TCP Dump - A simple WAY
Published: 2023-09-25 03:37:02

**<u>What is TCPDUMP ?</u>**

Dumping traffic logs on a network or in other words _**captures network traffic and prints**_.

---

**<u>Most commonly used Query :</u>**

```
sudo tcpdump -n -i any port 443
```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0cck90knvzf7qj0r5vl8.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/73u9l7nmo7tju6kqux43.png)

**_எங்க officeல ஒரு server ஒன்னு ஓடுது ,  அதோட port  வந்து 8080 . இப்ப இந்த portக்கு எங்க எல்லாம் இருந்து request வருதுன்னு பாக்க போறேன்,_**

```
sudo tcpdump -i any port 8080
```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fcose5g5bay2d8daj7cu.png)

**_என்னோட serverக்கு  ( 8080) இந்த IPல இருந்து request வருதான்னு பாக்கணும் ,_**

```
sudo tcpdump port 8080 and host 1.3.5.7
```

**_Networkல எதெல்லாம் FAIL ஆகுது i.e DNS queries,_**

```
sudo tcpdump 'udp[11] & 0xf==3'
```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g8cg0vbr9ntviij3o9c3.png)

**_To take the compete dump of network on the server for analysis,_** ( give **_control + x_** to terminate , normally take for 1 min )

```
sudo tcpdump -w packets.pcap
```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k5w8wj1scfaipbipobru.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lb01n3duk9s08pfkx3mo.png)

---

**<u>Important THINGS to be noted in a TCP DUMP :</u>**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ch10hlv4qepwgk5h6qce.png)

**_UDP Packet_**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adcb2leemf1xf1k3hgsg.png)

**_TCP Packet_**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qqzm9ullgtpn99rba1sp.png)

---

**<u>How the TCPDUMP filters the port or IP ?</u>**

- It uses a concept called " **_BPF Filters_** ".
- If a tcpdump command executed for port 443 , then its BPF filters the port 443 and provides the output.
- Interesting eg., if you provide **_udp[11] & 0xf==3_** , this filter checks for the DNS response code "**_NXDOMAIN_**" and provides the output.

---

**<u>Commands Explanation :</u>**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o1r5fcgfn09e5be9alkw.png)

---

**<u>Network commands :</u>**

```
ping
nslookup/dig
netstat/ss
ifconfig
ip
arp
ngrep
traceroute/mtr
nc
iptables/nftables
sysctl
ethtool
nmap
whois
lsof
telnet
ssh
network manager
paping
nethogs/ab/nload/iptraf/netperf/iperf/iftop/netsniff-ng
openvpn
socat
```

---
**<u>Note :</u>**

1.**_PCAP stands for Packet Capture_**, which is a file format used to store network packet data captured from a network interface. It is commonly associated with network analysis and troubleshooting activities. PCAP files contain the raw data of network packets, including the headers and payloads of each packet.

2.To analyze .pcap file , most commonly used tool is **_Wireshark_**. Powerful packet analysis tool & graphical interface. Also this tool understands all the below mentioned protocols too ,

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9uhdz6etbthygjyxk4sj.png)

3.**_Berkeley Packet Filter_** - BPF

**<u>Reference :</u>**

https://jvns.ca/tcpdump-zine.pdf