TCPdump adalah CLI paket sniffer yg powerfull.
1. Install TCPDUMP
- Utk nginstall :
#apt-get install tcpdump
- Utk liat dependensinya :
#apt-cache depends tcpdump
tcpdump
Depends: libc6
Depends: libpcap0.8
Depends: libssl0.9.8
- Utk lihat versi TCPdump yg terinstall :
# apt-cache policy tcpdump
tcpdump:
Installed: 3.9.5-2etch1
Candidate: 3.9.5-2etch1
Version Table:
*** 3.9.5-2etch1 0
500 http://kambing.vlsm.org stable/main Packages
500 http://security.debian.org stable/updates/main Packages
100 /var/lib/dpkg/status

2. Cara pake TCPdump
- Utk nampilin standar TCPdump output :
#tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:49:57.950569 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 705743480:705743596(116) ack 1737657567 win 20368
15:49:57.953868 arp who-has ns1.wave.net.id tell 116.212.100.13
15:49:57.953960 arp reply ns1.wave.net.id is-at 00:1b:11:e8:98:ba (oui Unknown)
15:49:57.953977 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 24955+ PTR? 222.3.159.202.in-addr.arpa. (44)
15:49:58.027214 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 24955 NXDomain 0/1/0 (107)
15:49:58.027798 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 37723+ PTR? 13.100.212.116.in-addr.arpa. (45)
15:49:58.028068 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 37723 NXDomain* 0/1/0 (105)
15:49:58.028765 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 28052+ PTR? 10.100.212.116.in-addr.arpa. (45)
15:49:58.029058 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 28052* 1/2/2 (138)
15:49:58.096475 IP 202.159.3.222.1766 > 116.212.100.13.ssh: . ack 0 win 64623
15:49:58.096558 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 116:1548(1432) ack 1 win 20368
15:49:58.096806 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 1548:1760(212) ack 1 win 20368
15:49:58.161419 IP 202.159.3.222.1766 > 116.212.100.13.ssh: P 1:53(52) ack 0 win 64623
- Network interface yg bisa di capture :
#tcpdump -D
1.eth1
2.any (Pseudo-device that captures on all interfaces)
3.lo
- Utk nampilin alamat numerik
#tcpdump -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:52:35.038923 IP 116.212.100.13.22 > 202.159.3.222.1766: P 705747000:705747116(116) ack 1737658607 win 20368
15:52:35.135921 IP 202.159.3.222.1766 > 116.212.100.13.22: . ack 0 win 65275
15:52:35.136008 IP 116.212.100.13.22 > 202.159.3.222.1766: P 116:396(280) ack 1 win 20368
15:52:35.136301 IP 116.212.100.13.22 > 202.159.3.222.1766: P 396:512(116) ack 1 win 20368
15:52:35.202463 IP 202.159.3.222.1766 > 116.212.100.13.22: P 1:53(52) ack 116 win 65159
15:52:35.202528 IP 116.212.100.13.22 > 202.159.3.222.1766: P 512:776(264) ack 53 win 20368
- Utk nampilin output yg cpt
#tcpdump -q
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:53:26.152224 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 116
15:53:26.161792 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 116
15:53:26.160278 arp who-has ns1.wave.net.id tell 116.212.100.13
15:53:26.160374 arp reply ns1.wave.net.id is-at 00:1b:11:e8:98:ba (oui Unknown)
15:53:26.160395 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 44
15:53:26.160624 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 107
15:53:26.161187 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 45
15:53:26.161413 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 105
15:53:26.162190 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 45
15:53:26.162450 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 138
15:53:26.211335 IP 202.159.3.222.1766 > 116.212.100.13.ssh: tcp 0
15:53:26.211407 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 1272
- Capture traffic interface tertentu :
#tcpdump -i eth0
- Capture traffic UDP :
#tcpdump udp
- Capture traffic port TCP 80
#tcpdump port http
- Capture trafik dari filter suatu file :
#tcpdump -F file_name
contoh file :
#vim file_name
port 80
- Berhenti capture setelah 20 paket :
#tcpdump -c 20
- Nyimpen capture-an ke suatu file :
#tcpdump -w capture.log
- Lihat capture file :
#tcpdump -r capture.log
reading from file capture.log, link-type EN10MB (Ethernet)
16:06:10.607444 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 705756112:705756164(52) ack 1737661227 win 22512
16:06:10.607463 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 52:168(116) ack 1 win 22512
16:06:10.704568 IP 202.159.3.222.1766 > 116.212.100.13.ssh: . ack 168 win 64431
16:06:12.450891 802.1d config 8000.00:1e:be:4f:93:08.8004 root 8000.00:1e:be:4f:93:08 pathcost 0 age 0 max 20 hello 2 fdelay 15
16:06:12.630703 IP 202.159.3.222.1766 > 116.212.100.13.ssh: P 1:53(52) ack 168 win 64431
- Utk nampilin paket yg punya “www.zulfanruri.com” sby source/dest address :
#tcpdump host www.zulfanruri.com
- Utk nampilin paket FTP yg berasal dari 192.168.1.100 ke 192.168.1.2 :
#tcpdump src 192.168.1.100 and dst 192.168.1.2 and port ftp
- Utk nampilin isi paket :
#tcpdump -A
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ath0, link-type EN10MB (Ethernet), capture size 96 bytes
20:53:24.872785 IP local.40205 > 192.168.1.2.ftp: S 4155598838:4155598838(0) win 5840
….g………………..
