download

Network Configuration—BasicsNote that when you are running the tcpdump on an interface, it puts the networkinterface into promiscuous mode (explained earlier in this chapter) in order toreceive all traffic passing from the interface. This will show all packets that arereceived by your network hardware, regardless of the source and destinationhardware. This would be more interesting if you are connected to a network hub(so you will see packets for all connected nodes) or to a network tap (or an SPANswitch port). If this is not what you want, and you only want to sniff the traffic that isactually for your host, you can disable this mode by using the tcpdump's -p options.You can filter out the packet capture by using expressions you specify on thecommand line. For example, to see last 5 UDP packets, you may use thefollowing command:# tcpdump -i bge1 -c 5 -n udpOr to capture traffic that is going to or coming from network 172.21.3.0/24, youmay use:# tcpdump -i bge1 net 172.21.3.0/24The expression can match any rule from layer2 packets to layer4 packets.It is also capable of capturing and decoding complex protocols suchas MPLS and IPv6 protocol set. For more information, please refer totcpdump(1) man pages.Using tcpdump you can set up a stealth network capture device that is passivelycapturing network traffic. In order to achieve this, you should put your interface inmonitor mode. Hence your sniffing network interface does not transmit any packetsand only diverts packets to bpf(4) packet filter, so there will be no trace (no packetswith your source IP or MAC address ) from your system on the wire.Before enabling the monitor mode on the interface that you want to sniff,make sure this is not the interface that you have connected to your box viaSSH. Otherwise, you will lock yourself out of your box.It would be wise to have a host with multiple NICs, so one NIC would be dedicatedfor traffic sniffing and the other for typical network connection, on which you canSSH or run a web interface.The tcpdump utility can fully decode packets in real-time. If you use the-vvvvoptions (that gives the most verbosity-level) as well as -s0 (that captures wholepacket payload off the wire), you will have the complete packet decodedon STDOUT.[ 128 ]