Tcpdump patterns - Revision history

Tykling at 08:06, 12 June 2011

2011-06-12T08:06:11Z

← Older revision		Revision as of 08:06, 12 June 2011
Line 90:		Line 90:

	'''Summary:''' The tcpdump pattern to match ServFail responses in the example above matches '''all four low bits in byte 11 of the UDP packet, and makes sure they are exactly ''0010'''''.		'''Summary:''' The tcpdump pattern to match ServFail responses in the example above matches '''all four low bits in byte 11 of the UDP packet, and makes sure they are exactly ''0010'''''.
			== Matching other traffic ==
			=== Spanning Tree ===
			To make tcpdump show only spanning tree packets:
			<pre>
			tcpdump ether[14:1] = 0x42
			</pre>

	== Links ==		== Links ==

Tykling: /* Links */

2011-05-27T07:47:25Z

Links

← Older revision		Revision as of 07:47, 27 May 2011
Line 93:		Line 93:
	== Links ==		== Links ==
	See [http://acs.lbl.gov/~jason/tcpdump_advanced_filters.txt this page] for much more on bit matching with tcpdump.		See [http://acs.lbl.gov/~jason/tcpdump_advanced_filters.txt this page] for much more on bit matching with tcpdump.

			There is also a bunch of goodies on [http://www.workrobot.com/sysadmin/security/tcpdump_expressions.html this page].

Tykling at 17:35, 2 August 2009

2009-08-02T17:35:48Z

← Older revision		Revision as of 17:35, 2 August 2009
Line 1:		Line 1:
			[[category:tcpdump]]
	This page contains information on [http://www.tcpdump.org/ tcpdumps] match pattern syntax. When I find or write a nice pattern I may want to use later I will add it to this page.		This page contains information on [http://www.tcpdump.org/ tcpdumps] match pattern syntax. When I find or write a nice pattern I may want to use later I will add it to this page.

Tykling: /* Matching DNS Queries */

2009-08-02T17:32:19Z

Matching DNS Queries

← Older revision		Revision as of 17:32, 2 August 2009
Line 32:		Line 32:
	This section is about matching different kinds of DNS queries with tcpdump.		This section is about matching different kinds of DNS queries with tcpdump.

	==== NS Update Queries ====		==== DNS Dynamic Update Queries ====
	~~To show incoming nsupdate queries run the following:~~		A bit of backgound information on UDP and DNS packets is neccesary for this:
	~~<pre>~~
	~~tcpdump port 53 and 'udp[10] & 128 = 0' and 'udp[10] & 64 = 0' and 'udp[10] & 32 = 32' and 'udp[10] & 16 = 0' and 'udp[10] & 8 = 8'~~
	~~</pre>~~

	~~Explanation:~~ A bit of backgound information on UDP and DNS packets is neccesary for this:

	* The UDP packet header is 8 bytes and tcpdump is counting the bytes from zero when matching, so the DNS packet header begins at "byte number 8" in tcpdump match syntax. See [http://www.ietf.org/rfc/rfc768.txt RFC768] for more on UDP packet characteristics.		* The UDP packet header is 8 bytes and tcpdump is counting the bytes from zero when matching, so the DNS packet header begins at "byte number 8" in tcpdump match syntax. See [http://www.ietf.org/rfc/rfc768.txt RFC768] for more on UDP packet characteristics.
Line 55:		Line 50:
	* I want the fourth bit in byte 10 to be 0 in matched packets, that bit is decimal 16 or binary ''00010000'', so I add 'udp[10] & 16 = 0' to the tcpdump pattern.		* I want the fourth bit in byte 10 to be 0 in matched packets, that bit is decimal 16 or binary ''00010000'', so I add 'udp[10] & 16 = 0' to the tcpdump pattern.
	* I want the fifth bit in byte 10 to be 1 in matched packets, that bit is decimal 8 or binary ''00001000'', so I add 'udp[10] & 8 = 8' to the tcpdump pattern.		* I want the fifth bit in byte 10 to be 1 in matched packets, that bit is decimal 8 or binary ''00001000'', so I add 'udp[10] & 8 = 8' to the tcpdump pattern.

