CRIPTOGRAFIA - FESP

# cat > filterfile
dst host spider and "(udp or proto 51)" and not "(src host daffy or src host fulton)"
Ctrl-D
# tcpdump -F filterfile
So we can save compound filters that interest us and capture traffic with ease.
By the way, the above command captures all IP traffic involving host spider as
destination but not involving host daffy nor host fulton as sources. A second
protocol must be either UDP or AH.
4. how to display packet information
The fourth and final approach at taming tcpdump is specifying how our data is to
be displayed. It is important to realize that our filter (or the lack of one)
determines what data is actually captured. After that, we tell tcpdump how to
output that data. We have already looked at how to output certain kinds of data
(subsection 2). In this section, we look at how to format that output.
We can format data output in the following ways:
1. "-a " -- force all name resolution (the default)
2. "-n " -- remove all name resolution
3. "-N " -- remove domain name resolution
4. "-f " -- remove all remote host name resolution
5. "-t " -- remove timestamp
6. "-tt " -- no timestamp formatting (use epoch time)
7. "-ttt " -- format timestamp with day and month
So there's nothing spectacular here. The most we can say is that removing name
resolution can speed things up. Removing timestamps also unclutters the screen
quite well. I leave it up to you, dear reader, to experiment with these formatting
options.
Let me end with two more examples.
Let's say I am working at my desk and I want to keep tabs at what bastards are
bombarding my firewall with junk. I could issue the following command and take
a look from time to time:
# tcpdump -i tun0 -nq \
not "(port 22 and host spider)" \
and not "(port 53 or 80 or 110 or 119 or 443)" \
and dst host 216.209.50.188
on my system the interface is 'tun0'
so as not to have my ssh session interfer
so as not to show valid packets
if this is the IP currently assigned to t
What if I am interested in what my firewall is actually sending out onto the
internet? I can remove some known good outgoing traffic and observe the rest
(which ideally should not exist):
# tcpdump -i tun0 -nq \
and not port '(20 or 21 or 25 or 53 or 80 or 110 or 119 or 123 or 443)' \
and not icmp \