‫TCP dump is a free open source, very common and fast packet analyzer that runs under the command line.
‫It prints out a description of the contents of packets on a network interface that matched the Boolean
‫expression given as a parameter.
‫DCPI Dump has a lot of filtering options.
‫We'll discuss some of them in the next slide.
‫It can be preferred to the other packet analysers, such as Wireshark, because it's so fast.
‫It also supports some of the most common network traffic capturing format, PopCap, you can see the
‫result as raw ASCII text in a document as well.
‫So I have a look at this.
‫These are some of the parameters you can use with the Tsipi command deed or list interfaces.
‫Prince The list of the network interface is available on the system and on which TCP dump can capture
‫packet's.
‫I or interface listens in on the interface.
‫If unspecified, TCP dump searches the system interface list for the lowest numbered configured interface,
‫excluding loop back, which may turn out to be, for example, if zero.
‫RN means do not convert addresses, that is hosted addresses, port numbers, etc. to names.
‫V produces verbose output when parsing and printing, the more V, the more details W. writes the raw
‫packets to specified file rather than parsing and printing them out.
‫Are reads packets from the file, which was created with the option or by other tools that write PopCap
‫or P files.
‫A prince, each packet and aski handy for capturing Web pages.
‫When passing and printing, in addition to printing the headers of each packet, Capital X prints,
‫the data of each packet in Hex and ASCII.
‫This is very handy for analyzing new protocol.
‫So if you use the X option, the data of each packet is printed in Hex.
‫In addition to these options, you can filter the results in several ways.
‫If you would like to monitor specific protocol such as TCP, you can use its name as the filter.
‫You can capture packets to or from an endpoint residing in the network using net filter or use a host
‫filter to see the packets of a host as a source destination or either one.
‫Use the port to filter TCP or UDP packet sent to or from a specified port use port range to listen to
‫ports in any given range.
‫Now, if you use the sars-cov-2, you can see only the packets where the target system is the source
‫of the packet.
‫Similarly, DST is used to specify the destination system.
‫So, of course, you can use more than one filter in a command and set up their relation using and and
‫or as logical operators, for example, host is one point one one to one, and port is 80.
‫Now, before running several Taqaddum commands, let's examine the fields of a typical TCP dump output
‫row.
‫The row shown in the slide is a TCP packet.
‫The first field is the time when the package arrived with a time stamp as our minute, second and,
‫well, the fractions of a second.
‫So the second field is a protocol running atop the link layer, in this case IPV for.
‫Now for IP packets, the third field is the IP address, her host name of the host sending the packet
‫along with four TCP and UDP packets, the source port.
‫The packet on the slide came from Port 80 of the system, 172 dot one six nine nine dot one three nine.
‫Now, the fourth field is the IP address or hostname of the host receiving the packet, along with four
‫TCAP and UDP packets, the destination, Port Flagg's is the TCP IP segment flag.
‫The packet on the slide doesn't have any flags set other than ACC.
‫ACC is the acknowledgement number in the packet.
‫DCPI shows sequence and acknowledgement numbers relative to the initial sequence number by default.
‫When is the source host TCP window and you see the options, field length is the length of the data
‫in the TCP segment, like here is zero.
‫So that means that no data is exchanged yet.
‫Well, that's enough for now, let's see, TCP dove in action, time for Hands On.