Tcpdump Examples - 22 Tactical Commands | HackerTarget.com
Practical tcpdump examples to lift your network troubleshooting and security testing game. Commands and tips to not only use tcpdump but master ways to know your network. Knowing tcpdump is an essential skill that will come in handy for any system administrator, network engineer or security professional. First The Basics Breaking down the Tcpdump Command Line The following command uses common para
Monitor All HTTP Requests (like TCPdump) On a Linux Server with httpry
Monitor All HTTP Requests (like TCPdump) On a Linux Server with httpry Want to help support this blog? Try out Oh Dear, the best all-in-one monitoring tool for your entire website, co-founded by me (the guy that wrote this blogpost). Start with a 10-day trial, no strings attached. We offer uptime monitoring, SSL checks, broken links checking, performance & cronjob monitoring, branded status pages
DnsHiveをリリースã—ã¾ã—㟠| ã‚ã‚‹ç ”ç©¶è€…ã®æ‰‹è¨˜
DnsHiveã¯ãƒ‘ケットã‚ャプãƒãƒ£ã«ã‚ˆã£ã¦DNSåå‰è§£æ±ºæƒ…å ±ã®è“„ç©ã¨ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ç›£è¦–ã‚’åŒæ™‚ã«å®Ÿè¡Œã—ã€ãƒ„ールã§ã™ã€‚tcpdumpコマンドを使ã£ãŸã“ã¨ãŒã‚る人ã«ç«¯çš„ã«æ©Ÿèƒ½ã‚’説明ã™ã‚‹ã¨ã€ä»¥ä¸‹ã®æ§˜ãªä½¿ã„æ–¹ãŒã§ãã¾ã™ã€‚ # dnshive -i eth0 | grep google.com 1391871175.057028 TCP 10.0.0.5/63906 -> safebrowsing.google.com.(173.194.126.233)/443 Len:107 1391871175.102049 TCP safebrowsing.google.com.(173.194.126.233)/443 -> 10.0.0.5/63906 Len:66 1391871332.255500 TCP 10.0.0.5/63921 -> www3.l.google.com.(173.194.117.1
Wireshark ã ã‘ã«é ¼ã‚‰ãªã„! パケット解æžãƒ„ールã®ç´¹ä»‹
2. $ whoami • åå‰ï¼šæ£®ä¹… å’Œæ˜ â€¢ Twitter：@k_morihisa • æƒ…å ±ã‚»ã‚ュリティエンジニア・アナリスト • 趣味ã§ãƒãƒ‹ãƒ¼ãƒãƒƒãƒˆã‚’観察ã—ã¦ã¾ã™ http://www.morihi-soc.net/ ! • 第10回「ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ‘ケットをèªã‚€ä¼šï¼ˆä»®ï¼‰ã€ 何ãŒå¤‰ã‚ã£ãŸ!? Wireshark 1.8 http://www.slideshare.net/morihisa/wireshark-18 2
