How to - Monitor Packet Flow Using Tcpdump

How To - Monitor packet flow with tcpdump

How To – Monitor packet flow using tcpdump

tcpdump prints out the headers of packets on a network interface that match the Boolean expression. tcpdump is a packet capture tool that allows to intercept and capture packets passing through a network interface, making it useful for understanding and troubleshooting network layer problems. It will help to monitor packet flow coming on interface, response for each packet, packet drop, and ARP information. This This ut utilit ility y wil willl not not be be of mu much hel help p to to iden identtify ify and and tr troubl ouble eshoo shoott pr proble oblem ms rela relatted to to App Applica licattion, ion, hen hence ce before using this tool try to understand the behavior of the problem. Usage

Use from Cyberoam Telnet Console, option 4 Cyberoam Console

How to view traffic of the

tcpdump command

Example Example

specific specific host

tcpdump ’host ipaddres s>’

tcpdump tcpdump ‘host 10.10.10.1’

specific specific source source host

tcpdump tcpdump ’src host ipaddress>’’

tcpdump ‘src host 10.10.10.1’

specific specific destination host

tcpdump tcpdump ’dst host host ipaddress>’’

tcpdump ‘dst host 10.10.10.1’

specific specific network

tcpdump tcpdump ’net address>’

tcpdump tcpdump ‘net 10.10.10.0’

specific specific source source network

tcpdump ’src net address>’

tcpdump tcpdump ‘src net 10.10.10.0’

specific specific destination network

tcpdump ’dst net address>’

tcpdump ‘dst net 10.10.10.0’

speci specific fic port

tcpdump ’port port-number>’

tcpdump ‘port 21’

specific specific source source port

tcpdump ’src port ’

tcpdump tcpdump ‘src port 21’

specific specific destination port

tcpdump tcpdump ’dst port ’

tcpdump ‘dst port 21’

specific host for the particular port the specific host for all the ports except SSH specific protocol

pari parittcula cularr int interfa erface ce

tcpdump ‘host and port tcpdump ‘host 10.10.10.1 and ’ port 21’ tcpdump ‘host and port tcpdump ‘host 10.10.10.1 and not ’ port not 22’ tcpdump ’proto ’proto ICMP IC MP’’ tcpdump ’proto UDP’ tcpdum tcpdump ’proto ’proto TCP TC P ’ tcpdump tcpdump ‘arp’ ‘arp’ tcpdu cpdum mp int interfa erface ce > tcpdu cpdum mp int interfa erface ce eth1 eth1

specific port of a particular interface

tcpdump interface interface ‘port tcpdump interface eth1 ‘port 21’ ’

Note: Expression Expression can be combined us ing l ogical operators AND or OR and with NOT NOT also. Make Make sure to use different different combinations w ithin sin gle quotes.


Port Mapping

Appliance – 50i, 100i, 250i, 500i Port

Physical Interface

A

eth0

B

eth1

C

eth2

D

eth3

Appliance – 1000i, 1500i Port

Physical Interface

A

eth6

B

eth7

C

eth8

D

eth9

E

eth0

F

eth1

G

eth2

H

eth3

Analyzing t cp dump output

corporate> tcpdump 'port 21' Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on all devices 12:29:33.860721 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: S 4023323694:4023 323694(0) win 65535 (DF) 12:29:33.860769 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: S 4023323694:402 3323694(0) win 65535 (DF) 12:29:33.861293 eth1 <161.114.22.105.ftp >192.168.13.40.1633: S 1587918290:158 7918290(0) ack 4023323695 win 5840 (DF) 12:29:33.861324 eth0 >161.114.22.105.ftp >172.16.16.81.1633: S 1587918290:1587 918290(0) ack 4023323695 win 5840 (DF) 12:29:33.861530 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: . 1:1(0) ack 1 win 65535 (DF) 12:29:33.861567 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: . 1:1(0) ack 1 win 65535 (DF) 12:29:34.872070 eth1 <161.114.22.105.ftp >192.168.13.40.1633: P 1:65(64) ack 1 win 5840 (DF) 12:29:34.872114 eth0 >161.114.22.105.ftp >172.16.16.81.1633: P 1:65(64) ack 1 win 5840 (DF) 12:29:34.977585 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: . 1:1(0) ack 65 win 65471 (DF) 12:29:34.977623 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: . 1:1(0) ack 65 win 65471 (DF) 12:29:45.885899 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: P 1:17(16) ack 65 win 65471 (DF)


