Posts Tagged ‘promiscuous’
October 23rd, 2008 | 
Author: Some times I had to use some tools to test the network to find some problems or simply to debug something not working fine.
Tcpdump is a popular computer network debugging and security tool which allows the user to intercept and display TCP/IP packets being transmitted or received over a network to which the computer is attached. Tcpdump allows to precisely see all the traffic and enables to create statistical monitoring scripts.
At an ethernet segment, tcpdump operates by putting the network card into promiscuous mode in order to capture all the packets going through the wire. Using tcpdump we have a view on any TCP/UDP connection establishment and termination.
Obviously, if you can mirror one or more port on the network devices to the port on which your computer is connected you’ll obtain a lot more data.
Some examples:
all packets arriving at or departing from 192.168.1.1
# tcpdump -n host 192.168.1.1
To print traffic between 192.168.1.1 and either 10.0.0.1 or 10.0.0.2:
# tcpdump -n host 192.168.1.1 and \( 10.0.0.1 or 10.0.0.2 \)
To print all IP packets between 192.168.1.1 and any host except 10.0.0.1:
# tcpdump ip -n host 192.168.1.1 and not 10.0.0.1
To print all traffic between local hosts and hosts at Berkeley:
# tcpdump net ucb-ether
To print all ftp traffic through internet gateway yyy:
# tcpdump ‘gateway yyy and (port ftp or ftp-data)’
To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net).
# tcpdump ip and not net localnet
To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
# tcpdump ‘tcp[13] & 3 != 0 and not src and dst net localnet’
To print IP packets longer than 576 bytes sent through gateway yyy:
# tcpdump ‘gateway yyy and ip[2:2] > 576′
To print IP broadcast or multicast packets that were not sent via ethernet broadcast or multicast:
# tcpdump ‘ether[0] & 1 = 0 and ip[16] >= 224′
To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):
# tcpdump ‘icmp[0] != 8 and icmp[0] != 0″
Hope this help
Bye
Riccardo