…………
20:53:24.879473 IP local.40205 > 192.168.1.2.ftp: . ack 1228937421 win 183
….g.I@………….
……..
20:53:24.881654 IP local.40205 > 192.168.1.2.ftp: . ack 43 win 183
….g.I@…….8…..
……EN
20:53:26.402046 IP local.40205 > 192.168.1.2.ftp: P 0:10(10) ack 43 win 183
….g.I@……`$…..
…=..ENUSER teddybear
20:53:26.403802 IP local.40205 > 192.168.1.2.ftp: . ack 76 win 183
….h.I@………….
…>..E^
20:53:29.169036 IP local.40205 > 192.168.1.2.ftp: P 10:25(15) ack 76 win 183
….h.I@……#c…..
……E^PASS wakeup
20:53:29.171553 IP local.40205 > 192.168.1.2.ftp: . ack 96 win 183
….h.I@.,………..
……Ez
20:53:29.171649 IP local.40205 > 192.168.1.2.ftp: P 25:31(6) ack 96 win 183
….h.I@.,………..
……EzSYST
20:53:29.211607 IP local.40205 > 192.168.1.2.ftp: . ack 115 win 183
….h.I@.?…..j…..
……Ez
20:53:31.367619 IP local.40205 > 192.168.1.2.ftp: P 31:37(6) ack 115 win 183
….h.I@.?………..
……EzQUIT
20:53:31.369316 IP local.40205 > 192.168.1.2.ftp: . ack 155 win 183
….h.I@.g………..
……E.
20:53:31.369759 IP local.40205 > 192.168.1.2.ftp: F 37:37(0) ack 156 win 183
….h.I@.h…..e…..
……E.
Capture paket saat koneksi ftp, passwordnya gampang dilihat krn dikirim berupa clear text ke server.
Utk capture di atas, user/password ftp = teddybear/wakeup

semoga berhasil ya ini juga referensi dari orang lain yang penting fokus pasti nanti bisa

1 Tools Found on BackTrack 2.0 Final
o 1.1 Information Gathering
+ 1.1.1 Ass
+ 1.1.2 DMitry
+ 1.1.3 DNS-Ptr
+ 1.1.4 dnswalk
+ 1.1.5 dns-bruteforce
+ 1.1.6 dnsenum
+ 1.1.7 dnsmap
+ 1.1.8 DNSPredict
+ 1.1.9 Finger Google
+ 1.1.10 Firewalk
+ 1.1.11 Goog Mail Enum
+ 1.1.12 Google-search
+ 1.1.13 Googrape
+ 1.1.14 Gooscan
+ 1.1.15 Host
+ 1.1.16 Itrace
+ 1.1.17 Netenum
+ 1.1.18 Netmask
+ 1.1.19 Pirana
+ 1.1.20 Protos
+ 1.1.21 QGoogle
+ 1.1.22 Relay Scanner
+ 1.1.23 SMTP-Vrfy
+ 1.1.24 TCtrace
o 1.2 Network Mapping
+ 1.2.1 Amap 5.2
+ 1.2.2 Ass
+ 1.2.3 Autoscan 0.99_R1
+ 1.2.4 Fping
+ 1.2.5 Hping
+ 1.2.6 IKE-Scan
+ 1.2.7 IKEProbe
+ 1.2.8 Netdiscover
+ 1.2.9 Nmap
+ 1.2.10 NmapFE
+ 1.2.11 P0f
+ 1.2.12 PSK-Crack
+ 1.2.13 Ping
+ 1.2.14 Protos
+ 1.2.15 Scanrand
+ 1.2.16 SinFP
+ 1.2.17 Umit
+ 1.2.18 UnicornScan
+ 1.2.19 UnicornScan pgsql 0.4.6e module version 1.03
+ 1.2.20 XProbe2
