TCPDUMP (Command-line action)-grab, filter, advanced filter, process documentation

TCPDUMP
No-gui's Clutch analysis tool
Linux, UNIX system default installation

tcpdump-– Grab Bag
Grab Bag
Only 68 bytes are caught by default
Tcpdump-i eth0-s 0-w File.pcap
Tcpdump-i eth0 Port 22
Read the Capture package file
Tcpdump-r File.pcap

Options Introduction

-A prints out all the groupings in ASCII format and minimizes the head of the link layer.
-C Tcpdump will stop after receiving the specified number of packets.
-C checks whether the current size of the file exceeds the size specified in the parameter file_size before writing an original grouping to the file. If the specified size is exceeded, the current file is closed, and then a new file is opened. The units of the parameter file_size are megabytes (1,000,000 bytes, not 1,048,576 bytes).
-D gives the code for matching packets in a compiled format that people can understand.
-DD the code for matching packets in the format of the C program segment.
The code for matching packets is given in decimal form-ddd.
-D prints out all network interfaces in the system that can be truncated with tcpdump.
-e Prints the header information of the data link layer on the output line.
-E uses the [email protected] Algo:secret to decrypt the IPSec ESP groupings with addr as the address and contains the Security parameter index value SPI.
-F Prints the external Internet address as a digital form.
-F reads an expression from the specified file, ignoring the expression given in the command line.
-i specifies the network interface to listen on.
-L causes the standard output to become a buffered line and can export data to a file.
-l lists the known data links for the network interface.
-M imports the SMI MIB module definition from the file module. This parameter can be used multiple times to import multiple MIB modules.
-M if the TCP-MD5 option exists in the TCP message, you need to use secret as the shared verification code to verify the summary of the TCP-MD5 selection option (refer to RFC 2385 for details).
-B Select Protocols on the data-link layer, including IP, ARP, RARP, and IPX.
-N does not convert the network address into a name.
-nn does not perform a conversion of port names.
-N does not output the domain name portion of the hostname. For example, ' nic.ddn.mil ' only outputs ' NIC '.
-T does not print a timestamp on each line of the output.
-O does not run the grouping grouping matching (packet-matching) code optimizer.
-P does not set the network interface to promiscuous mode.
-Q fast output. Only less protocol information is output.
-R reads the package from the specified file (these packages are typically generated through the-w option).
-S outputs the serial number of TCP as absolute value, not relative.
-S reads the first Snaplen bytes from each packet, rather than the default of 68 bytes.
-T directly interprets the heard packet as a specified type of message, the common type has RPC remote procedure call) and SNMP (Simple Network Management Protocol;).
-T does not output a timestamp in each row.
-TT output a non-formatted timestamp in each row.
-TTT outputs the time difference between the line and the previous row.
-TTTT prints the timestamp of the default format processed by date in each row.
-U outputs an NFS handle that is not decoded.
-V outputs a slightly more detailed information, such as the TTL and the type of service that can be included in the IP packet.
The-VV outputs detailed message information.
-W directly writes the groupings to the file instead of parsing and printing them out.

root:~# tcpdump-hTcpdumpversion 4.3. 0Libpcapversion 1.3. 0Usage:tcpdump [-AABDDEFHHIJKLLNNOPQRSTUUVXX] [-B size] [-c Count] [-c file_size] [-e Algo:secret] [-Ffile] [-Gseconds] [-I interface] [-j tstamptype] [-M secret] [-Rfile] [-S snaplen] [-t type] [-Wfile] [-W filecount] [-y datalinktype] [-Z Command ][-Z User] [Expression]root:~# tcpdump-i Eth0-s 0-w a.cap//Listening network interface byte is 0 saved to the A.cap fileTcpdump:listeningOn   eth0, link-type en10mb(Ethernet), capture size  65535 bytes ^C15 Packets Captured thePackets receiced by Filter0Packets drodded byKernel

We use the ping IP command to generate some SMP data traffic. As you can see, we've got 15 packets.

root:～# tcpdump -r a.cap                  //来读取a.cap文件内容

root:~# Tcpdump-a-R a.cap//print out all the groupings in ASCII format and read this file

root:~# Tcpdump-x-R a.cap//print out all the groupings in hexadecimal format and read this file

root:~# tcpdump-i eth0 TCP port 22 catches only tcp,22 ports, here we use NC to connect the other virtual machine 22 port

tcpdump--filtering

Tcpdump- N - Rhttp.Cap|Awk' {print $} '|Sort- u//-n does not parse the domain name, only in the form of an IP address; awk ' {print $} ' displays the contents of the third column; sort-u filter out duplicate contentTcpdump- NSRC Host145.254.. 237 - Rhttp.Cap///Only the source IP of the packet (source) 145.254.160.237 is the only extractTcpdump- NDST Host145.254.. 237 - Rhttp.Cap///Only the packet is the destination address 145.254.160.237 is displayed.Tcpdump- NPort - - Rhttp.Cap//50 PortTcpdump-nxPort the - Rhttp.Cap//16 binary Display 80 port information

The TCP header structure is as follows, the 8 bits are one byte, each behavior four bytes, altogether is 32 bits, the source end share population The preceding 16 bits, two bytes; the destination port is the same; the third column in row four is the label bit

0                  1                    2                   30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|     Source Port | Destination Port |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|Sequence  Number|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Acknowledgment Nuber |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|Date| |C|E| u| a| p| r| a|                               F| ||Offset| res.| w|C| r|C| s| s| y|I|        Windwos | |      | | r|E| G|K| h| T|N|N|            |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|     Checksum | Urgent Pointer |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|Options|Padding|+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Data |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

TCPDUMP-A-n ' tcp[13]=24 '-r HTTP.CAP//ASCLL code only shows tcp13 bits of 24

Process document Recording
Dradis
Short-term temporary small team resource sharing
Various plug-in import files
Keepnote
Truecrypt








Here's a look at Keepnote

Application-–>office-–>keepnote
New Notebook
Create a new Keepnote



TrueCrypt is a free, open source encryption software that supports Windows VISTA,7/XP, Mac os X, Linux and other operating systems. TrueCrypt does not need to generate any files to establish a virtual disk on the hard disk, the user can be accessed according to the drive letter, all the files on the virtual disk are automatically encrypted and need to be accessed through a password. TrueCrypt offers a variety of cryptographic algorithms, including: AES-256, Blowfish (448-bit key), CAST5, Serpent, Triple DES, and Twofish, and other features that support FAT32 and NTFS partitions, hidden volume labels , hotkey startup, and so on.


Create a file, or encrypt a partition.

Standard volume and hidden encryption volume, after the Don't say, want to ask what message ...

TCPDUMP (Command-line action)-grab, filter, advanced filter, process documentation