download

Network Configuration—BasicsThis will capture 1000 packets (note -c 1000) from the bge1 interface (note -i bge1)and save the capture to a pcap file called sample1.pcap. This file can be read laterby tcpdump's -r option and information extracted using expressions, or can beprocessed using Wireshark. The following screenshot shows Wireshark in action:The tcpdump utility is also capable of decrypting IPSEC ESP packets if the ESP secretkey is known. This is possible using tcpdump's -E option:# tcpdump -E des3:b1dd0bfffee -n -i bge1tcpdump: verbose output suppressed, use -v or -vv for full protocoldecodelistening on bge1, link-type EN10MB (Ethernet), capture size 96 bytes09:42:26.855518 esp 11.11.11.11 > 9.9.9.9 spi 0x00000305 seq 426 len92 [|esp] [tos 0x1 (C)]09:42:26.876694 esp 9.9.9.9 > 11.11.11.11 spi 0x00000305 seq 942078len 92 [|esp] [tos 0x21 (C)]09:42:27.860240 esp 11.11.11.11 > 9.9.9.9 spi 0x00000305 seq 427 len92 [|esp] [tos 0x21 (C)]09:42:27.880190 esp 9.9.9.9 > 11.11.11.11 spi 0x00000305 seq 942079len 92 [|esp] [tos 0x21 (C)][ 130 ]