Instructor: tcpdump. 2 2
In this lesson, 3 3
I'm going to show you a little bit how to use tcpdump. 4 4
Now, by the end of this lesson, 5 5
you're not going to be an expert in it but that's okay, 6 6
because for the exam, 7 7
you don't need to know how to actually use tcpdump 8 8
but you should be familiar with the fact 9 9
that tcpdump and Wireshark are often used together 10 10
as a way to capture packets and then analyze packets. 11 11
Unlike Wireshark, tcpdump is a text-based program 12 12
and you use it inside the command line. 13 13
Now, what I'm going to do here is 14 14
first, I'm going to start using tcpdump 15 15
inside my Mac OSX environment. 16 16
It comes installed by default 17 17
inside Mac as well as in Linux. 18 18
If you're going to use tcpdump, 19 19
you need to know what interface you're connected 20 20
to the network on. 21 21
In my case, it's en0. 22 22
So to use it, I'm going to do sudo 23 23
because you must be running this 24 24
with administrative permissions 25 25
to be able to turn your card into promiscuous mode, 26 26
and then tcpdump -i, and then your interface, 27 27
en0 if you're on a Mac. 28 28
If you're on a Linux machine, it should be eth0. 29 29
So I'll go ahead and hit type in en0 and hit Enter. 30 30
Now, at this point, I'm putting my card 31 31
into promiscuous mode 32 32
and I'm starting to look at everything 33 33
that's going across the network. 34 34
And here you see information going across the screen, 35 35
showing me all sorts of different connections 36 36
that are happening on this network 37 37
both from my computer and other computers on the network. 38 38
Now, this isn't nearly as helpful 39 39
as being able to look at things slowly 40 40
or by filtering it down, but that's okay, 41 41
because we can do that using tcpdump as well. 42 42
Instead of displaying it to the screen, 43 43
I'm going to go ahead and hit Control + C 44 44
and that's going to pause that and cancel my collection. 45 45
And now, I can see a couple of things here. 46 46
If we start up towards the top, 47 47
you'll see that my IP address is 10.128.1.130. 48 48
The first line there is actually going from my computer 49 49
over port 57963 to that particular website that you see 50 50
which is 1e100.net. 51 51
It's doing this over HTTPS, which is port 443. 52 52
There is no flags in that packet. 53 53
There was an acknowledgement that was received. 54 54
You can see the windowing, the options, and the value. 55 55
That is one packet with one timestamp. 56 56
Then you go down to the next one, there's another one. 57 57
And the next one, there's another one. 58 58
And there's lots of information here. 59 59
Now, let's say instead of looking at data 60 60
from all different things on the network, 61 61
I only wanted to see things that came from my computer. 62 62
Could I do that? Well, certainly. 63 63
What I can do is clear my screen 64 64
and then I will use sudo tcpdump. 65 65
I will type in source, which is the IP I want to collect from. 66 66
And in my case, it is going to be 10.128.1.130, 67 67
and then I will hit Enter. 68 68
Now, all you're going to see here is traffic 69 69
going from the .130 my host to somewhere else on the network 70 70
and right now there's not much going on 71 71
because I'm sitting here talking to you 72 72
and not browsing the internet. 73 73
But if I was browsing the internet 74 74
and doing other connections, 75 75
those would all be showing up here. 76 76
What you're seeing here is a lot of different beaconing 77 77
and keep alive traffic for different programs I have 78 78
on my computer, and that's what we're seeing here. 79 79
Now, the next thing we want to do 80 80
is go ahead and hit Control + C. 81 81
And this is also helpful, 82 82
but again, it's not extremely helpful 83 83
because if I had this running on a large enterprise network, 84 84
there'd be so much data whizzing by my screen 85 85
I wouldn't be able to read it all, 86 86
so we would want to write that to a file. 87 87
How do we do that? 88 88
Well, again, I'm going to clear my screen 89 89
so I can go to the top 90 90
and I'll bring up the last command I did. 91 91
If we want to do this and write it to its file 92 92
we can just type in -w 93 93
and then the file name that we want. 94 94
And so in my case, 95 95
I'm going to call it host130.pcap, and then hit Enter. 96 96
Now, that information is going to go into a file 97 97
that's going to be captured on my hard drive. 98 98
As it's sitting there listening, it's picking up any traffic 99 99
that's going from that source, 10.128.1.130 100 100
and it's writing it to the file host130.pcap. 101 101
Now, once we have enough of that, we can hit Control + C. 102 102
In this case, we captured 161 packets of information. 103 103
Again, it's very little information right now 104 104
because it's basically background tasks on this computer 105 105
because I'm not actively running things 106 106
