I'm trying to learn to use tcpdump. I thought I'd eavesdrop on my ssh login. The setup is a bit unusual, I have OS X Lion running VirtualBox, with Ubuntu running in the VM. I have ssh enabled and can login from OS X normally:
> ssh -p 22 10.0.1.2 -l telliott
Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-17-generic i686)
* Documentation: https://help.ubuntu.com/
0 packages can be updated.
0 updates are security updates.
Last login: Sat Mar 31 19:54:36 2012 from toms-mac-mini.local
telliott@U32:~$ logout
Connection to 10.0.1.2 closed.
>
I have not obfuscated the ssh port on Ubuntu. From OS X, stroke gives what I expect:
> ./stroke 10.0.1.2 22 22
Port Scanning host: 10.0.1.2
Open TCP Port: 22 ssh
So from OS X I do:
> sudo tcpdump -i en1 -v port 22
Password:
tcpdump: listening on en1, link-type EN10MB (Ethernet), capture size 65535 bytes
Then I login from OS X to Ubuntu using ssh, but I see nothing with tcpdump. Here is ifconfig from Ubuntu:
telliott@U32:~$ ifconfig
eth1 Link encap:Ethernet HWaddr 08:00:27:d7:ba:0e
inet addr:10.0.1.2 Bcast:10.0.1.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fed7:ba0e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:799 errors:0 dropped:0 overruns:0 frame:0
TX packets:465 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:96863 (96.8 KB) TX bytes:68638 (68.6 KB)
Where are the packets I was hoping to see? Thanks for any help.
Update: on OS X
> ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=3<RXCSUM,TXCSUM>
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=27<RXCSUM,TXCSUM,VLAN_MTU,TSO4>
ether 60:fb:42:f4:cd:9e
media: autoselect
status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:26:b0:fa:75:7f
inet6 fe80::226:b0ff:fefa:757f%en1 prefixlen 64 scopeid 0x5
inet 10.0.1.3 netmask 0xffffff00 broadcast 10.0.1.255
media: autoselect
status: active
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 60:fb:42:ff:fe:f4:cd:9e
media: autoselect <full-duplex>
status: inactive
Update 2:
Realized now this is a silly question because (i) tcpdump on port 22 on Ubuntu works as you'd expect and (ii) I never actually opened port 22 on OS X. ssh is working through some magic of the "bridged" mode of the VM that I don't understand yet. I'm trying to get the solution below working, as I'm sure it will.
ifconfig
on the OSX box? Depending on how it's configured, you may or may not want to be using en1.