1. tcpdump tcpreplaytcprewrite#ssmjp 2013/03/29 @togakushi

2. tcpdump root NIC promiscuous mode 3. 4. MAC tcpdump ( ) 5. 2 6. (TD) 2 (RD) 1:TD+ 1:TD+ HOST-BHOST-A 2:TD- 2:TD- 3:RD+ 3:RD+ 6:RD- 6:RD- 3:RD+6:RD- 3:RD+6:RD- eth0 eth1HOST-C(tcpdump) 100BASE 7. 1:TD+ 1:TD+H 2:TD-2:TD- SnifferUB 3:RD+ 3:RD+6:RD-6:RD- HUB 8. # tcpdump -i any -nn port 80# tcpdump -i any -nn host 192.168.1.1 and port 80# tcpdump -i any -nn not port 22 and not port 3389 # tcpdump -i any -nn -x# tcpdump -i any -nn -X Hex 9. # tcpdump -i eth0 -C 10 -Z root -w tcpdump.pcap -C file_size(MB) -Z root # ls tcpdump*tcpdump.pcap tcpdump.pcap.1 tcpdump.pcap.2 ... # tcpdump -i eth0 -G 60 -Z root -w tcpdump_%Y%m%d-%H%M%S.pcap -G rotate_seconds -w strftime # ls tcpdump*tcpdump_20120909-000740.pcap tcpdump_20120909-000840.pcaptcpdump_20120909-000940.pcap ... 10. tcpslice 3 % tcpslice -r tcpdump.pcaptcpdump.pcap Wed Mar 27 11:44:11 2013 Wed Mar 27 11:44:23 2013% tcpslice -t tcpdump.pcaptcpdump.pcap 2013y03m27d11h44m11s817661u 2013y03m27d11h44m23s174956u% tcpslice -R tcpdump.pcaptcpdump.pcap 1364352251.817661 1364352263.174956% tcpslice 1364352251.817661 +10 -w new.pcap tcpdump.pcap 11. mergecap pcap % mergecap -w [ ...] 12. ngrep grep grep -i -w -v -X 16 # ngrep [option] < match expression > < bpf filter ># ngrep -q -d eth0port 80 13. ngrep -K < > RST ( ) L7FW ngrep -K 1 14. grep sed netsed # netsed [] [ ...]# netsed 8080 192.168.1.1 80 s/google/yahoolocalhost:8080 192.168.1.1:80 15. GUI wireshark 16. CLI tshark wireshark wireshark CLI % tshark -r x.pcap1 0.000000 192.168.100.101 -> 192.168.100.102 TCP 74 49924 > http [SYN] Seq=0 Win=...2 0.000567 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [ACK] Seq=1 Ack=...3 0.000697 192.168.100.101 -> 192.168.100.102 HTTP 223 GET / HTTP/1.14 0.007204 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [ACK] Seq=158 Ack=...5 0.007224 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [ACK] Seq=158 Ack=...6 0.007320 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [ACK] Seq=158 Ack=...7 0.007517 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [ACK] Seq=158 Ack=...8 0.007580 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [FIN, ACK] Seq=158 ...9 0.007625 192.168.100.101 -> 192.168.100.102 TCP 66 49924 > http [ACK] Seq=159 Ack=... 17. 18. tcpreplay tcpdump (pcap) FW IDS 1 19. tcprewrite pcap tcpreplay IP MAC ( ) VLAN 20. http://wiki.wireshark.org/CaptureSetup/Ethernet man tcpdump man tcpreplay / tcprewrite