			So to show incoming dns dynamic update queries (as defined in [http://www.ietf.org/rfc/rfc2136.txt rfc2136]), run the following:
			<pre>
			tcpdump port 53 and 'udp[10] & 128 = 0' and 'udp[10] & 64 = 0' and 'udp[10] & 32 = 32' and 'udp[10] & 16 = 0' and 'udp[10] & 8 = 8'
			</pre>

	'''Summary:''' The tcpdump pattern to match ns update queries in the example above matches '''the first five bits of byte 10 of the udp packet, and makes sure they are exactly ''00101'''''.		'''Summary:''' The tcpdump pattern to match ns update queries in the example above matches '''the first five bits of byte 10 of the udp packet, and makes sure they are exactly ''00101'''''.


	=== Matching DNS Responses ===		=== Matching DNS Responses ===

Tykling: /* Matching ServFail Responses */

2009-08-02T17:30:47Z

Matching ServFail Responses

← Older revision		Revision as of 17:30, 2 August 2009
Line 62:		Line 62:
	This section is about matching different kinds of DNS responses with tcpdump.		This section is about matching different kinds of DNS responses with tcpdump.

	==== Matching ServFail Responses ====		==== Matching DNS ServFail Responses ====
	~~To show ServFail responses run the following:~~		A bit of backgound information on UDP and DNS packets is neccesary for this:
	~~<pre>~~
	~~tcpdump port 53 and 'udp[11] & 8 = 0' and 'udp[11] & 4 = 0' and 'udp[11] & 2 = 2' and 'udp[11] & 1 = 0'~~
	~~</pre>~~
	~~Explanation:~~ A bit of backgound information on UDP and DNS packets is neccesary for this:

	* The UDP packet header is 8 bytes and tcpdump is counting the bytes from zero when matching, so the DNS packet header begins at "byte number 8" in tcpdump match syntax. See [http://www.ietf.org/rfc/rfc768.txt RFC768] for more on UDP packet characteristics.		* The UDP packet header is 8 bytes and tcpdump is counting the bytes from zero when matching, so the DNS packet header begins at "byte number 8" in tcpdump match syntax. See [http://www.ietf.org/rfc/rfc768.txt RFC768] for more on UDP packet characteristics.
Line 87:		Line 83:
	* I want the seventh bit in byte 11 to be 1 in matched packets, that bit is decimal 2 or binary ''00000010'', so I add 'udp[11] & 2 = 2' to the tcpdump pattern.		* I want the seventh bit in byte 11 to be 1 in matched packets, that bit is decimal 2 or binary ''00000010'', so I add 'udp[11] & 2 = 2' to the tcpdump pattern.
	* I want the eigth bit in byte 11 to be 0 in matched packets, that bit is decimal 1 or binary ''00000001'', so I add 'udp[11] & 1 = 0' to the tcpdump pattern.		* I want the eigth bit in byte 11 to be 0 in matched packets, that bit is decimal 1 or binary ''00000001'', so I add 'udp[11] & 1 = 0' to the tcpdump pattern.

			So to show only DNS ServFail responses run the following:
			<pre>
			tcpdump port 53 and 'udp[11] & 8 = 0' and 'udp[11] & 4 = 0' and 'udp[11] & 2 = 2' and 'udp[11] & 1 = 0'
			</pre>

	'''Summary:''' The tcpdump pattern to match ServFail responses in the example above matches '''all four low bits in byte 11 of the UDP packet, and makes sure they are exactly ''0010'''''.		'''Summary:''' The tcpdump pattern to match ServFail responses in the example above matches '''all four low bits in byte 11 of the UDP packet, and makes sure they are exactly ''0010'''''.

Tykling at 17:25, 2 August 2009

2009-08-02T17:25:02Z

← Older revision		Revision as of 17:25, 2 August 2009
Line 1:		Line 1:
	This page contains information on ~~the~~ tcpdump match pattern syntax. When I find a nice pattern I may want to use later I will add it to this page.		This page contains information on [http://www.tcpdump.org/ tcpdumps] match pattern syntax. When I find or write a nice pattern I may want to use later I will add it to this page.