Bit-Twist: Libpcap-based Ethernet packet generator
Supported systems: Linux, BSD, macOS, and Windows. Bit-Twist is a simple yet powerful libpcap-based Ethernet packet generator and packet editor. It is designed to complement tcpdump, which by itself has done a great job at capturing network traffic. With Bit-Twist, you can now regenerate your captured traffic onto a live network! Packets are generated from tcpdump trace file (.pcap file). Bit-Twis
サーãƒã®ãƒˆãƒ©ãƒ–ルシューティングã«sysdigãŒä½¿ãˆãㆠ- $web->{note};
sysdig ã¨ã¯ï¼Ÿ Sysdig is open source, system-level exploration: capture system state and activity from a running Linux instance, then save, filter and analyze. Think of it as strace + tcpdump + lsof + awesome sauce. With a little Lua cherry on top. http://www.sysdig.org/ 上ã«æ›¸ã„ã¦ã‚る通りã€ä¸€è¨€ã§è¨€ã†ã¨ strace + tcpdump + lsof + α。tcpdumpã®ã‚ˆã†ã«-wã§æ›¸ã出ã—ã¦-rã§èªã¿è¾¼ã‚ã‚‹ã®ãŒã‚ã‚ŠãŒãŸã„。 高機能éŽãŽã¦ã¾ã 全然使ã„ã“ãªã›ã¦ãªã„ã‘ã©ã€ã±ã£ã¨è§¦ã£ãŸæ„Ÿã˜ä½¿ãˆãã†ã ãªã¨æ€ã£ãŸã‚‚ã®ã‚’紹介。 1. プãƒ
Redisã®ã‚¯ã‚¨ãƒªãƒ¼ã‚¢ãƒŠãƒ©ã‚¤ã‚¶ãƒ¼ "redis-traffic-stats" を書ãã¾ã—㟠- （ã²ï¼‰ãƒ¡ãƒ¢
redis-traffic-stats ã¨ã„ㆠRedis ã®ã‚¯ã‚¨ãƒªãƒ¼ã‚¢ãƒŠãƒ©ã‚¤ã‚¶ãƒ¼ã‚’作りã¾ã—ãŸã€‚ https://github.com/hirose31/redis-traffic-stats redis-traffic-statsã¯tcpdump -wã§æ›¸ã出ã—ãŸpcapデータを解æžã—ã¦ã€ä»¥ä¸‹ã®ã‚ˆã†ãªçµ±è¨ˆã‚’表示ã—ã¾ã™ã€‚ ç·ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯é‡ã¨å¹³å‡byte/sec ç·ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ã¨å¹³å‡ã¨ãƒ”ークã®req/sec コマンド毎ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ã€ç·ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ã«å ã‚る割åˆã€req/secã‚’ã€ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ãŒå¤šã„é †ã«ä¸Šä½10コマンドを表示 コマンド毎ã®ç·è»¢é€ãƒã‚¤ãƒˆæ•°ã€byte/secã‚’ã€ç·è»¢é€ãƒã‚¤ãƒˆæ•°ãŒå¤šã„é †ã«ä¸Šä½10コマンドを表示 コマンド別ã«ã€ã‚ー毎ã®ç·è»¢é€ãƒã‚¤ãƒˆæ•°ã€byte/secã€ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ã€ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ã®å‰²åˆã€req/secã‚’ã€ç·è»¢é€ãƒã‚¤ãƒˆæ•°ãŒå¤šã„é †ã«ä¸Šä½10ã‚ーを表示 時間ã®ã‹ã‹ã£