12:29:45.885937 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: P 1:17(16) ack 65 win 65471 (DF) 12:29:45.886350 eth1 <161.114.22.105.ftp >192.168.13.40.1633: . 65:65(0) ack 17 win 5840 (DF) 12:29:45.886369 eth0 >161.114.22.105.ftp >172.16.16.81.1633: . 65:65(0) ack 17 win 5840 (DF) 12:29:46.280547 eth1 <161.114.22.105.ftp >192.168.13.40.1633: P 65:133(68) ack 17 win 5840 (DF) 12:29:46.280567 eth0 >161.114.22.105.ftp >172.16.16.81.1633: P 65:133(68) ack 17 win 5840 (DF) 12:29:46.444599 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: . 17:17(0) ack 133 win 65403 (DF) 12:29:46.444639 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: . 17:17(0) ack 133 win 65403 (DF) 12:29:52.568606 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: P 17:31(14) ack 133 win 65403 (DF) 12:29:52.568638 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: P 17:31(14) ack 133 win 65403 (DF) 12:29:52.569079 eth1 <161.114.22.105.ftp >192.168.13.40.1633: . 133:133(0) ack 31 win 5840 (DF) 12:29:52.569097 eth0 >161.114.22.105.ftp >172.16.16.81.1633: . 133:133(0) ack 31 win 5840 (DF) 12:30:00.428258 eth1 <161.114.22.105.ftp >192.168.13.40.1633: P 133:181(48) ack 31 win 5840 (DF) 12:30:00.428289 eth0 >161.114.22.105.ftp >172.16.16.81.1633: P 133:181(48) ack 31 win 5840 (DF) 12:30:00.627489 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: . 31:31(0) ack 181 win 65355 (DF) 12:30:00.627532 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: . 31:31(0) ack 181 win 65355 (DF) 12:30:07.696901 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: P 31:37(6) ack 181 win 65355 (DF) 12:30:07.696937 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: P 31:37(6) ack 181 win 65355 (DF) 12:30:07.698430 eth1 <161.114.22.105.ftp >192.168.13.40.1633: . 181:181(0) ack 37 win 5840 (DF) 12:30:07.698450 eth0 >161.114.22.105.ftp >172.16.16.81.1633: . 181:181(0) ack 37 win 5840 (DF) 12:30:08.133574 eth1 <161.114.22.105.ftp >192.168.13.40.1633: P 181:227(46) ack 37 win 5840 (DF) 12:30:08.133593 eth0 >161.114.22.105.ftp >172.16.16.81.1633: P 181:227(46) ack 37 win 5840 (DF) 12:30:08.272170 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: . 37:37(0) ack 227 win 65309 (DF) 12:30:08.272205 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: . 37:37(0) ack 227 win 65309 (DF) 12:30:08.526813 eth1 <161.114.22.105.ftp >192.168.13.40.1633: P 227:293(66) ack 37 win 5840 (DF) 12:30:08.526832 eth0 >161.114.22.105.ftp >172.16.16.81.1633: P 227:293(66) ack 37 win 5840 (DF) 12:30:08.526981 eth1 <161.114.22.105.ftp >192.168.13.40.1633: FP 293:370(77) ack 37 win 5840 (DF) 12:30:08.527006 eth0 >161.114.22.105.ftp >172.16.16.81.1633: FP 293:370(77) ack 37 win 5840 (DF) 12:30:08.527221 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: . 37:37(0) ack 371 win 65166 (DF) 12:30:08.527248 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: . 37:37(0) ack 371 win 65166 (DF) 12:30:08.536286 eth0 <172.16.16.81.1633 >161.114.22.105.ftp: F 37:37(0) ack 371 win 65166 (DF) 12:30:08.536312 eth1 >192.168.13.40.1633 >161.114.22.105.ftp: F 37:37(0) ack 371 win 65166 (DF) 1st line: Brown color shows timestamp of the packet Green color shows the incoming interface Blue color shows source address who originates the request Red color shows destination IP address Orange color shows services which is being accessed Pink color shows flag of particular packet. This is new connection originated by 172.16.16.81 IP address & destined for 161.114.22.105 to access FTP services. This is first packet so flag is set to Sync “S” 3rd line: As three ways handshaking needs to be complete, second packet is the response coming back from server with “Ack” for Sync packet. This is nothing but “Syn-Ack” packet. 4th Line: “Ack” packet sent by source for “Syn-Ack”. For any tcp connection first three lines are like Source to Destination-- Sync Destination to Source-- Sync-Ack Source to Destination—Ack


