2

I'm trying to do automated treatment of pcap with tcpdump (to store them in ELK). My problem is I need to have access to TCP flags, and I can't identify if a packet is TCP or UDP.

If I use -q, there is a pretty obvious field after the destination port number, but TCP flags are not displayed :

Oct 04 16:47:21.058974 00:08:e3:ff:fc:04 00:00:5e:00:01:19 171: 10.193.47.54.3389 > 10.60.2.87.54075: tcp 117 (DF) [tos 0x2 (E)] (ttl 127, id 14452, len 157)
Oct 04 16:47:21.058990 2c:76:8a:53:2f:d6 00:08:e3:ff:fc:04 157: 10.60.7.17.54934 > 10.194.151.66.53522: udp 115 (ttl 62, id 0, len 143, bad ip cksum 0! -> c90d)

If I remove the -q flag, this field mostly disappears. It is only filled for UDP packets, but not every time (especially DNS and SNMP requests).

Oct 04 16:49:52.964277 00:08:e3:ff:fc:04 00:00:5e:00:01:19 0800 172: 10.194.5.11.53 > 10.202.7.126.55187: 61642 NXDomain 0/1/0 (130) (ttl 126, id 10111, len 158)
Oct 04 16:51:59.321776 2c:76:8a:53:2f:d6 00:08:e3:ff:fc:04 0800 128: 10.60.2.46.161 > 10.194.125.121.41624: |30|54|02|01|04|05C=toto47 |a2|48GetResponse(60)|02|02|02|01|02|01|30|3c |30|12|06|0c.1.3.6.1.2.1.25.5.1.1.2.4305=|02|022824 |30|13|06|0c.1.3.6.1.2.1.25.5.1.1.1.4305=|02|03539869 |30|11|06|0c.1.3.6.1=[|snmp] (ttl 62, id 0, len 114, bad ip cksum 0! -> e7d6)

Is there a way so that l4 protocol is always displayed in the output, without loosing the TCP flags ? Or at least to always display if this is UDP ?

Or will I have to do some complicated logstash filtering to sort out DNS and SNMP ?

Thank you

2 Answers 2

1

I not sure is it your intention, but you just use -v options and then you have output like this where you have "proto":

1507132726.499248 IP (tos 0x0, ttl 64, id 60959, offset 0, flags [DF], proto UDP (17), length 59)
3
  • Unfortunately doesn't work : no matter how much -v I add, my line doesnt look like yours : tcpdump -lnettvvvi vlan4015 tcp gives me 1507213853.468162 2c:76:8a:53:2f:d6 00:08:e3:ff:fc:04 0800 1502: 10.60.254.30.3128 > 10.194.128.124.60218: P 105353:106801(1448) ack 3869 win 328 (ttl 60, id 7600, len 1488, bad ip cksum 0! -> c7df) Oct 5, 2017 at 14:31
  • try: tcpdump -i vlan4015 -ttnnv Oct 6, 2017 at 18:12
  • Still doesn't work : 1507539532.573541 10.200.126.28.22 > 10.194.11.1.55602: P 13581733:13582265(532) ack 73944 win 2190 [tos 0x10] (ttl 64, id 57723, len 572, bad ip cksum 0! -> f889). I forgot to mention this is openBSD tcpdump, so my results may differ from yours. Oct 9, 2017 at 9:00
0

Am I right in saying your priority is filtering out which packets are TCP and which are UDP?

Whilst I'm not entirely sure that this is a complete solution to your problem, one option would be to filter the output from tcpdump by level 4 protocol.

This can be done as follows to just display UDP packets:

tcpdump 'udp'

The equivalent to show only TCP packets is:

tcpdump 'tcp'
1
  • That's not what I want to achieve : one sigle tcpdump command must give me all the packets, I then process them using logstash. Oct 5, 2017 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .