Unit 1: Layers and packets · Lesson 4 of 5 · 20 min
Filtering with tcpdump
Cut a capture down to what matters with tcpdump filters and save the result as evidence.
mission
- You are
- The analyst preparing evidence for another team.
- Situation
- The incident team only wants the packets that matter, not whole captures. They asked for the DNS traffic from one laptop and the handshakes where the web server said yes.
- Goal
- Select packets with tcpdump filters and write them to a new file.
- Hand in
- The packet counts for both requests.
Where a capture comes from
Filter by host
tcpdump filters are written in BPF, the same language a live capture uses to decide what to record. src host matches the sender address.
tcpdump -nn -r dns.pcap -c 3 'src host 10.10.0.57'
reading from file dns.pcap, link-type EN10MB (Ethernet), snapshot length 65535
11:00:41.237593 IP 10.10.0.57.36515 > 10.20.0.53.53: 9324+ A? 8a8e9bb8bdb5eba456bf92d5d98065e5751f75143a5f61de.00.t.cdn-sync.example.net. (92)
11:00:42.318473 IP 10.10.0.57.41134 > 10.20.0.53.53: 8222+ A? 267b0bc8d3b1939a9b4ddbe45cf642b0c3a4acdd7f9fcc58.01.t.cdn-sync.example.net. (92)
11:00:43.711294 IP 10.10.0.57.41513 > 10.20.0.53.53: 23701+ A? 9f8d0a9f94f03e7914c0f87f17f8499ff30499a90ebb4108.02.t.cdn-sync.example.net. (92)
you should see Odd, very long names. You will investigate them properly in a later unit.
Filter by TCP flags
tcp[tcpflags] reads the flag byte directly. Comparing it with tcp-syn|tcp-ack keeps only SYN-ACK packets: a port saying yes.
tcpdump -nn -r scan.pcap 'tcp[tcpflags] == (tcp-syn|tcp-ack) and dst host 203.0.113.50'
reading from file scan.pcap, link-type EN10MB (Ethernet), snapshot length 65535
14:00:00.378193 IP 10.20.0.11.22 > 203.0.113.50.41670: Flags [S.], seq 3519837531, ack 2031090100, win 65160, length 0
14:00:00.810699 IP 10.20.0.11.443 > 203.0.113.50.58255: Flags [S.], seq 310846306, ack 119272178, win 65160, length 0
14:00:00.946694 IP 10.20.0.11.8443 > 203.0.113.50.52262: Flags [S.], seq 3252678920, ack 2913827487, win 65160, length 0
14:00:00.974217 IP 10.20.0.11.80 > 203.0.113.50.58548: Flags [S.], seq 2864237875, ack 2302821037, win 65160, length 0
you should see Four ports answered an outside address. Keep 8443 in mind.
Save a filtered copy
-w writes matching packets to a new pcap instead of printing them. Hand that file over, not your notes.
tcpdump -nn -r scan.pcap -w ~/open-ports.pcap 'tcp[tcpflags] == (tcp-syn|tcp-ack)' reading from file scan.pcap, link-type EN10MB (Ethernet), snapshot length 65535 capinfos -c ~/open-ports.pcap File name: /home/analyst/open-ports.pcap Number of packets: 10
you should see Ten SYN-ACKs: the four to the scanner plus six to office laptops.
defender tip Write evidence to a new file and never edit the original capture. Note the filter you used next to it.
Filter by size
greater N keeps packets of at least N bytes, which skips the empty ACKs and leaves the ones carrying data.
tcpdump -nn -r http.pcap 'tcp port 80 and greater 200'
reading from file http.pcap, link-type EN10MB (Ethernet), snapshot length 65535
09:30:00.002800 IP 10.10.0.23.53100 > 10.20.0.40.80: Flags [P.], seq 1023818840:1023818995, ack 1312657533, win 64240, length 155: HTTP: GET /login HTTP/1.1
09:30:04.502800 IP 10.10.0.23.53101 > 10.20.0.40.80: Flags [P.], seq 3952586890:3952587136, ack 1252859371, win 64240, length 246: HTTP: POST /login HTTP/1.1
09:30:09.002800 IP 10.10.0.23.53102 > 10.20.0.40.80: Flags [P.], seq 751588491:751588676, ack 3561386828, win 64240, length 185: HTTP: GET /dashboard HTTP/1.1
you should see The three requests, with the boring packets gone.
Display filter or capture filter
tshark -r scan.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==1'
Rich field names. Works on saved files.
tcpdump -r scan.pcap 'tcp[tcpflags] == (tcp-syn|tcp-ack)'
BPF. The only kind a live capture accepts, so learn it for the day you record.
What a defender takes away
- 1BPF filters (
host,port,tcp[tcpflags],greater) work in tcpdump and in live captures. - 2Save filtered evidence with
-wand keep the original untouched. - 3Hand over small, named pcaps with the filter written down.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.