5th to 40th Line: P ush packet (Data Packet) because of “P” & “.” Flag 41st and 42nd Line: Termination of FTP connection because “F” flag Flag Information:

“S” – Sync packet for new connection “S” – Sync packet with “ack” “P” – Push packet containing Data “.” -- No data information, only “ack” “F” – FIN packet which provides information of termination of connection “R” – Reset packet, Packet which dropped in between somewhere at firewall end

Advanced Usage View p acket con tents in hexadecimal notations

corporate> tcpdump hex Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on all devices 13:49:04.438097 eth0 >192.168.13.40.telnet >172.16.16.81.1916: P 831812622:831 812624(2) ack 616504356 win 5840 (DF) 4500 002a 4841 4000 4006 685b c0a8 0d28 ac10 1051 0017 077c 3194 740e 24bf 1c24 5018 16d0 13a6 0000 0d0a 13:49:04.545219 eth1 B arp who-has 192.168.2.30 (Broadcast) tell 192.168.2.31 0001 0800 0604 0001 0003 ba29 8f63 c0a8 021f ffff ffff ffff c0a8 021e 0000 0000 0000 0000 0000 0000 0000 0000 0000 13:49:04.553181 eth0 <172.16.16.81.1916 >192.168.13.40.telnet: . 1:1(0) ack 2 win 65523 (DF) 4500 0028 3c3b 4000 8006 3463 ac10 1051 c0a8 0d28 077c 0017 24bf 1c24 3194 7410 5010 fff3 3794 0000 0000 0000 0000 13:49:04.553217 eth0 >192.168.13.40.telnet >172.16.16.81.1916: P 2:538(536) ack 1 win 5840 (DF) 4500 0240 4842 4000 4006 6644 c0a8 0d28 ac10 1051 0017 077c 3194 7410 24bf 1c24 5018 16d0 058f 0000 4b65 726e 656c 2066 696c 7465 722c 2070 726f 746f 636f 6c20 414c 4c2c 2064 6174 6167 7261 6d20 7061 636b 6574 2073 6f63 6b65 740d 0a74 6370 6475 6d70 3a20 6c69 7374 656e 696e 6720 6f6e 2061 6c6c 2064 6576 6963 6573 0d0a 3133 3a34 393a 3034 2e34 3338 3039 3720 13:49:04.662912 eth1 B arp who-has 192.168.13.4 tell 192.168.13.5 0001 0800 0604 0001 000c 29ca 2f1e c0a8 0d05 0000 0000 0000 c0a8 0d04 0000 0000


