Changes between Initial Version and Version 1 of netsec2018wireshark

Timestamp:

Jun 6, 2018, 6:45:47 AM (6 years ago)

Author:

admin

Comment:

--

netsec2018wireshark

@@ +1 @@
+= Capture and Analise Packets =
+
+In this lab session we will use tcpdump and wireshark to capture packets. To analise them we will use wireshark.
+
+== Packet Capturing == 
+
+=== tcpdump ===
+
+ - Go to the ubuntu VM
+
+ - use tcpdump command to pacture packets
+{{{
+tcpdump -nn
+}}}
+
+ - you will get outputs like following
+{{{
+IP 199.59.148.139.443 > 192.168.1.8.54343: Flags [P.], seq 53:106,
+ack 1, win 67, options [nop,nop,TS val 854797891 ecr 376933204],
+length 53
+}}}
+
+ - You can try tcpdump with different attributes
+{{{
+tcpdump –nni eth0 host 10.10.10.10
+tcpdump –nni eth0 dst host 10.10.10.10 and tcp
+tcpdump –nni eth0 src net 10.10.10.0/24 and tcp and portrange 1-1024
+tcpdump –nni eth0 –s0
+tcpdump –nni eth0 not port 22 –s0 –c 1000
+tcpdump –nni eth0 not port 22 and dst host 10.10.10.10 and not src net 10.20.30.0/24
+
+-nn = don’t use DNS to resolve IPs and display port no 
+-i = interface to watch 
+dst = watch only traffic des0ned to a net, host or port 
+src = watch only traffic whose src is a net, host or port 
+net = specifies network 
+host = specifies host 
+port = specifies a port 
+proto = protocol ie tcp or udp 
+-s0 = seIng samples length to 0 m
+-c = number of packets 
+}}}
+
+ - You can capture packets and save them to a file
+{{{
+# tcpdump –nni eth0 -w capture.pcap –vv –c 1000
+# tcpdump –nni eth0 –r capture.pcap port 80
+ 
+-w capture.pcap = save capture packet to capture.pcap 
+–vv =  display number of packet captured 
+-r capture.pcap = read capt
+}}}