In this video, we're going to cover tcpdump
and how we use them in maintaining
and troubleshooting our networks.
tcpdump is a command line tool
that allows a network technician to display TCP IP
and other packets that are being transmitted
or received over a network to the client screen.
Now, tcpdump is not included on Windows clients by default,
but it is installed by default on Linux, Unix,
and OSX systems.
If you want to use it on Windows, you'll have
to actually download and install it.
Now, tcpdump is used
to simply dump the traffic from the network onto the screen,
but this can also be redirected to a file,
so you can store it and analyze it later on
using the tcpdump-w option.
This will create a file known
as a PCAP file or packet capture file.
When you use tcpdump,
you can see the same standard format used
for every single packet.
This includes a timestamp,
whether the packet is IPv4 notated
by IP in the tcpdump,
or IPv6 notated by IP6 in the tcpdump,
the source IP import, the destination IP import.
What flags were used in that TCP packet,
the sequence number, the acknowledgement number,
the windowing number, and the length of the packet.
If any of these options are set in the packet,
it's going to be shown between the windowing number
and the packet length.
If you create a PCAP file using tcpdump,
it can later be loaded into a more graphical tool
like Wireshark, where you can do more analysis on it
or you can reload it back into tcpdump
and analyze it in this text-based tool.
Now, I'm going to show you a little bit how to use tcpdump.
By the end of this lesson,
you're not going to be an expert in it, but that's okay
because for the exam, you don't need to know how
to actually use tcpdump,
but you should be familiar with the fact that tcpdump
and Wireshark are often used together as a way
to capture packets and then analyze packets.
Unlike Wireshark, tcpdump is a text-based program
and you use it inside the command line.
Now, what I'm going to do here is first I'm going to start
using tcpdump inside my Mac OSX environment.
It comes to installed by default inside Mac
as well as in Linux.
If you're going to use tcpdump, you need to know
what interface you're connected to the network on.
In my case, it's en0, so to use it,
I'm going to do sudo
because you must be running this
with administrative permissions to be able
to turn your card into promiscuous mode
and then tcpdump-i,
and then your interface, en0 if you're on a Mac,
if you're on a Linux machine, it should be eth0.
So I'll go ahead and hit type in en0 and hit enter.
Now at this point, I'm putting my card into promiscuous mode
and I'm starting to look at everything
that's going across the network.
And here you see information going across the screen
showing me all sorts of different connections
that are happening on this network, both from my computer
and other computers on the network.
Now, this isn't nearly as helpful as being able
to look at things slowly or by filtering it down,
but that's okay because we can do
that using tcpdump as well.
Instead of displaying it to the screen, I'm going to go ahead
and hit control C and that's going to pause that
and cancel my collection.
And now I can see a couple of things here.
If we start up towards the top, you'll see
that my IP address is 10.128.1.130.
The first line there is actually going from my computer
over port 57963 to that particular website that you see,
which is 1e100.net.
It's doing this over HTTPS, which is port 443.
There is no flags in that packet.
There was an acknowledgement that was received.
You could see the windowing, the options and the value.
That is one packet with one timestamp.
Then you go down to the next one, there's another one
and the next one, there's another one
and there's lots of information here.
Now, let's say instead
of looking at data from all different things on the network,
I only wanted to see things that came from my computer.
Could I do that? Well, certainly.
What I can do is clear my screen
and then I will use sudo tcpdump.
I will type in source, which is the IP I want to collect from,
and in my case, it is going to be 10.128.1.130,
and then I will hit enter.
Now all you're going to see here is traffic going
from the .130, my host to somewhere else on the network,
and right now there's not much going on
because I'm sitting here talking to you
and not browsing the internet.
But if I was browsing the internet
and doing other connections,
those would all be showing up here.
What you're seeing here is a lot of different beaconing
and keep alive traffic
for different programs I have on my computer,
and that's what we're seeing here.
Now, the next thing we want to do
is go ahead and hit control C
and this is also helpful,
but again, it's not extremely helpful
because if I had this running on a large enterprise network,
there'd be so much data whizzing by my screen,
I wouldn't be able to read it all.
