setting tcpdump
TCPdump adalah CLI paket sniffer yg powerfull.
1. Install TCPDUMP
- Utk nginstall :
#apt-get install tcpdump
- Utk liat dependensinya :
#apt-cache depends tcpdump
tcpdump
Depends: libc6
Depends: libpcap0.8
Depends: libssl0.9.8
- Utk lihat versi TCPdump yg terinstall :
# apt-cache policy tcpdump
tcpdump:
Installed: 3.9.5-2etch1
Candidate: 3.9.5-2etch1
Version Table:
*** 3.9.5-2etch1 0
500 http://kambing.vlsm.org stable/main Packages
500 http://security.debian.org stable/updates/main Packages
100 /var/lib/dpkg/status
2. Cara pake TCPdump
- Utk nampilin standar TCPdump output :
#tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:49:57.950569 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 705743480:705743596(116) ack 1737657567 win 20368
15:49:57.953868 arp who-has ns1.wave.net.id tell 116.212.100.13
15:49:57.953960 arp reply ns1.wave.net.id is-at 00:1b:11:e8:98:ba (oui Unknown)
15:49:57.953977 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 24955+ PTR? 222.3.159.202.in-addr.arpa. (44)
15:49:58.027214 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 24955 NXDomain 0/1/0 (107)
15:49:58.027798 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 37723+ PTR? 13.100.212.116.in-addr.arpa. (45)
15:49:58.028068 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 37723 NXDomain* 0/1/0 (105)
15:49:58.028765 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 28052+ PTR? 10.100.212.116.in-addr.arpa. (45)
15:49:58.029058 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 28052* 1/2/2 (138)
15:49:58.096475 IP 202.159.3.222.1766 > 116.212.100.13.ssh: . ack 0 win 64623
15:49:58.096558 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 116:1548(1432) ack 1 win 20368
15:49:58.096806 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 1548:1760(212) ack 1 win 20368
15:49:58.161419 IP 202.159.3.222.1766 > 116.212.100.13.ssh: P 1:53(52) ack 0 win 64623
- Network interface yg bisa di capture :
#tcpdump -D
1.eth1
2.any (Pseudo-device that captures on all interfaces)
3.lo
- Utk nampilin alamat numerik
#tcpdump -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:52:35.038923 IP 116.212.100.13.22 > 202.159.3.222.1766: P 705747000:705747116(116) ack 1737658607 win 20368
15:52:35.135921 IP 202.159.3.222.1766 > 116.212.100.13.22: . ack 0 win 65275
15:52:35.136008 IP 116.212.100.13.22 > 202.159.3.222.1766: P 116:396(280) ack 1 win 20368
15:52:35.136301 IP 116.212.100.13.22 > 202.159.3.222.1766: P 396:512(116) ack 1 win 20368
15:52:35.202463 IP 202.159.3.222.1766 > 116.212.100.13.22: P 1:53(52) ack 116 win 65159
15:52:35.202528 IP 116.212.100.13.22 > 202.159.3.222.1766: P 512:776(264) ack 53 win 20368
- Utk nampilin output yg cpt
#tcpdump -q
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:53:26.152224 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 116
15:53:26.161792 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 116
15:53:26.160278 arp who-has ns1.wave.net.id tell 116.212.100.13
15:53:26.160374 arp reply ns1.wave.net.id is-at 00:1b:11:e8:98:ba (oui Unknown)
15:53:26.160395 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 44
15:53:26.160624 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 107
15:53:26.161187 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 45
15:53:26.161413 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 105
15:53:26.162190 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 45
15:53:26.162450 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 138
15:53:26.211335 IP 202.159.3.222.1766 > 116.212.100.13.ssh: tcp 0
15:53:26.211407 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 1272
- Capture traffic interface tertentu :
#tcpdump -i eth0
- Capture traffic UDP :
#tcpdump udp
- Capture traffic port TCP 80
#tcpdump port http
- Capture trafik dari filter suatu file :
#tcpdump -F file_name
contoh file :
#vim file_name
port 80
- Berhenti capture setelah 20 paket :
#tcpdump -c 20
- Nyimpen capture-an ke suatu file :
#tcpdump -w capture.log
- Lihat capture file :
#tcpdump -r capture.log
reading from file capture.log, link-type EN10MB (Ethernet)
16:06:10.607444 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 705756112:705756164(52) ack 1737661227 win 22512
16:06:10.607463 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 52:168(116) ack 1 win 22512
16:06:10.704568 IP 202.159.3.222.1766 > 116.212.100.13.ssh: . ack 168 win 64431
16:06:12.450891 802.1d config 8000.00:1e:be:4f:93:08.8004 root 8000.00:1e:be:4f:93:08 pathcost 0 age 0 max 20 hello 2 fdelay 15
16:06:12.630703 IP 202.159.3.222.1766 > 116.212.100.13.ssh: P 1:53(52) ack 168 win 64431
- Utk nampilin paket yg punya “www.zulfanruri.com” sby source/dest address :
#tcpdump host www.zulfanruri.com
- Utk nampilin paket FTP yg berasal dari 192.168.1.100 ke 192.168.1.2 :
#tcpdump src 192.168.1.100 and dst 192.168.1.2 and port ftp
- Utk nampilin isi paket :
#tcpdump -A
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ath0, link-type EN10MB (Ethernet), capture size 96 bytes
20:53:24.872785 IP local.40205 > 192.168.1.2.ftp: S 4155598838:4155598838(0) win 5840
….g………………..