tcpdumpã¨tcpreplayã¨tcprewriteã¨ä»–。
1. tcpdump 㨠tcpreplay 㨠tcprewrite ã¨ä»–。 #ssmjp 2013/03/29 @togakushi 2. パケット好ãã§ã™ã‹ï¼Ÿ â— tcpdump ã£ã¦ã‚³ãƒžãƒ³ãƒ‰ã§å¥½ããªã ã‘ã¿ã‚Œã¾ ã™ï¼ â— è¦ root – NIC ㌠promiscuous mode 㸠– æµã‚Œã¦ããŸãƒ‘ケットã¯ç„¡å·®åˆ¥ã«æ‹¾ã†ãƒ¢ãƒ¼ãƒ‰ – 通常ã¯è‡ªåˆ†å®›ã¦ã®ãƒ‘ケットã—ã‹å‡¦ç†ã—ãªã„
netsniff-ng toolkit
Summary netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa. Our toolkit can be used for network development and analysis, debugging, auditin
tcptrace - Official Homepage
tcptrace is a tool written by Shawn Ostermann at Ohio University, for analysis of TCP dump files. It can take as input the files produced by several popular packet-capture programs, including tcpdump, snoop, etherpeek, HP Net Metrix, and WinDump. tcptrace can produce several different types of output containing information on each connection seen, such as elapsed time, bytes and segments sent and
é«˜è² è·ã‚µã‚¤ãƒˆã®ãƒœãƒˆãƒ«ãƒãƒƒã‚¯ã‚’見ã¤ã‘ã‚‹ã«ã¯ : DSAS開発者ã®éƒ¨å±‹
ã¯ã˜ã‚㫠アクセスãŒæ€¥å¢—ã™ã‚‹ã¨ã€å¿œç”時間ãŒè‘—ã—ã悪化ã™ã‚‹ã‚µã‚¤ãƒˆã¯ã‚ã‚Šã¾ã›ã‚“ã‹ï¼Ÿ 普段ã¯200ミリ秒以内ã§å®‰å®šã—ã¦ã‚¢ã‚¯ã‚»ã‚¹ã‚’ã•ã°ã„ã¦ã„ã‚‹ã®ã«ã€ã‚¤ãƒ™ãƒ³ãƒˆã‚„らã‚ャンペーンやらを開始ã—ãŸçž¬é–“ã‹ã‚‰ã€æ™®æ®µã®ï¼’å€ã‚„３å€ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒæ®ºåˆ°ã—ã€ãã®çµæžœã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚¿ã‚¤ãƒ ãŒ3秒ã¨ã‹9秒ã¨ã‹ã‹ã‹ã‚‹ã‚ˆã†ã«ãªã£ã¦ã—ã¾ã†ã“ã¨ã£ã¦ã‚ã‚Šã¾ã™ã‚ˆã。 ã‚るサイトã®å®ŸçŠ¶ ã¤ã„先日ã¾ã§ã€ãã‚“ãªã‚µã‚¤ãƒˆãŒç§ã®ç›®ã®å‰ã«ã‚‚ã‚ã‚Šã¾ã—ãŸã€‚自社ã§é‹å–¶ã—ã¦ã„ã‚‹æŸã‚½ãƒ¼ã‚·ãƒ£ãƒ«ç³»ã®ã‚µã‚¤ãƒˆãªã‚“ã§ã™ãŒã€ã‚¤ãƒ™ãƒ³ãƒˆé–‹å§‹æ™‚刻ã¨åŒæ™‚ã«ã‚¢ã‚¯ã‚»ã‚¹æ•°ãŒæ€¥å¢—ã™ã‚‹ã®ã§ã™ã€‚ã¨ã¯ã„ãˆã€æ‰€è©®ã¯æ™®æ®µã®2å€ã¨ã‹3å€ç¨‹åº¦ã®æ•°ãªã®ã ã‹ã‚‰ã€å°‘ãªãã¨ã‚‚1秒以内ã«ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’è¿”ã›ã‚‹ãらã„ã®æ€§èƒ½ã¯ç¶æŒã—ãŸã„ã‚‚ã®ã§ã™ã€‚ ã—ã‹ã—実際ã¯å›°ã£ãŸã“ã¨ã«ã€å¿œç”ã«3秒以上もã‹ã‹ã£ã¦ã—ã¾ã†å‡¦ç†ãŒå¤§é‡ã«ç™ºç”Ÿã—ã¦ã—ã¾ã†çŠ¶æ³ã«é™¥ã£ã¦ã—ã¾ã£ã¦ã„ã¾ã—ãŸã€‚ã“ã‚Œã¯ãã£ã¨ã€ã©ã“ã‹ã«ãƒœãƒˆãƒ«ãƒãƒƒã‚¯ãŒã‚ã‚‹ã«é•ã„ã‚ã‚Šã¾ã›ã‚“。 仮説を立
Maatkitã¯tcpdumpを食ã¹ã‚‰ã‚Œã‚‹ä¸Šï¼Œmemcachedも咀嚼出æ¥ã‚‹ï¼Ž - ã¯ã¾ã•ã
maatkitを一通り使ã£ã¦ã¿ãŸãƒ¡ãƒ¢ - ククラフト ã§ç´¹ä»‹ã—ãŸMaatkitã®MySQLã®ã‚¯ã‚¨ãƒªçµ±è¨ˆãƒ„ールmk-query-digest． mk-query-digest /var/lib/mysql/db.slow.logã¨ã„ã†é¢¨ã«ã—ã¦ï¼ŒMySQLã®ã‚¹ãƒãƒ¼ãƒã‚°ã‚’食ã¹ã¦ # Query 73: 0.00 QPS, 0.00x concurrency, ID 0x2256C8F4C0666085 at byte 322977024 # This item is included in the report because it matches --outliers. # pct total min max avg 95% stddev median # Count 0 10 # Exec time 0 20s 2s 2s 2s 2s 0 2s # Lock time 0 0 0 0 0 0
DSAS開発者ã®éƒ¨å±‹:ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ‘ケットを覗ã„ã¡ã‚ƒãˆ
レイヤをå•ã‚ãš (ethernet ã‹ã‚‰ HTTP ã‚„ SMTP ã¾ã§) ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯çµ¡ã¿ã®ãƒˆãƒ©ãƒ–ルシューティングや挙動ã®ç¢ºèªã‚’ã™ã‚‹ã¨ãã«ãƒ‘ケットã®æµã‚ŒãŒè¦‹ã‚‰ã‚Œã‚‹ã¨éžå¸¸ã«æœ‰ç›Šã§ã™ã€‚ 開眼ã™ã‚‹ã¨ã€Œãƒ‘ケットã®æµã‚ŒãŒç›®ã§è¦‹ãˆã‚‹ã€ãã†ã§ã™ãŒã€ç§ãªã©ã¯ã¾ã ã¾ã 修行ãŒè¶³ã‚Šãšè£¸çœ¼ã§ã¯è¦‹ãˆãªã„ã®ã§ã€tcpdump ã¨ã„ã†ãƒ„ールを使ã£ã¦è¦‹ã¦ã„ã¾ã™ã€‚ tcpdump ã¯ãã®åå‰ãŒã‚ã¾ã‚Šã‚ˆããªã„ã¨ç§ã¯æ€ã£ã¦ã„ã¦ã€"tcp" ã ã‘ã§ãªã udp ã‚„ICMP ã‚„ ethernet フレームã¾ã§è¦—ã‘る超強力ツールã§ã™ã€‚ ã¨ã„ã†ã‚ã‘㧠tcpdump ã®ç°¡å˜ãªèª¬æ˜Žã‚’書ã„ã¦ã¿ã¾ã™ã€‚ tcpdumpã«ã¤ã„㦠tcpdump 㯠UNIX 系㮠OS ã§ä½¿ãˆã‚‹ãƒ„ールãªã®ã§ã™ãŒã€Windows 用ã«ã¯WinDumpã¨ã„ㆠCUI ã®ãƒ„ールãŒã‚ã‚Šã€tcpdump ã¨åŒã˜ã‚ˆã†ã«ä½¿ãˆã¾ã™ã€‚ GUI ãŒãŠå¥½ã¿ã®æ–¹ã¯ã€å¾Œã§ã‚‚紹介ã™ã‚‹E
Windows管ç†ã®ç¾å ´ã§ä½¿ã†ï¼Œ8ã¤ã®ä¾¿åˆ©ãªç„¡å„Ÿãƒ¦ãƒ¼ãƒ†ã‚£ãƒªãƒ†ã‚£
Windows管ç†ã®ç¾å ´ã§ä½¿ã†ï¼Œ8ã¤ã®ä¾¿åˆ©ãªç„¡å„Ÿãƒ¦ãƒ¼ãƒ†ã‚£ãƒªãƒ†ã‚£ オープン・ソース・コミュニティã®è³œç‰©ã‚’利用ã—よㆠシステム管ç†ã®ç”Ÿç”£æ€§ã¯ï¼Œé©åˆ‡ãªãƒ„ールを用ã„ã‚‹ã“ã¨ã«ã‚ˆã£ã¦çˆ†ç™ºçš„ã«å‘上ã™ã‚‹ã€‚特ã«ï¼Œä½œæ¥æ™‚é–“ã®çŸç¸®ã¨ï¼Œä½œæ¥ä¸ã«å¾—られるデータã®å¹…広ã•ã‚„æ£ç¢ºæ€§ã®æ”¹å–„ãŒå›³ã‚Œã‚‹ã®ã 。管ç†ã®ç”Ÿç”£æ€§ã®å‘上ãŒé¡§å®¢æº€è¶³åº¦å‘上ã«ã¤ãªãŒã‚‹ã®ã¯è¨€ã†ã¾ã§ã‚‚ãªã„。ç†è€…ã¯ãã‚“ãªç”Ÿç”£æ€§å‘上を実ç¾ã™ã‚‹8ã¤ã®ãƒ„ールを，ã„ã¤ã‚‚USBメモリーã«å…¥ã‚Œã¦æŒã¡æ©ã„ã¦ã„る。ã“ã®ãƒ„ールãŒæœ€é«˜ãªã®ã¯ï¼Œã™ã¹ã¦å®Œå…¨ã«ç„¡å„Ÿã ã¨ã„ã†ã“ã¨ã 。 コミュニケーションã«ä½¿ç”¨ã™ã‚‹ãƒ¦ãƒ¼ãƒ†ã‚£ãƒªãƒ†ã‚£ FileZilla Webホスティングæ¥ç•Œã§åƒã„ã¦ã„ãŸã¨ã，サーãƒãƒ¼é–“ã§å¤šé‡ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã¨ãƒ•ã‚¡ã‚¤ãƒ«ã‚’移動ã•ã›ãªã‘ã‚Œã°ãªã‚‰ãªã„ã“ã¨ãŒé »ç¹ã«ã‚ã£ãŸã€‚ç§ã®ã‚る顧客ã¯ï¼ŒWebサイト上ã§æœ€æ–°ç‰ˆã‚³ãƒ¼ãƒ‰ã‚’é…布ã—ã¦ã„ãŸãŸã‚，顧客もç§ã¨åŒæ§˜ã®ä½œæ¥ã‚’ã™ã‚‹å¿…è¦ãŒã‚ã£ãŸã€‚顧客ã«é›»è©±ã§ã‚³ãƒžãƒ³ãƒ‰ãƒ»
ファイアウォールã®è¨å®šãƒ»å‹•ä½œãƒã‚§ãƒƒã‚¯æ–¹æ³•
ファイアウォールを構築ã—ãŸã‚‰ã‚µãƒ¼ãƒã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã£ãŸã€‚ã‚ã‚‹ã„ã¯ã€ä¸€è¦‹æ£ã—ã動作ã—ã¦ã„るよã†ã§ã‚‚ルールã«æŠœã‘ç©´ãŒã‚ã‚Œã°æ„味ãŒãªã„。ファイアウォールã®å‹•ä½œãŒæœ¬å½“ã«é©åˆ‡ã‹ã©ã†ã‹ã€å„種ã®ãƒ„ールを利用ã—ã¦ãƒã‚§ãƒƒã‚¯ã—よã†ã€‚ 第3回ã‹ã‚‰3回ã«åˆ†ã‘ã¦ã€ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ã®æ§‹ç¯‰æ–¹æ³•ã‚’紹介ã—ã¦ãã¾ã—ãŸã€‚今回ã¯ã€æ§‹ç¯‰ã—ãŸãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ã®å‹•ä½œã®ç¢ºèªæ–¹æ³•ãªã©ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ tcpdumpã«ã‚ˆã‚‹ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ã®å°Žé€šç¢ºèª 導通確èªã¨ã¯ã€ç›®çš„ã®ã‚µãƒ¼ãƒã«å¯¾ã—ã¦ãƒ«ãƒ¼ãƒ«ã©ãŠã‚Šã«ã‚¢ã‚¯ã‚»ã‚¹ã§ãã‚‹ã“ã¨ã‚’確èªã™ã‚‹ã“ã¨ã§ã™ã€‚ã‚‚ã¡ã‚ã‚“ã€å®Ÿéš›ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚Œã°ç¢ºèªã§ãã‚‹ã§ã—ょã†ã€‚「導通確èªã€ã¨ã„ã†è¦³ç‚¹ã‹ã‚‰è€ƒãˆã‚‹ã¨ã“ã‚Œã ã‘ã§ã‚‚目的ã¯é”æˆã§ãã‚‹ã®ã§ã™ãŒã€ä»Šå›žã¯æŽ¥ç¶šã§ããªã„ã¨ã„ã†ãƒˆãƒ©ãƒ–ルも想定ã—ã¦ãƒ„ールを使ã£ã¦ã¿ã¾ã—ょã†ã€‚ ファイアウォールを介ã™ã‚‹ã¨ç›®çš„ã®ãƒ›ã‚¹ãƒˆã«æŽ¥ç¶šã§ããªã„ã¨ãã¯ã€NATã‚„FORWARDã®å•é¡Œãªã©ã€ã•ã¾ã–ã¾ãªåŽŸå› ãŒè€ƒ
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Wireshark ã® tcptrace グラフを使用ã—ãŸã€ãƒ‘フォーマンスã®ãƒˆãƒ©ãƒ–ルシューティング - troushoo
パケットã‚ャプãƒãƒ£ã®å‹˜ã©ã“ã‚ Ssmjp 201501
http://acs.lbl.gov/~jason/tcpdump_advanced_filters.txt
http://members.jcom.home.ne.jp/j-klein/unix/tcpdump.html
{{#tags}}- {{label}}
{{/tags}}