blog.6admin.io
guest@6admin.io:~$
dns, network, security, tcpdump

tcpdump: frame analysis and BPF filters

After Nemesis which forges and raw sockets which sniff by hand, the tool that does all of it without writing a line of C: tcpdump. If you have never used it, know that it is probably the highest-return diagnostic tool of your entire career: one command, one filter and you read the network in cleartext.

The BPF filter, the concept that changes everything

tcpdump alone shows ALL the traffic on the interface. It is unusable on an active network: you are drowning in ten seconds. The magic comes from the BPF filter (Berkeley Packet Filter), an expression language compiled on the fly into the kernel to only capture what matches:

# All HTTP traffic from my box to a specific server
tcpdump -i eth0 host 192.168.1.100 and port 80

# Incoming SYNs (connection attempts)
tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'

# DNS traffic
tcpdump -i eth0 port 53

# What arrives from outside
tcpdump -i eth0 src net not 192.168.1.0/24

The BPF syntax reads like approximate English: host X, port Y, src, dst, and, or, not. The bitwise operations on TCP flags (tcp[tcpflags] & tcp-syn) let you select the exact packet type without a parser.

Reading frames

# Verbose, full headers
tcpdump -vvv -i eth0 port 53

# Hex + ASCII, for packets that refuse to be read
tcpdump -X -i eth0 port 80

# Limit to N packets
tcpdump -c 100 -i eth0

The verbose output decodes every field: TTL, flags, options and for DNS, the records in the response. It is the free manual for any protocol: launch tcpdump, do the action in another window, read what really goes through.

What it is for in practice

Three diagnostics I made this week with tcpdump that would have taken hours otherwise:

  1. “The mail does not pass”: tcpdump port 25 and we see the remote server answer RST. Firewall at the hoster, not here.
  2. “The site is slow”: tcpdump port 80 and we see the server answer in three packets then DNS re-query between each. Empty DNS cache at every request, TTL at zero.
  3. “We are being scanned”: tcpdump ’tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0’ and we count the sources. More than ten SYN/s without ACK from the same IP, that is a scan.

For those who write in C

If you have read the raw sockets article , you know that tcpdump does what your C code does: a socket(AF_PACKET, SOCK_RAW), a BPF filter applied via setsockopt(SO_ATTACH_FILTER) and a recvfrom() loop. tcpdump does no magic, it does exactly what you already know how to write, but with twenty years of debugging on top.