…………
20:53:24.879473 IP local.40205 > 192.168.1.2.ftp: . ack 1228937421 win 183
….g.I@………….
……..
20:53:24.881654 IP local.40205 > 192.168.1.2.ftp: . ack 43 win 183
….g.I@…….8…..
……EN
20:53:26.402046 IP local.40205 > 192.168.1.2.ftp: P 0:10(10) ack 43 win 183
….g.I@……`$…..
…=..ENUSER teddybear
20:53:26.403802 IP local.40205 > 192.168.1.2.ftp: . ack 76 win 183
….h.I@………….
…>..E^
20:53:29.169036 IP local.40205 > 192.168.1.2.ftp: P 10:25(15) ack 76 win 183
….h.I@……#c…..
……E^PASS wakeup
20:53:29.171553 IP local.40205 > 192.168.1.2.ftp: . ack 96 win 183
….h.I@.,………..
……Ez
20:53:29.171649 IP local.40205 > 192.168.1.2.ftp: P 25:31(6) ack 96 win 183
….h.I@.,………..
……EzSYST
20:53:29.211607 IP local.40205 > 192.168.1.2.ftp: . ack 115 win 183
….h.I@.?…..j…..
……Ez
20:53:31.367619 IP local.40205 > 192.168.1.2.ftp: P 31:37(6) ack 115 win 183
….h.I@.?………..
……EzQUIT
20:53:31.369316 IP local.40205 > 192.168.1.2.ftp: . ack 155 win 183
….h.I@.g………..
……E.
20:53:31.369759 IP local.40205 > 192.168.1.2.ftp: F 37:37(0) ack 156 win 183
….h.I@.h…..e…..
……E.
Capture paket saat koneksi ftp, passwordnya gampang dilihat krn dikirim berupa clear text ke server.
Utk capture di atas, user/password ftp = teddybear/wakeup
semoga berhasil ya ini juga referensi dari orang lain yang penting fokus pasti nanti bisa
1. Install TCPDUMP
- Utk nginstall :
#apt-get install tcpdump
- Utk liat dependensinya :
#apt-cache depends tcpdump
tcpdump
Depends: libc6
Depends: libpcap0.8
Depends: libssl0.9.8
- Utk lihat versi TCPdump yg terinstall :
# apt-cache policy tcpdump
tcpdump:
Installed: 3.9.5-2etch1
Candidate: 3.9.5-2etch1
Version Table:
*** 3.9.5-2etch1 0
500 http://kambing.vlsm.org stable/main Packages
500 http://security.debian.org stable/updates/main Packages
100 /var/lib/dpkg/status
2. Cara pake TCPdump
- Utk nampilin standar TCPdump output :
#tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:49:57.950569 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 705743480:705743596(116) ack 1737657567 win 20368
15:49:57.953868 arp who-has ns1.wave.net.id tell 116.212.100.13
15:49:57.953960 arp reply ns1.wave.net.id is-at 00:1b:11:e8:98:ba (oui Unknown)
15:49:57.953977 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 24955+ PTR? 222.3.159.202.in-addr.arpa. (44)
15:49:58.027214 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 24955 NXDomain 0/1/0 (107)
15:49:58.027798 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 37723+ PTR? 13.100.212.116.in-addr.arpa. (45)
15:49:58.028068 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 37723 NXDomain* 0/1/0 (105)
15:49:58.028765 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: 28052+ PTR? 10.100.212.116.in-addr.arpa. (45)
15:49:58.029058 IP ns1.wave.net.id.domain > 116.212.100.13.1035: 28052* 1/2/2 (138)
15:49:58.096475 IP 202.159.3.222.1766 > 116.212.100.13.ssh: . ack 0 win 64623
15:49:58.096558 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 116:1548(1432) ack 1 win 20368
15:49:58.096806 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 1548:1760(212) ack 1 win 20368
15:49:58.161419 IP 202.159.3.222.1766 > 116.212.100.13.ssh: P 1:53(52) ack 0 win 64623
- Network interface yg bisa di capture :
#tcpdump -D
1.eth1
2.any (Pseudo-device that captures on all interfaces)
3.lo
- Utk nampilin alamat numerik
#tcpdump -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:52:35.038923 IP 116.212.100.13.22 > 202.159.3.222.1766: P 705747000:705747116(116) ack 1737658607 win 20368
15:52:35.135921 IP 202.159.3.222.1766 > 116.212.100.13.22: . ack 0 win 65275
15:52:35.136008 IP 116.212.100.13.22 > 202.159.3.222.1766: P 116:396(280) ack 1 win 20368
15:52:35.136301 IP 116.212.100.13.22 > 202.159.3.222.1766: P 396:512(116) ack 1 win 20368
15:52:35.202463 IP 202.159.3.222.1766 > 116.212.100.13.22: P 1:53(52) ack 116 win 65159
