Intro to Network Traffic Analysis

6 min read

Tcpdump

Command	Description
`tcpdump --version`	Prints the tcpdump and libpcap version strings then exits.
`tcpdump -h`	Prints the help and usage information.
`tcpdump -D`	Prints a list of usable network interfaces from which tcpdump can capture.
`tcpdump -i (interface name or #)`	Executes tcpdump and utilizes the interface specified to capture on.
`tcpdump -i (int) -w file.pcap`	Runs a capture on the specified interface and writes the output to a file.
`tcpdump -r file.pcap`	TCPDump will read the output from a specified file.
`tcpdump -r/-w file.pcap -l \	grep ‘string’`
`tcpdump -i (int) host (ip)`	TCPDump will start a capture on the interface specified at (int) and will only capture traffic originating from or destined to the IP address or hostname specified after `host`.
`tcpdump -i (int) port (#)`	Will filter the capture for anything sourcing from or destined to port (#) and discard the rest.
`tcpdump -i (int) proto (#)`	Will filter the capture for any protocol traffic matching the (#). For example, (6) would filter for any TCP traffic and discard the rest.
`tcpdump -i (int) (proto name)`	Will utilize a protocols common name to filter the traffic captured. TCP/UDP/ICMP as examples.

Tcpdump Common Switches and Filters

Switch/Filter	Description
`D`	Will display any interfaces available to capture from.
`i`	Selects an interface to capture from. ex. -i eth0
`n`	Do not resolve hostnames.
`nn`	Do not resolve hostnames or well-known ports.
`e`	Will grab the ethernet header along with upper-layer data.
`X`	Show Contents of packets in hex and ASCII.
`XX`	Same as X, but will also specify ethernet headers. (like using Xe)
`v, vv, vvv`	Increase the verbosity of output shown and saved.
`c`	Grab a specific number of packets, then quit the program.
`s`	Defines how much of a packet to grab.
`S`	change relative sequence numbers in the capture display to absolute sequence numbers. (13248765839 instead of 101)
`q`	Print less protocol information.
`r file.pcap`	Read from a file.
`w file.pcap`	Write into a file
`host`	Host will filter visible traffic to show anything involving the designated host. Bi-directional
`src / dest`	`src` and `dest` are modifiers. We can use them to designate a source or destination host or port.
`net`	`net` will show us any traffic sourcing from or destined to the network designated. It uses / notation.
`proto`	will filter for a specific protocol type. (ether, TCP, UDP, and ICMP as examples)
`port`	`port` is bi-directional. It will show any traffic with the specified port as the source or destination.
`portrange`	`Portrange` allows us to specify a range of ports. (0-1024)
`less / greater "< >"`	`less` and `greater` can be used to look for a packet or protocol option of a specific size.
`and / &&`	`and` `&&` can be used to concatenate two different filters together. for example, src host AND port.
`or`	`or` Or allows for a match on either of two conditions. It does not have to meet both. It can be tricky.
`not`	`not` is a modifier saying anything but x. For example, not UDP.

TShark

Command	Description
`tshark -h`	Prints the help menu.
`tshark -D`	List available interfaces to capture from.
`tshark -i (int)`	Capture on a selected interface. Replace (int) with the interface name or number.
`tshark -i eth0 -f "host (ip)"`	apply a filter with (-f) looking for a specific host while utilizing tshark
`D`	Will display any interfaces available to capture from and then exit out.
`L`	Will list the Link-layer mediums you can capture from and then exit out. (ethernet as an example)
`i`	choose an interface to capture from. (-i eth0)
`f`	packet filter in libpcap syntax. Used during capture.
`c`	Grab a specific number of packets, then quit the program. Defines a stop condition.
`a`	Defines an autostop condition. It can be after a duration, specific file size, or after a certain number of packets.
`r (pcap-file)`	Read from a file.
`W (pcap-file)`	Write into a file using the pcapng format.
`P`	Will print the packet summary while writing into a file (-W)
`x`	will add Hex and ASCII output into the capture.
`h`	See the help menu