	== Matching TCP Flags ==		== Matching TCP Flags ==

Tykling: Tcpdump moved to Tcpdump patterns

2009-08-02T17:23:51Z

Tcpdump moved to Tcpdump patterns

← Older revision	Revision as of 17:23, 2 August 2009
(No difference)

Tykling at 17:23, 2 August 2009

2009-08-02T17:23:00Z

← Older revision		Revision as of 17:23, 2 August 2009
Line 44:		Line 44:
	* The next two bytes ("number 10 and 11" in tcpdump match syntax) make up the flags for the DNS packet. The two bytes contain a lot of information (refer to [http://www.ietf.org/rfc/rfc1035.txt rfc1035] section 4.1.1, page 26). First I need to match only queries and not responses. That is set in the QR bit which is the first bit of the first byte of the DNS packet flags. Secondly I need to match only ns update queries, the type of query can be found in the Opcode field which is contains in bits 2-5 in the first byte of the DNS flags.		* The next two bytes ("number 10 and 11" in tcpdump match syntax) make up the flags for the DNS packet. The two bytes contain a lot of information (refer to [http://www.ietf.org/rfc/rfc1035.txt rfc1035] section 4.1.1, page 26). First I need to match only queries and not responses. That is set in the QR bit which is the first bit of the first byte of the DNS packet flags. Secondly I need to match only ns update queries, the type of query can be found in the Opcode field which is contains in bits 2-5 in the first byte of the DNS flags.
	* According to [http://www.ietf.org/rfc/rfc1035.txt rfc1035] section 4.1.1, page 26, the QR bit is set to 0 for queries, and 1 for responses.		* According to [http://www.ietf.org/rfc/rfc1035.txt rfc1035] section 4.1.1, page 26, the QR bit is set to 0 for queries, and 1 for responses.
	* According to [http://www.ietf.org/rfc/rfc2136.txt rfc2136] section 2.2, page 4, the Opcode decimal 5 (with four bits for the Opcode that is binary ''0101'') means it is an update query.		* According to [http://www.ietf.org/rfc/rfc2136.txt rfc2136] (which defines dynamic updates) section 2.2, page 4, the Opcode decimal 5 (with four bits for the Opcode that is binary ''0101'') means it is an update query.

	Putting this together, I need to match DNS packets that has the following bit pattern in bits 1-5 of byte 10: ''00101'' - the first ''0'' is the QR bit, the next four is the Opcode.		Putting this together, I need to match DNS packets that has the following bit pattern in bits 1-5 of byte 10: ''00101'' - the first ''0'' is the QR bit, the next four is the Opcode.

	I will check the individual bits that make up the bytes in a packet with tcpdump by using a '''bit-by-bit "binary AND" against a bitmask'''. I put the tcpdump expression together a bit at a time, maching each bit like I want it:		I will check the individual bits that make up the bytes in a packet with tcpdump by using a '''bit-by-bit "binary AND" against a bitmask'''. I put the tcpdump expression together a bit at a time, maching each bit like I want it:

			* I want the first bit in byte 10 to be 0 in matched packets, that bit is decimal 128 or binary ''10000000'', so I add 'udp[10] & 128 = 0' to the tcpdump pattern.
			* I want the second bit in byte 10 to be 0 in matched packets, that bit is decimal 64 or binary ''01000000'', so I add 'udp[10] & 64 = 0' to the tcpdump pattern.
			* I want the third bit in byte 10 to be 1 in matched packets, that bit is decimal 32 or binary ''00100000'', so I add 'udp[10] & 32 = 32' to the tcpdump pattern. Note the difference.
			* I want the fourth bit in byte 10 to be 0 in matched packets, that bit is decimal 16 or binary ''00010000'', so I add 'udp[10] & 16 = 0' to the tcpdump pattern.
			* I want the fifth bit in byte 10 to be 1 in matched packets, that bit is decimal 8 or binary ''00001000'', so I add 'udp[10] & 8 = 8' to the tcpdump pattern.

			'''Summary:''' The tcpdump pattern to match ns update queries in the example above matches '''the first five bits of byte 10 of the udp packet, and makes sure they are exactly ''00101'''''.