15:52:35.202528 IP 116.212.100.13.22 > 202.159.3.222.1766: P 512:776(264) ack 53 win 20368
- Utk nampilin output yg cpt
#tcpdump -q
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
15:53:26.152224 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 116
15:53:26.161792 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 116
15:53:26.160278 arp who-has ns1.wave.net.id tell 116.212.100.13
15:53:26.160374 arp reply ns1.wave.net.id is-at 00:1b:11:e8:98:ba (oui Unknown)
15:53:26.160395 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 44
15:53:26.160624 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 107
15:53:26.161187 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 45
15:53:26.161413 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 105
15:53:26.162190 IP 116.212.100.13.1035 > ns1.wave.net.id.domain: UDP, length 45
15:53:26.162450 IP ns1.wave.net.id.domain > 116.212.100.13.1035: UDP, length 138
15:53:26.211335 IP 202.159.3.222.1766 > 116.212.100.13.ssh: tcp 0
15:53:26.211407 IP 116.212.100.13.ssh > 202.159.3.222.1766: tcp 1272
- Capture traffic interface tertentu :
#tcpdump -i eth0
- Capture traffic UDP :
#tcpdump udp
- Capture traffic port TCP 80
#tcpdump port http
- Capture trafik dari filter suatu file :
#tcpdump -F file_name
contoh file :
#vim file_name
port 80
- Berhenti capture setelah 20 paket :
#tcpdump -c 20
- Nyimpen capture-an ke suatu file :
#tcpdump -w capture.log
- Lihat capture file :
#tcpdump -r capture.log
reading from file capture.log, link-type EN10MB (Ethernet)
16:06:10.607444 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 705756112:705756164(52) ack 1737661227 win 22512
16:06:10.607463 IP 116.212.100.13.ssh > 202.159.3.222.1766: P 52:168(116) ack 1 win 22512
16:06:10.704568 IP 202.159.3.222.1766 > 116.212.100.13.ssh: . ack 168 win 64431
16:06:12.450891 802.1d config 8000.00:1e:be:4f:93:08.8004 root 8000.00:1e:be:4f:93:08 pathcost 0 age 0 max 20 hello 2 fdelay 15
16:06:12.630703 IP 202.159.3.222.1766 > 116.212.100.13.ssh: P 1:53(52) ack 168 win 64431
- Utk nampilin paket yg punya “www.zulfanruri.com” sby source/dest address :
#tcpdump host www.zulfanruri.com
- Utk nampilin paket FTP yg berasal dari 192.168.1.100 ke 192.168.1.2 :
#tcpdump src 192.168.1.100 and dst 192.168.1.2 and port ftp
- Utk nampilin isi paket :
#tcpdump -A
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ath0, link-type EN10MB (Ethernet), capture size 96 bytes
20:53:24.872785 IP local.40205 > 192.168.1.2.ftp: S 4155598838:4155598838(0) win 5840
….g………………..
…………
20:53:24.879473 IP local.40205 > 192.168.1.2.ftp: . ack 1228937421 win 183
….g.I@………….
……..
20:53:24.881654 IP local.40205 > 192.168.1.2.ftp: . ack 43 win 183
….g.I@…….8…..
……EN
20:53:26.402046 IP local.40205 > 192.168.1.2.ftp: P 0:10(10) ack 43 win 183
….g.I@……`$…..
…=..ENUSER teddybear
20:53:26.403802 IP local.40205 > 192.168.1.2.ftp: . ack 76 win 183
….h.I@………….
…>..E^
20:53:29.169036 IP local.40205 > 192.168.1.2.ftp: P 10:25(15) ack 76 win 183
….h.I@……#c…..
……E^PASS wakeup
20:53:29.171553 IP local.40205 > 192.168.1.2.ftp: . ack 96 win 183
….h.I@.,………..
……Ez
20:53:29.171649 IP local.40205 > 192.168.1.2.ftp: P 25:31(6) ack 96 win 183
….h.I@.,………..
……EzSYST
20:53:29.211607 IP local.40205 > 192.168.1.2.ftp: . ack 115 win 183
….h.I@.?…..j…..
……Ez
20:53:31.367619 IP local.40205 > 192.168.1.2.ftp: P 31:37(6) ack 115 win 183
….h.I@.?………..
……EzQUIT
20:53:31.369316 IP local.40205 > 192.168.1.2.ftp: . ack 155 win 183
….h.I@.g………..
……E.
20:53:31.369759 IP local.40205 > 192.168.1.2.ftp: F 37:37(0) ack 156 win 183
….h.I@.h…..e…..
……E.
Capture paket saat koneksi ftp, passwordnya gampang dilihat krn dikirim berupa clear text ke server.
Utk capture di atas, user/password ftp = teddybear/wakeup
semoga berhasil ya ini juga referensi dari orang lain yang penting fokus pasti nanti bisa
0 komentar:
Posting Komentar