So we would want to write that to a file.
How do we do that?
Well, again, I'm going to clear my screen
so I can go to the top
and I'll bring up the last command I did.
If we want to do this and write it to us file,
we can just type in -w
and then the file name that we want.
And so in my case, I'm going to call it host130.pcap
and then hit enter.
Now that information is going to go into a file
that's going to be captured on my hard drive.
As it's sitting there listening, it's picking up any traffic
that's going from that source, 10.128.1.130,
and it's writing it to the file, host130.pcap.
Now, once we have enough of that, we can hit control C.
In this case, we captured 161 packets of information.
Again, it's very little information right now
because it's basically background tasks on this computer
because I'm not actively running things
because I'm not sitting there browsing the internet.
Now, if I wanted to be able to see that information,
I can do that by doing sudo tcpdump and then -r
and then the file that I did, host130.pcap.
When I hit enter, I'm going to see all 161 packets
from that file and display them to the screen.
Here's the first bunch, and then I'm just going to keep
reading them and displaying 'em to the screen.
Now again, that's a lot of information
and I only did that for about five or 10 seconds.
If I had this running all day,
that'd be way too much information to go through.
So instead, we would want to start filtering that information
and we can do that based on a lot of different things.
For instance, if I look at this particular packet
right here, you can see that it is going
from the host at 130 over port 5475,
and it's going out to the broadcast
of the network at .255.255 over port 5474.
If I just wanted to see every time that there was a beacon
that was going out like that, I can do that.
And so what I'll do is I'll hit clear.
I would type in sudo tcpdump source, src,
and then port, the port I want to see,
in this case that was 5475,
and then again, I need to read it from the file,
so -r host130.pcap.
If I don't put the -r host130.pcap,
what it's going to do is it's going to look at the live traffic
and anytime it sees a source port of 5475,
it would display it to the screen.
But in this case, I want to go through and
analyze what I already captured.
So as I did that, you can see here a handful
of times that that happened.
Now, if this was malware, it was beaconing out,
I could see exactly when that happened.
In this case, this particular packet
is being sent out every second,
19:06:51, 19:06:52, 19:06:53.
Now, this is just the header we're seeing
and we can see this is a UDP packet
that's being sent out with a length of 5.
Well, what if you wanted to look inside this packet
and see what was actually sent?
Can you do that? Well, sure you can.
We can do the exact same thing we just did
and then add the command -x,
which will show the packets contents in both hex and ASCII.
So let me go ahead and clear my screen
and then go here and add -x.
Now I see all those packets again done by time,
and here I see the IP, where it's going from,
where it's going to, UDP length 5.
Then you're seeing that 5 bytes of data.
Notice here, we see it in hex first,
and then we see it in ASCII on the right hand side.
This will allow us to go through
and see what was being sent.
This can be extremely helpful if somebody's using something
like FTP or HTTP where things are being sent in the clear.
Now, as I said, what I did here was just a very,
very quick demonstration to show you some
of the capabilities of this tool.
If you want to learn more,
I recommend you go into the man pages for tcpdump
and just type in man tcpdump and hit enter.
This will bring up the manual
and you can see all of the different options
and all of the different ways you can filter down content.
Remember, you can filter during collection,
or you can filter
after you've collected when you're reading things.
Why would you want to do one versus the other?
Well, again, let's say I was
running a big large enterprise network.
One of the organizations I work for, we ran a network
with tens of thousands of computers,
and so if I said, "Show me everything
that's coming from this particular IP address
or this particular port,
or is beaconing out to a known bad actors command
and control server," that could be a ton of information.
So we would want to just filter down on the collection
because we're only interested in what we are looking
for instead of every single packet sent across the network
internally or out to the internet.
And so this is why it's important for you to think about
what are you trying to collect
and filter that down on the collection to reduce the size.
On the other hand, if you're not sure what you're trying
to collect yet, you're still trying
to identify the indicators of compromise,
you may collect everything, which can take up tons of space
and then filter it down as you start reading through
and going through those logs.