because I'm not sitting there browsing the internet. 107 107
Now, if I wanted to be able to see that information 108 108
I can do that by doing sudo tcpdump and then -r 109 109
and then the file that I did, host130.pcap. 110 110
When I hit Enter, I'm going to see all 161 packets 111 111
from that file and display them to the screen. 112 112
Here's the first bunch 113 113
and then it's going to keep reading them 114 114
and displaying 'em to the screen. 115 115
Now again, that's a lot of information 116 116
and I only did that for about 5 or 10 seconds. 117 117
If I had this running all day, 118 118
that'd be way too much information to go through. 119 119
So instead, we would want to start filtering that information 120 120
and we can do that based on a lot of different things. 121 121
For instance, if I look at this particular packet 122 122
right here, you can see 123 123
that it is going from the host at 130 over port 5475 124 124
and it's going out to the broadcast 125 125
of the network at .255.255 over port 5474. 126 126
If I just wanted to see every time 127 127
that there was a beaconing that was going out like that, 128 128
I can do that. 129 129
And so what I'll do is I'll hit clear. 130 130
I would type in sudo tcpdump, source, src 131 131
and then port, the port I want to see, 132 132
in this case that was 5475. 133 133
And then again I need to read it from the file, 134 134
so -r host130.pcap. 135 135
If I don't put the dash -r host130.pcap, 136 136
what it's going to do is it's going to look at the live traffic 137 137
and anytime it sees a source port of 5475, 138 138
it would display it to the screen. 139 139
But in this case, I want to go through and analyze 140 140
what I already captured. 141 141
So as I did that, you can see here 142 142
a handful of times that that happened. 143 143
Now, if this was malware it was beaconing out, 144 144
I could see exactly when that happened. 145 145
In this case, this particular packet is being sent out 146 146
every second, 190651, 190652, 190653. 147 147
Now, this is just the header we're seeing 148 148
and we can see this is a UDP packet that's being sent out 149 149
with a length of five. 150 150
Well, what if you wanted to look inside this packet 151 151
and see what was actually sent? 152 152
Can you do that? 153 153
Well, sure you can. 154 154
We can do the exact same thing we just did 155 155
and then add the command -x 156 156
which will show the packets contents 157 157
in both hex and ASCII. 158 158
So let me go ahead and clear my screen, 159 159
and then go here and add -x. 160 160
Now, I see all those packets again done by time 161 161
and here I see the IP, where it's going from, 162 162
where it's going to, UDP length five. 163 163
Then you're seeing that five bites of data. 164 164
Notice here, we see it in hex first 165 165
and then we see it in ASCII on the right hand side. 166 166
This will allow us to go through 167 167
and see what was being sent. 168 168
This can be extremely helpful 169 169
if somebody's using something like FTP or HTTP 170 170
where things are being sent in the clear. 171 171
Now, as I said, what I did here 172 172
was just a very, very quick demonstration to show you 173 173
some of the capabilities of this tool. 174 174
If you want to learn more, 175 175
I recommend you go into the man pages for tcpdump, 176 176
and just type in man tcpdump and hit Enter. 177 177
This will bring up the manual 178 178
and you can see all of the different options 179 179
and all of the different ways you can filter down content. 180 180
Remember, you can filter during collection, 181 181
or you can filter after you've collected 182 182
when you're reading things. 183 183
Why would you want to do one versus the other? 184 184
Well, again, let's say I was running 185 185
a big large enterprise network. 186 186
One of the organizations I worked for, 187 187
we ran a network with tens of thousands of computers, 188 188
and so if I said show me everything that's coming 189 189
from this particular IP address or this particular port 190 190
or is beaconing out to a known bad actors command 191 191
and control server, that could be a ton of information. 192 192
So we would want to just filter down on the collection 193 193
because we're only interested in what we are looking for 194 194
instead of every single packet sent 195 195
across the network internally or out to the internet. 196 196
And so this is why it's important 197 197
for you to think about what are you trying to collect 198 198
and filter that down on the collection to reduce the size. 199 199
On the other hand, 200 200
if you're not sure what you're trying to collect yet, 201 201
you're still trying to identify 202 202
the indicators of compromise, 203 203
you may collect everything, 204 204
which can take up tons of space and then filter it down 205 205
as you start reading through and going through those logs.