CRIPTOGRAFIA - FESP

3. what traffic to capture (packet filtering)
4. how to display that packet information (data formatting)
1. controlling tcpdump
The switches we have seen so far (l,w,r) fall in this catagory. Here are a few
more:
# tcpdump -i xl0 -c 100 -s 400
Ok, so that tells tcpdump to listen on the xl0 network interface, capture only the
first 100 packets that come across it, and suck up the first 400 bytes of data from
each packet (which includes the 14 bytes from the ethernet frame). The
corresponding defaults are: the "lowest" interface (example: eth0 and not eth1);
an indefinite number of packets; and 96 bytes.
2. what packet information to show
For the traffic that is captured we have a say in what information is shown. A few
things you can try are to tell tcpdump to be "quiet", "verbose", or "very verbose".
The corresponding switches are "-q", "-v", and "-vv" and, quite frankly, they are
no big deal. The switches that are more interesting are "-e" and "-x". The former
tells tcpdump to display the source and destination mac/ethernet addresses and
the latter tells it to show us the payload of a packet in hexadecimal. This last
switch is one of the more important switches available to us and it is what we
used to display that first packet in the tutorial. Here are some examples:
Let's say we're just interested in the mac addresses:
# tcpdump -qec1
00:57:06.154240 0:a0:4d:3:e0:1d 0:50:be:2b:44:8f 60: spider.4454 > fulton.pmatulis.homeunix.
The two mac addresses you see are the source and destination. So here, spider
has mac address 0:a0:4d:3:e0:1d and fulton has mac address 0:50:be:2b:44:8f. I
used the quiet option to cut down on the clutter and requested a count of only 1
packet.
Let's go further and tell tcpdump to include some data in the capture:
# tcpdump -qec1 -x
01:04:18.762895 0:50:ba:2b:44:8f 0:a0:4b:3:e0:1d 118: fulton.pmatulis.homeunix.net.ssh > spi
4510 0068 ca56 4000 4006 ec92 c0a8 011e
c0a8 0128 0016 1166 fe89 6677 1140 5338
5018 4470 9250 0000 3b6e e13e c39e cebe
6ad5 5a78 8d62 090c 7dcf e1f1 37e0 9f64
1c54 0ef7 8534 1ec9 0240 d02d c8a1 e54b
fa3b
A final and very useful switch for controlling tcpdump is to have the packet
payload converted to ASCII. Normally this is used in conjunction with hex (the