WireShark

Capture Filter	Description
`host x.x.x.x`	Capture only traffic pertaining to a certain host
`net x.x.x.x/24`	Capture traffic to or from a specific network (using slash notation to specify the mask)
`src/dst net x.x.x.x/24`	Using src or dst net will only capture traffic sourcing from the specified network or destined to the target network
`port #`	will filter out all traffic except the port you specify
`not`	will capture everything except the variable specified. ex. `not port 80`
`and`	AND will concatenate your specified ports. ex. `host 192.168.1.1 and port 80`
`portrange x-x`	Portrange will grab traffic from all ports within the range only
`ip / ether / tcp`	These filters will only grab traffic from specified protocol headers.
`broadcast / multicast / unicast`	Grabs a specific type of traffic. one to one, one to many, or one to all.

Display Filter	Description
`ip.addr == x.x.x.x`	Capture only traffic pertaining to a certain host. This is an OR statement.
`ip.addr == x.x.x.x/24`	Capture traffic pertaining to a specific network. This is an OR statement.
`ip.src/dst == x.x.x.x`	Capture traffic to or from a specific host.
`dns / tcp / ftp / arp / ip`	filter traffic by a specific protocol. There are many more options.
`tcp.port == x`	filter by a specific tcp port.
`src.port / dst.port ==x`	will capture everything except the port specified.
`and / or / not`	AND will concatenate, OR will find either of two options, NOT will exclude your input option.
`tcp.stream eq #`	Allows us to follow a tcp session in which we captured the entire stream. Replace (#) with the session to reassemble.
`http`	Will filter for any traffic matching the http protocol.
`http && image-jfif`	This filter will display any packet with a jpeg image file.
`ftp`	Filters for the ftp protocol.
`ftp.request.command`	Will filter for any control commands sent over ftp control channel.
`ftp-data`	Will show any objects transfered over ftp.

Misc Commands

Command	Description
`sudo *`	Sudo will run the command that proceeds it with elevated privileges.
`which (application)`	Utilizes which to determine if (application) is installed on the host. Replace the application with what you are looking for. ex. `which tcpdump`
`sudo apt install (application)`	Uses elevated privileges to install an application package if it does not exist on the host. ex. `sudo apt install wireshark`
`man (application)`	Displays the manual pages for an application. ex. `man tcpdump`.

Common Ports and Protocols

Port Number	Protocol	Description
`20`	FTP-Data	Data channel for passing FTP files.
`21`	FTP-Command	Control channel for issuing commands to an FTP server.
`22`	SSH	Secure Shell Service port. Provides secure remote communications
`23`	Telnet	Telnet service provides cleartext communications between hosts.
`25`	SMTP	Simple Mail Transfer protocol. Utilized for email transmissions between servers.
`53`	DNS	Domain Name Services. Provides name resolution with multiple protocols
`69`	TFTP	Trivial File Transfer Protocol. A lightweight, minimal-function transfer protocol.
`80`	HTTP	HyperText Transfer Protocol. Provides dynamic web services
`88`	Kerberos	Providing cryptographic network authentication
`110`	POP3	Mail service utilized by clients to retrieve email from a server.
`111`	RPC	Remote Procedure Call. Remote service for managing network file systems.
`115`	SFTP	SSH File Transfer Protocol. An extension of SSH providing secure and reliable FTP services.
`123`	NTP	Network Time Protocol. Provides timing and sync services for network devices.
`137`	Netbios-NS	Local network name resolution.
`139`	Netbios-SSN	Provides session services for data transfer. Services like SMB can utilize it.
`179`	BGP	Border Gateway Protocol. BGP is a protocol for exchanging routing info with autonomous systems worldwide.
`389`	LDAP	Lightweight Directory Access Protocol. System agnostic authentication and authorization services.
`443`	HTTPS	HyperText Transfer Protocol Secure. An extension of HTTP utilizing SSL/TLS for encrypting the communications.
`445`	SMB	Server Message Block. SMB allows for the sharing of services, files, networking ports, and printers between hosts.