+ 1.2.21 PBNJ 2.04
# 1.2.21.1 OutputPBNJ
# 1.2.21.2 ScanPBNJ
# 1.2.21.3 Genlist
o 1.3 Vulnerability Identification
+ 1.3.1 Absinthe
+ 1.3.2 Bed
+ 1.3.3 CIRT Fuzzer
+ 1.3.4 Checkpwd
+ 1.3.5 Cisco Auditing Tool
+ 1.3.6 Cisco Enable Bruteforcer
+ 1.3.7 Cisco Global Exploiter
+ 1.3.8 Cisco OCS Mass Scanner
+ 1.3.9 Cisco Scanner
+ 1.3.10 Cisco Torch
+ 1.3.11 Curl
+ 1.3.12 Fuzzer 1.2
+ 1.3.13 GFI LanGuard 2.0
+ 1.3.14 GetSids
+ 1.3.15 HTTP PUT
+ 1.3.16 Halberd
+ 1.3.17 Httprint
+ 1.3.18 Httprint GUI
+ 1.3.19 ISR-Form
+ 1.3.20 Jbrofuzz
+ 1.3.21 List-Urls
+ 1.3.22 Lynx
+ 1.3.23 Merge Router Config
+ 1.3.24 Metacoretex
+ 1.3.25 Metoscan
+ 1.3.26 Mezcal HTTP/S
+ 1.3.27 Mibble MIB Browser
+ 1.3.28 Mistress
+ 1.3.29 Nikto
+ 1.3.30 OAT
+ 1.3.31 Onesixtyone
+ 1.3.32 OpenSSL-Scanner
+ 1.3.33 Paros Proxy
+ 1.3.34 Peach
+ 1.3.35 RPCDump
+ 1.3.36 RevHosts
+ 1.3.37 SMB Bruteforcer
+ 1.3.38 SMB Client
+ 1.3.39 SMB Serverscan
+ 1.3.40 SMB-NAT
+ 1.3.41 SMBdumpusers
+ 1.3.42 SMBgetserverinfo
+ 1.3.43 SNMP Scanner
+ 1.3.44 SNMP Walk
+ 1.3.45 SQL Inject
+ 1.3.46 SQL Scanner
+ 1.3.47 SQLLibf
+ 1.3.48 SQLbrute
+ 1.3.49 Sidguess
+ 1.3.50 Smb4K
+ 1.3.51 Snmpcheck
+ 1.3.52 Snmp Enum
+ 1.3.53 Spike
+ 1.3.54 Stompy
+ 1.3.55 SuperScan
+ 1.3.56 TNScmd
+ 1.3.57 Taof
+ 1.3.58 VNC_bypauth
+ 1.3.59 Wapiti
+ 1.3.60 Yersinia
+ 1.3.61 sqlanlz
+ 1.3.62 sqldict
+ 1.3.63 sqldumplogins
+ 1.3.64 sqlquery
+ 1.3.65 sqlupload
o 1.4 Penetration
+ 1.4.1 Framework3-MsfC
+ 1.4.2 Framework3-MsfUpdate
+ 1.4.3 Framework3-Msfcli
+ 1.4.4 Framework3-Msfweb
+ 1.4.5 Init Pgsql (autopwn)
+ 1.4.6 Milw0rm Archive
+ 1.4.7 MsfCli
+ 1.4.8 MsfConsole
+ 1.4.9 MsfUpdate
+ 1.4.10 OpenSSL-To-Open
+ 1.4.11 Update Milw0rm
o 1.5 Privilege Escalation
+ 1.5.1 Ascend attacker
+ 1.5.2 CDP Spoofer
+ 1.5.3 Cisco Enable Bruteforcer
+ 1.5.4 Crunch Dictgen
+ 1.5.5 DHCPX Flooder
+ 1.5.6 DNSspoof
+ 1.5.7 Driftnet
+ 1.5.8 Dsniff
+ 1.5.9 Etherape
+ 1.5.10 EtterCap
+ 1.5.11 File2Cable
+ 1.5.12 HSRP Spoofer
+ 1.5.13 Hash Collision
+ 1.5.14 Httpcapture
+ 1.5.15 Hydra
+ 1.5.16 Hydra GTK
+ 1.5.17 ICMP Redirect
+ 1.5.18 ICMPush
+ 1.5.19 IGRP Spoofer
+ 1.5.20 IRDP Responder
+ 1.5.21 IRDP Spoofer
+ 1.5.22 John
+ 1.5.23 Lodowep
+ 1.5.24 Mailsnarf
