TCPDUMP IN LINUX AND
SNOOP IN SOLARIS
TCPDUMP IN LINUX:
[root@gagan
~]# tcpdump –help
OPTIONS:
-S : Print absolute sequence numbers.
-e : Get the ethernet header.
-q : Show less protocol information.
-E : Decrypt IPSEC traffic by providing an encryption key.
-n : Don't resolve hostnames.
-nn : Don't resolve hostnames or port names.
-X : Show the packet's contents in both hex and ASCII.
-XX : Same as -X, but also shows the ethernet header.
-v, -vv, -vvv : Increase the amount of packet information you get back.
-c : Only get x number of packets and then stop.
-s : Define the snaplength (size) of the capture in bytes.
Use -s0 to get everything, unless you are intentionally capturing less.
Regular
Expressions:
AND - and or &&
OR - or or ||
EXCEPT - not or !
TCPDUMP COMMAND EXAMPLES:
1. To capture all the interfaces network traffic using tcpdump,just run command “tcpdump”
[root@gagan ~]# tcpdump
2. To capture the
network traffic on the particular interface,
[root@gagan ~]# tcpdump -i eth0
3.To capture the “N” no
of network packets , use “-c” option (To
specify“N” value.)
[root@gagan
~]# tcpdump -c 8 -i eth0
4.
To capture the network traffic between two IP address.
Source IP address: Local system IP
Destination IP address:Remote
system IP
[root@gagan ~]# tcpdump src 10.0.0.2 and dst host 10.0.04 -c 10
5.
To capture the specific local port traffic using
tcpdump,
[root@gagan ~]# tcpdump src port 21 -c 9
6.
To capture network traffic of destination port ,
[root@gagan ~]# tcpdump dst port 21 -c 8
7.
To filter the network traffic using destination
IP address and local port number,
[root@gagan ~]# tcpdump dst 10.0.0.4 and src port 21 -c 9
8.
To filter the specific network traffic,use the below command.
[root@gagan ~]# tcpdump net 10.0.0.0/24 -c 8
9.
To filter the traffic using the protocal, Ex:ICMP
[root@gagan ~]# tcpdump icmp
10.
To filter the traffic using port range,
[root@gagan ~]# tcpdump portrange 21-25 -c 9
11.
To capture the network packets to the file, use “-w”
option.File should have extension with the name “pcap”.
[root@gagan ~]# tcpdump portrange 21-25 -w saveme.pcap
SNOOP IN SOLARIS
OPTIONS:
snoop
[ -a ] # Listen to packets on audio
[ -d device ] # settable to le?, ie?, bf?, tr?
[ -s snaplen ] # Truncate packets
[ -c count ] # Quit after count packets
[ -P ] # Turn OFF promiscuous mode
[ -D ] # Report dropped packets
[ -S ] # Report packet size
[ -i file ] # Read previously captured packets
[ -o file ] # Capture packets in file
[ -n file ] # Load addr-to-name table from file
[ -N ] # Create addr-to-name table
[ -t r|a|d ] # Time: Relative, Absolute or Delta
[ -v ] # Verbose packet display
[ -V ] # Show all summary lines
[ -p first[,last] ] # Select packet(s) to display
[ -x offset[,length] ] # Hex dump from offset for length
[ -C ] # Print packet filter code
[ -q ] # Suppress printing packet count
[ -r ]
EXAMPLES OF SNOOP:
1. capture all packets going to and from the box
gagan007.
# snoop host gagan007
2. We can also see all
packets that goes through specific port. In this case it is port 22.
# snoop port 22
3. To examine only
packets on specific interface (eth0) and store the output to the file, enter
the following:
# snoop -d eth0 -o /tmp/output1.file
4. You can read your
captured output file by issuing following command:
# snoop -i /tmp/output.file
# snoop -v host system2 port 513
5. Observing Traffic by Identifying the Zone
# snoop -I eth0 gagan1 -I eth1 gagan2
