[Linux] tcpdump - view TCP traffic on Linux

View contents of TCP packet in LINUX : using tcpdump command
  • only shows packets from a specific IP address 
            tcpdump src 192.168.5.29 -X 
  • only shows packets to and from specific IP address 
            tcpdump host 192.168.5.29 -X 
  • display packets to and from a specific IP address 
          tcpdump -X dst 192.168.0.122 or src 192.168.0.122 
  • specify interface -i ens33 
        tcpdump -i ens33 -X dst 172.19.176.145 or src 172.19.176.145 

   tcpdump -i ens33 -X dst 10.44.57.129 or src 10.44.57.129 

  • display only tcp packets sent from src to dst ip address 
   tcpdump -i ens33 -X dst 10.44.63.130 and src 10.44.63.229 

  • capture only POST requests on specified network interface '-i ens33' 
  tcpdump -i ens33 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504F5354'

Comments

Post a Comment

Popular posts from this blog

[Python] PyQt5 Message Boxes

buttonReply = QMessageBox.question( self , 'Shutdown Server' , "Shutdown Server VM, Continue?" , QMessageBox.Yes | QMessageBox.No , QMessageBox.No) if buttonReply == QMessageBox.Yes: operation_num = 2 self .operationsThread = Operations_Thread() self .operationsThread.updateTextEditSignal.connect( self .updateText) self .operationsThread.start() self .updateText( "[{}]Shutting down VM - Please wait..." .format(time.strftime( "%Y.%m.%d-%H:%M:%S" ))) def showdialog ( self , text): global mon_config if text != 'FAIL' : msg = QMessageBox() msg.setIcon(QMessageBox.Information) msg.setWindowTitle( f"MODBUS TCP Read from: { self .selectedDevice } " ) msg.setText( f"Sensor serial no: { text } " ) msg.setInformativeText( "For more info. click 'Show Details'" ) msg.setDetailedText( f"Serial no. from IP address : { self .selectedDevic...
Read more

[Linux] Using grep command with pattern input from a file

Image
grep <text pattern> <file to be checked> grep -f<pattern file> <file to be checked> example: grep -f pattern.txt /var/log/apache2/access.log -f to input search patterns one search pattern per line do not include space/enter empty lines at the end - it will result displaying the whole file as it has enter '\r, '\n' characters contents of pattern.txt : /admin/system-monitor/flood-protect HTTP/1.1" 200 582 /admin/system-monitor/flood-protect HTTP/1.1" 200 590
Read more