+ 1.5.25 Medusa
+ 1.5.26 Msgsnarf
+ 1.5.27 Nemesis Spoofer
+ 1.5.28 NetSed
+ 1.5.29 Netenum
+ 1.5.30 Netmask
+ 1.5.31 Ntop
+ 1.5.32 PHoss
+ 1.5.33 PackETH
+ 1.5.34 Rcrack
+ 1.5.35 SIPdump
+ 1.5.36 SMB Sniffer
+ 1.5.37 Sing
+ 1.5.38 TFTP-Brute
+ 1.5.39 THC PPTP
+ 1.5.40 TcPick
+ 1.5.41 URLsnarf
+ 1.5.42 VNCrack
+ 1.5.43 WebCrack
+ 1.5.44 Wireshark
+ 1.5.45 Wireshark Wifi
+ 1.5.46 WyD
+ 1.5.47 XSpy
+ 1.5.48 chntpw
o 1.6 Maintaining Access
+ 1.6.1 3proxy
+ 1.6.2 Backdoors
+ 1.6.3 CryptCat
+ 1.6.4 HttpTunnel Client
+ 1.6.5 HttpTunnel Server
+ 1.6.6 ICMPTX
+ 1.6.7 Iodine
+ 1.6.8 NSTX
+ 1.6.9 Privoxy
+ 1.6.10 ProxyTunnel
+ 1.6.11 Rinetd
+ 1.6.12 TinyProxy
+ 1.6.13 sbd
+ 1.6.14 socat
o 1.7 Covering Tracks
+ 1.7.1 Housekeeping
o 1.8 Radio Network Analysis
+ 1.8.1 802.11
# 1.8.1.1 AFrag
# 1.8.1.2 ASLeap
# 1.8.1.3 Air Crack
# 1.8.1.4 Air Decap
# 1.8.1.5 Air Replay
# 1.8.1.6 Airmon Script
# 1.8.1.7 Airpwn
# 1.8.1.8 AirSnarf
# 1.8.1.9 Airodump
# 1.8.1.10 Airoscript
# 1.8.1.11 Airsnort
# 1.8.1.12 CowPatty
# 1.8.1.13 FakeAP
# 1.8.1.14 GenKeys
# 1.8.1.15 Genpmk
# 1.8.1.16 Hotspotter
# 1.8.1.17 Karma
# 1.8.1.18 Kismet
# 1.8.1.19 Load IPW3945
# 1.8.1.20 Load acx100
# 1.8.1.21 MDK2
# 1.8.1.22 MDK2 for Broadcom
# 1.8.1.23 MacChanger
# 1.8.1.24 Unload Drivers
# 1.8.1.25 Wep_crack
# 1.8.1.26 Wep_decrypt
# 1.8.1.27 WifiTap
# 1.8.1.28 Wicrawl
# 1.8.1.29 Wlassistant
+ 1.8.2 Bluetooth
# 1.8.2.1 Bluebugger
# 1.8.2.2 Blueprint
# 1.8.2.3 Bluesnarfer
# 1.8.2.4 Btscanner
# 1.8.2.5 Carwhisperer
# 1.8.2.6 CuteCom
# 1.8.2.7 Ghettotooth
# 1.8.2.8 HCIDump
# 1.8.2.9 Ussp-Push
o 1.9 VOIP & Telephony Analysis
+ 1.9.1 PcapSipDump
+ 1.9.2 PcapToSip_RTP
+ 1.9.3 SIPSak
+ 1.9.4 SIPcrack
+ 1.9.5 SIPdump
+ 1.9.6 SIPp
+ 1.9.7 Smap
o 1.10 Digital Forensics
+ 1.10.1 Allin1
+ 1.10.2 Autopsy
+ 1.10.3 DCFLDD
+ 1.10.4 DD_Rescue
+ 1.10.5 Foremost
+ 1.10.6 Magicrescue
+ 1.10.7 Mboxgrep
+ 1.10.8 Memfetch
+ 1.10.9 Memfetch Find
+ 1.10.10 Pasco
+ 1.10.11 Rootkithunter
+ 1.10.12 Sleuthkit
+ 1.10.13 Vinetto
o 1.11 Reverse Engineering
+ 1.11.1 GDB GNU Debugger
+ 1.11.2 GDB Console GUI
+ 1.11.3 GDB Server
+ 1.11.4 GNU DDD
+ 1.11.5 Hexdump
+ 1.11.6 Hexedit
+ 1.11.7 OllyDBG
o 1.12 Services
+ 1.12.1 SNORT