	=== Matching DNS Responses ===		=== Matching DNS Responses ===
Line 72:		Line 81:
	According to [http://www.ietf.org/rfc/rfc1035.txt rfc1035] (section 4.1.1, page 26), an RCODE of decimal 2 (thats binary ''0010'' in the four low bits of byte 11) means ServFail.		According to [http://www.ietf.org/rfc/rfc1035.txt rfc1035] (section 4.1.1, page 26), an RCODE of decimal 2 (thats binary ''0010'' in the four low bits of byte 11) means ServFail.

	~~You can~~ check the individual bits that make up the bytes in a packet with tcpdump by using a '''bit-by-bit "binary AND" against a bitmask'''. Since the RCODE of the response is only a half-byte, I don't care what the four high bits are, I only care that the four low bits are exactly ''0010''. This can be checked like so:		I will check the individual bits that make up the bytes in a packet with tcpdump by using a '''bit-by-bit "binary AND" against a bitmask'''. Since the RCODE of the response is only a half-byte, I don't care what the four high bits are, I only care that the four low bits are exactly ''0010''. This can be checked like so:

	* If I ~~wanted~~ the ~~third-lowest~~ bit in byte 11 to be 0 in matched packets, that bit is decimal 4 or binary ''00000100'', I ~~would~~ add 'udp[11] & 4 = 0' to the tcpdump pattern.		* I want the fifth bit in byte 11 to be 0 in matched packets, that bit is decimal 8 or binary ''00001000'', so I add 'udp[11] & 8 = 0' to the tcpdump pattern.
	* If I ~~wanted~~ the ~~fourth-lowest~~ bit in byte 11 to be 1 in matched packets, that bit is decimal 8 or binary ''~~00001000~~'', I ~~would~~ add 'udp[11] & 8 = 1' to the tcpdump pattern.		* I want the sixth bit in byte 11 to be 0 in matched packets, that bit is decimal 4 or binary ''00000100'', so I add 'udp[11] & 4 = 0' to the tcpdump pattern.
	* If I ~~for some reason wanted to~~ the ~~highest~~ bit in byte 17 to be 1 in matched packets, that bit is decimal ~~128~~ or binary ''~~10000000~~'', I ~~would~~ add 'udp[17] & ~~128~~ = 1' to the tcpdump pattern.		* I want the seventh bit in byte 11 to be 1 in matched packets, that bit is decimal 2 or binary ''00000010'', so I add 'udp[11] & 2 = 2' to the tcpdump pattern.
			* I want the eigth bit in byte 11 to be 0 in matched packets, that bit is decimal 1 or binary ''00000001'', so I add 'udp[11] & 1 = 0' to the tcpdump pattern.

	'''Summary:''' The tcpdump pattern to match ServFail responses in the example above matches '''all four low bits in byte 11 of the UDP packet, and makes sure they are exactly ''0010'''''.		'''Summary:''' The tcpdump pattern to match ServFail responses in the example above matches '''all four low bits in byte 11 of the UDP packet, and makes sure they are exactly ''0010'''''.

Tykling: /* NS Update Queries */

2009-08-02T17:10:13Z

NS Update Queries

← Older revision		Revision as of 17:10, 2 August 2009
Line 47:		Line 47:

	Putting this together, I need to match DNS packets that has the following bit pattern in bits 1-5 of byte 10: ''00101'' - the first ''0'' is the QR bit, the next four is the Opcode.		Putting this together, I need to match DNS packets that has the following bit pattern in bits 1-5 of byte 10: ''00101'' - the first ''0'' is the QR bit, the next four is the Opcode.

			I will check the individual bits that make up the bytes in a packet with tcpdump by using a '''bit-by-bit "binary AND" against a bitmask'''. I put the tcpdump expression together a bit at a time, maching each bit like I want it:

	=== Matching DNS Responses ===		=== Matching DNS Responses ===

Tykling: /* NS Update Queries */

2009-08-02T17:07:10Z

NS Update Queries

@@ Line 37: / Line 37: @@
 tcpdump port 53 and 'udp[10] & 128 = 0' and 'udp[10] & 64 = 0' and 'udp[10] & 32 = 32' and 'udp[10] & 16 = 0' and 'udp[10] & 8 = 8'
 </pre>
 === Matching DNS Responses ===