TCP dump is a free open source, very common and fast packet analyzer that runs under the command line.
It prints out a description of the contents of packets on a network interface that matched the Boolean
expression given as a parameter.
DCPI Dump has a lot of filtering options.
We'll discuss some of them in the next slide.
It can be preferred to the other packet analysers, such as Wireshark, because it's so fast.
It also supports some of the most common network traffic capturing format, PopCap, you can say the
result as raw ASCII text in a document as well.
So I have a look at this.
These are some of the parameters you can use with the TCP command deed or list interfaces, Prince the
list of the network interfaces available on the system and on which TCP dump can capture packet's.
I or interface listens in on the interface.
If unspecified, TCP dump searches the system interface list for the lowest numbered configured interface,
excluding loop back, which may turn out to be, for example, if zero.
RN means do not convert addresses, that is hosted addresses, port numbers, etc. to names.
V produces verbose output when parsing and printing, the more V, the more details W. writes the raw
packets to specified file rather than parsing and printing them out.
Are reads packets from the file, which was created with the option or by other tools that write PopCap
or recapping files.
A prince, each packet and aski.
Handy for capturing Web pages when passing and printing, in addition to printing the headers of each
packet, capital letters prints the data of each packet in hex and ASCII.
It's very handy for analyzing new protocol.
So if you use the X option, the data of each packet is printed in X.
In addition to these options, you can filter the results in several ways.
If you would like to monitor specific protocol such as TCP, you can use its name as the filter.
You can capture packets to or from an endpoint residing in the network using net filter or use a host
filter to see the packets of a host as a source destination or either one.
Use the port to filter TCP or UDP packet sent to or from a specified port use port range to listen to
ports in any given range.
Now, if you use the Sarsae option, you can see only the packets where the target system is the source
of the packet.
Similarly, DST is used to specify the destination system.
So, of course, you can use more than one filter and a command and set up the relation using and and
or as logical operators, for example, host is one point one one up one, and port is 80.
Now, before running several dumb commands, let's examine the fields of a typical TCP dump output row.
The rows shown in the slide is a TCP packet.
The first field is the time when the package arrived with a time stamp as our minute, second and,
well, the fractions of a second.
So the second field is a protocol running atop the link layer, in this case IPV for.
Now for IP packets, the third field is the IP address, her host name of the host sending the packet
along with four TCP and UDP packets, the source port.
The packet on the slide came from Port 80 of the system, 172 dot one six nine nine dot one three nine.
Now, the fourth field is the IP address or hostname of the host receiving the packet, along with four
TCAP and UDP packet.
The destination Port Flagg's is the TCP segment flag.
The packet on the slide doesn't have any flags set other than ACC.
ACC is the acknowledgement number in the packet.
DCPI shows sequence and acknowledgement numbers relative to the initial sequence number by default.
When is the source host TCP window and you see the options, field length is the length of the data
in the TCP segment, like here is zero.
So that means that no data is exchanged yet.
So that's enough for now, let's see, TCP dove in action, time for Hands On.