15 Dec 08 Some simple filtering and sniffing with tcpdump

tcpdump is one of the best network debugging tools available. In it’s most basic form, it will print network traffic in terms of a source and destination address to the console, more advanced uses include printing out captured ASCII and simple but powerful filtering.

What we see is:

And this is repeated over and over. Now this is a feedback loop. As we are connected via port 22 (SSH), this loop will continue, and we must therefore filter it out:

Now we can cleanly monitor traffic. What happens though if we want to view SSH traffic, but not our own?

We can build this filter up as much as we wish. Let’s start watching HTTP (tcp port 80) traffic only:

Finally, let’s set the ’snaplen’ to 1500 bytes, and print out the captured data in ASCII:

And from this we can see all HTTP traffic. As you can see, it’s that easy to capture and decode plaintext traffic. We can do the same on port 110 (POP3):

(more…)

Tags: ascii, http, https, IMAP, imaps, POP3, pop3s, sniffing http, tcpdump