CRIPTOGRAFIA - FESP

"x" switch) even though, when using this ASCII switch, hex is often displayed
whether demanded or not. To display ASCII we employ the "X" switch:
# tcpdump -qec1xX
On another system this gave me info on some Samba exchanges:
21:04:34.339233 0:c:6e:77:68:8d 0:c0:4f:ac:12:3b 107: bureau.danville.ca.2343 > candyman.dan
0x0000 4500 005d 138d 4000 8006 635e c0a8 013f E..]..@...c^...?
0x0010 c0a8 0120 0927 008b 8fba 2130 aa33 e823 .....'....!0.3.#
0x0020 5018 fe64 030d 0000 0000 0031 ff53 4d42 P..d.......1.SMB
0x0030 2b00 0000 0018 43c0 0000 0000 0000 0000 +.....C.........
0x0040 0000 0000 ffff fffe 0000 feff 0101 000c ................
0x0050 004a .J
3. what traffic to capture
We can capture traffic based on:
1. address
2. protocol
3. port
4. packet characteristics
5. combinations thereof
address filtering
• An address can refer to a host, a network, a multicast/broadcast,
or a mac/ethernet address
• An address can be a source or a destination
So if I am interested in all IP traffic involving host mudra:
# tcpdump host mudra
Let's say I want only traffic where mudra is the destination:
# tcpdump dst host mudra
Obviously, if you use names (instead of IP addresses) name resolution
must be set up.
Below we capture IP traffic involving a source ethernet address of
0:a0:3b:3:e1:1d
# tcpdump ether src host 0:a0:3b:3:e1:1d
Note the syntax: ether host {mac address}
Here we will display the first 100 packets involving network
192.168.1.0 with a netmask of 255.255.255.0 and save everything to a