates are even higher....
From wearable activity trackers to fantasy e-sports, data and technology are transforming the way athletes train for the game and fans engage with their teams. In his session at @ThingsExpo, will present key data findings from leading sports organizations San Francisco 49ers, Orlando Magic NBA team. By utilizing data analytics these sports orgs have recognized new revenue streams, doubled its fan base and streamlined costs at its stadiums. John Paul is the CEO and Founder of VenueNext. Prior ...
One of biggest questions about Big Data is “How do we harness all that information for business use quickly and effectively?” Geographic Information Systems (GIS) or spatial technology is about more than making maps, but adding critical context and meaning to data of all types, coming from all different channels – even sensors. In his session at @ThingsExpo, William (Bill) Meehan, director of utility solutions for Esri, will take a closer look at the current state of spatial technology and ar...
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, will discuss the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports. The session will include a working demo and a technical d...
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
Businesses are struggling to manage the information flow and interactions between all of these new devices and things jumping on their network, and the apps and IT systems they control. The data businesses gather is only helpful if they can do something with it. In his session at @ThingsExpo, Chris Witeck, Principal Technology Strategist at Citrix, will discuss how different the impact of IoT will be for large businesses, expanding how IoT will allow large organizations to make their legacy ap...
The many IoT deployments around the world are busy integrating smart devices and sensors into their enterprise IT infrastructures. Yet all of this technology – and there are an amazing number of choices – is of no use without the software to gather, communicate, and analyze the new data flows. Without software, there is no IT. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the protocols that communicate data and the emerging data analy...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management solutions, helping companies worldwide activate their data to drive more value and business insight and to transform moder...
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
Digital innovation is the next big wave of business transformation based on digital technologies of which IoT and Big Data are key components, For example: Business boundary innovation is a challenge to excavate third-party business value using IoT and BigData, like Nest Business structure innovation may propose re-building business structure from scratch, as Uber does in the taxicab industry The social model innovation is also a big challenge to the new social architecture with the design fr...