Lab Objective:
Learn how to use the tcpdump command and its switches.
Lab Purpose:
Tcpdump is the gold standard of network analysis tools. Using it to its full capabilities requires a thorough understanding of TCP/IP. It comes with a variety of filters and switches that reduce the output level displayed. Never use this tool on a live network unless you know what you are doing and have permission. This lab is a short dip into this very powerful tool.
Lab Tool:
Ubuntu or most other Linux distributions
Lab Topology:
Please use the following topology to complete this lab exercise. I used a virtual Ubuntu machine running inside VirtualBox.
Lab Walkthrough:
Task 1:
Pull up a command prompt. You have several options here (feel free to google them if you are unfamiliar with Linux/Unix/Ubuntu). I used the search facility and typed ‘terminal’ to bring up the icon.
Task 2:
You may well have to run the tcpdump command as sudo tcpdump, which runs the command with advanced user privileges.
Task 3:
Issue a sudo tcpdump -i any command. This will listen on all available interfaces to determine if there is any traffic. You can quit the output anytime by pressing the Ctrl button and the C key.
Task 4:
The sudo tcpdump -D command will list all your available interfaces. The output may look a little strange because I’m using a virtual machine, so there is no physical interface. My Ethernet interface name is listed in 1. below.
Task 5:
You can configure tcpdump to print only for a specific interface with the sudo tcpdump -i enp0s3 command (if enp0s3 is your interface name).
Task 6:
Monitor ICMP traffic with the sudo tcpdump icmp command. Then open another command line window.
And ping a website, such as 101labs.net or cisco.com. After a few seconds, press Ctrl and C to stop the packets.
Task 7:
Check the capture and compare against the ping window. As you know from your study guide, ping uses echo request and echo reply. The outgoing and incoming packets have sequence (seq) numbers which will match 1-1, 2-2, etc.
Notes:
It would take an experienced network engineer several weeks to gain a deep understanding of this command-line tool, which is why many of us use packet-capture programs such as Wireshark. Here is a sample command stack for tcpdump to capture only TCP FIN flags:
# tcpdump ‘tcp[13] & 1!=0’
# tcpdump ‘tcp[tcpflags] == tcp-fin’
Above command acknowledgment – https://danielmiessler.com/study/tcpdump/
