tcpdump

Comprehensive Guide to Using tcpdump on Ubuntu

tcpdump is a powerful command-line packet analyzer tool. It allows users to capture and analyze network traffic on a system. This guide will cover the installation of tcpdump, basic usage, and advanced command examples.

1. Installation of tcpdump

To use tcpdump, you need to ensure it is installed on your Ubuntu system. You can install it using the following command:

sudo apt update
sudo apt install tcpdump

2. Basic Usage

The basic syntax for tcpdump is as follows:

sudo tcpdump [options] [expression]
  • options: These modify the behavior of tcpdump (e.g., output format, interface selection).
  • expression: A filter to capture specific types of traffic.

3. Capturing Packets on a Specific Interface

To capture packets on a specific network interface, use the -i option followed by the interface name:

sudo tcpdump -i eth0

Replace eth0 with the name of your network interface (you can list interfaces with ip link).

4. Saving Captured Packets to a File

You can save the captured packets to a file for later analysis using the -w option:

sudo tcpdump -i eth0 -w capture.pcap
  • capture.pcap: The file where the captured packets are saved.

5. Reading Packets from a File

To read and analyze packets from a previously saved .pcap file, use the -r option:

sudo tcpdump -r capture.pcap

6. Filtering Traffic by Protocol

You can filter traffic by specific protocols such as TCP, UDP, or ICMP. Here are some examples:

  • Capture only TCP traffic:
  sudo tcpdump -i eth0 tcp
  • Capture only UDP traffic:
  sudo tcpdump -i eth0 udp
  • Capture only ICMP (ping) traffic:
  sudo tcpdump -i eth0 icmp

7. Filtering Traffic by Port

To filter traffic by port, use the port keyword:

  • Capture traffic on port 80 (HTTP):
  sudo tcpdump -i eth0 port 80
  • Capture traffic on a range of ports (e.g., 8000 to 8100):
  sudo tcpdump -i eth0 portrange 8000-8100

8. Filtering Traffic by IP Address

You can filter packets by source or destination IP address:

  • Capture traffic from a specific IP address:
  sudo tcpdump -i eth0 src 192.168.1.1
  • Capture traffic to a specific IP address:
  sudo tcpdump -i eth0 dst 192.168.1.1
  • Capture traffic either from or to a specific IP address:
  sudo tcpdump -i eth0 host 192.168.1.1

9. Combining Filters

You can combine multiple filters using logical operators such as and, or, and not.

  • Capture traffic from a specific IP and on a specific port:
  sudo tcpdump -i eth0 src 192.168.1.1 and port 22
  • Capture traffic not from a specific IP address:
  sudo tcpdump -i eth0 not src 192.168.1.1

10. Capturing a Specific Number of Packets

To stop capturing after a certain number of packets, use the -c option:

sudo tcpdump -i eth0 -c 10

This command captures only 10 packets.

11. Limiting the Size of Captured Packets

You can limit the size of packets captured to save space using the -s option:

sudo tcpdump -i eth0 -s 100

This command captures only the first 100 bytes of each packet.

12. Verbose Output

To get more detailed information about each packet, use the -v, -vv, or -vvv options:

sudo tcpdump -i eth0 -v
  • -v: Provides slightly more information.
  • -vv: Provides more detailed information.
  • -vvv: Provides the most detailed information.

13. Human-Readable Timestamps

To print timestamps in a human-readable format, use the -tttt option:

sudo tcpdump -i eth0 -tttt

14. Capturing Only Specific Packet Headers

To capture only specific parts of a packet (e.g., the TCP/IP headers without the payload), use the -s option with a small value:

sudo tcpdump -i eth0 -s 60

15. Analyzing Captured Traffic

While tcpdump is powerful for capturing traffic, analyzing captured data can be complex. You might use tools like Wireshark, which can read .pcap files, to provide a more user-friendly analysis.

Conclusion

tcpdump is a versatile and powerful tool for network traffic capture and analysis. The above examples cover many common scenarios, but tcpdump is capable of much more. Experimenting with different options and filters will help you become proficient in using this tool for network diagnostics and security monitoring.