0000 0000 0000 0000 0000 0000 0000 13:49:04.674536 eth1 B arp who-has 192.168.1.93 tell 192.168.1.206 0001 0800 0604 0001 0008 a132 e4f0 c0a8 01ce 0000 0000 0000 c0a8 015d 5d00 0100 0001 0000 0000 0000 046a 6973 7000 View p acket cont ents with Ethernet or other layer 2 header information

corporate> tcpdump llh Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on all devices 13:49:51.785823 eth1 B 0:3:ba:29:8f:63 Broadcast arp 60: arp who-has 192.168.2.3 0 (Broadcast) tell 192.168.2.31 13:49:51.868616 eth1 B 0:11:43:56:7d:7a Broadcast ip 92: 192.168.1.23.netbios-ns > 192.168.15.255.netbios-ns:NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:51.930139 eth0 <0:11:11:93:47:9b 0:0:0:0:0:1 ip 60: 172.16.16.81.1916 >1 92.168.13.40.telnet: . 616504364:616504364(0) ack 831819683 win 65281 (DF) 13:49:51.930177 eth0 > 0:0:0:0:0:0 0:10:f3:9:cf:da ip 412: 192.168.13.40.telnet >172.16.16.81.1916: P 1:359(358) ack 0 win 5840 (DF) 13:49:52.131308 eth0 <0:11:11:93:47:9b 0:0:0:0:0:1 ip 60: 172.16.16.81.1916 >1 92.168.13.40.telnet: . 0:0(0) ack 359 win 64923 (DF) 13:49:52.131339 eth0 > 0:0:0:0:0:0 0:10:f3:9:cf:da ip 345: 192.168.13.40.telnet >172.16.16.81.1916: P 359:650(291) ack 0 win 5840 (DF) 13:49:52.165068 eth1 B 0:10:f3:a:a5:fd Broadcast arp 60: arp who-has 3.3.3.1 tel l 3.3.3.3 13:49:52.328476 eth1 B 0:13:20:dc:d0:63 Broadcast ip 110: 192.168.4.51.netbios-n s > 192.168.15.255.netbios-ns:NBT UDP PACKET(137): RELEASE; REQUEST; BROADCAST 13:49:52.328986 eth1 B 0:13:20:dc:d0:63 Broadcast ip 110: 192.168.4.51.netbios-n s > 192.168.15.255.netbios-ns:NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADC AST 13:49:52.332491 eth0 <0:11:11:93:47:9b 0:0:0:0:0:1 ip 60: 172.16.16.81.1916 >1 92.168.13.40.telnet: . 0:0(0) ack 650 win 64632 (DF) 13:49:52.332519 eth0 > 0:0:0:0:0:0 0:10:f3:9:cf:da ip 741: 192.168.13.40.telnet >172.16.16.81.1916: P 650:1337(687) ack 0 win 5840 (DF) 13:49:52.370134 eth1 B 0:7:e9:2e:6c:c1 Broadcast arp 60: arp who-has 192.168.1.1 6 (Broadcast) tell 192.168.1.16 Generate binary f ile of traffic log generated w ith custom parameters

Cyberoam also supports to save and download the tcpdump output in a binary file from Telnet Console. File tcpdump contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team. To save the output in the downloadable file, log on to Telnet Console: •

Go to Option 4 Cyberoam Console

At the command prompt, issue the command: tcpdump filedump

•

Cyberoam saves this file under the name tcpdump.out Download from http:///documents/tcpdump.out and mail this file to Cyberoam Support team at [email protected]


Monitoring VPN traffic

Cyberoam will automatically configure VP N IPSec interface for each WAN port configured. For example, if Port B and Port C are configured as WAN ports then Cyberoam will configure ipsec0 and ipsec1 for Port B and Port C respectively. Use these ipsec ports to monitor VPN traffic e.g. tcpdump “-i ipsec0”

Document Version: 2.0-24/09/2007

How to - Monitor Packet Flow Using Tcpdump

Recommend Documents