11Capturing & Analyzing Network Traffic: tcpdump/tshark and WiresharkEE 122: Intro to Communication NetworksVern Paxson / Jorge Ortiz / Dilip Anthony Joseph2Overview• Examples of network protocols• Protocol Analysis– Verify Correctness– Analyze performance– Better understanding of existing protocols– Optimization and debugging of new protocols• Tools– tcpdump & tshark– Wireshark23Network Protocol Examples• Defines the rules of exchange between a pair (or more) machines over a communication network• HTTP (Hypertext Transfer Protocol)– Defines how web pages are fetched and sent across a network• TCP (Transmission Control Protocol)– Provides reliable, in-order delivery of a stream of bytes• Your protocol here4Protocol Analysis• Verify correctness• Debug/detect incorrect behavior• Analyze performance• Gain deeper understanding of existing protocols by “seeing” how they behave in actual use35Analysis Methods• Instrument the code– Difficult task, even for experienced network programmers– Tedious and time consuming• Use available tools– tcpdump / tshark– Wireshark– ipsumdump• Write your own tool– libpcap6Tools overview• Tcpdump– Unix-based command-line tool used to intercept packetso Including filtering to just the packets of interest– Reads “live traffic” from interface specified using -ioption …– … or from a previously recorded trace file specified using -r optiono You create these when capturing live traffic using -w option• Tshark– Tcpdump-like capture program that comes w/ Wireshark– Very similar behavior & flags to tcpdump• Wireshark– GUI for displaying tcpdump/tshark packet traces47Tcpdump example 01:46:28.808262 IP danjo.CS.Berkeley.EDU.ssh > adsl-69-228-230-7.dsl.pltn13.pacbell.net.2481: . 2513546054:2513547434(1380) ack 1268355216 win 1281601:46:28.808271 IP danjo.CS.Berkeley.EDU.ssh > adsl-69-228-230-7.dsl.pltn13.pacbell.net.2481: P 1380:2128(748) ack 1 win 1281601:46:28.808276 IP danjo.CS.Berkeley.EDU.ssh > adsl-69-228-230-7.dsl.pltn13.pacbell.net.2481: . 2128:3508(1380) ack 1 win 1281601:46:28.890021 IP adsl-69-228-230-7.dsl.pltn13.pacbell.net.2481 > danjo.CS.Berkeley.EDU.ssh: P 1:49(48) ack 1380 win 16560• Ran tcpdump on the machine danjo.cs.berkeley.edu• First few lines of the output:801:46:28.808262 IP danjo.CS.Berkeley.EDU.ssh > adsl-69-228-230-7.dsl.pltn13.pacbell.net.2481: . 2513546054:2513547434(1380) ack 1268355216 win 12816Timestamp This is an IP packetSource host nameSource port number (22)Destination host nameDestination port numberTCP specific information• Different output formats for different packet typesWhat does a line convey?59Similar Output from Tshark 1190003744.940437 61.184.241.230 -> 128.32.48.169 SSH Encrypted request packet len=481190003744.940916 128.32.48.169 -> 61.184.241.230 SSH Encrypted response packet len=481190003744.955764 61.184.241.230 -> 128.32.48.169 TCP 6943 > ssh [ACK] Seq=48 Ack=48 Win=65514 Len=0 TSV=445871583 TSER=6325354931190003745.035678 61.184.241.230 -> 128.32.48.169 SSH Encrypted request packet len=481190003745.036004 128.32.48.169 -> 61.184.241.230 SSH Encrypted response packet len=481190003745.050970 61.184.241.230 -> 128.32.48.169 TCP 6943 > ssh [ACK] Seq=96 Ack=96 Win=65514 Len=0 TSV=445871583 TSER=63253550210Demo 1 – Basic Run• Syntax: tcpdump [options] [filter expression]• Run the following command on the machine c199.eecs.berkeley.edu:tcpdump• Observe the output611Filters• We are often not interested in all packets flowing through the network• Use filters to capture only packets of interest to us12Demo 21. Capture only udp packets• tcpdump “udp”2. Capture only tcp packets• tcpdump “tcp”713Demo 2 (contd.)1. Capture only UDP packets with destination port 53 (DNS requests)• tcpdump “udp dst port 53”2. Capture only UDP packets with source port 53 (DNS replies)• tcpdump “udp src port 53”3. Capture only UDP packets with source or destination port 53 (DNS requests and replies)• tcpdump “udp port 53”14Demo 2 (contd.)1. Capture only packets destined to quasar.cs.berkeley.edu• tcpdump “dst host quasar.cs.berkeley.edu”2. Capture both DNS packets and TCP packets to/from quasar.cs.berkeley.edu• tcpdump “(tcp and host quasar.cs.berkeley.edu) or udp port 53”815How to write filters• Refer cheat sheet slides at the end of this presentation• Refer the tcpdump/tshark man page16Running tcpdump• Requires superuser/administrator privileges• EECS instructional accounts– You have access to setuid versions of tcpdump/tshark• /share/b/ee122/tcpdump• /share/b/ee122/{i86pc,sun4u}/bin/tshark ← Wireshark here too• /bin/bash• alias tcpdump=‘/share/b/ee122/tcpdump’– Only works on Solaris 10 machines listed at http://inst.eecs.berkeley.edu/cgi-bin/clients.cgi?choice=servers• Non EECS instructional accounts– tcpdump, tshark & wireshark work on many different operating systems– Download the version for your personal desktop/laptop from•http://www.tcpdump.org, http://www.winpcap.org/windump/917Security/Privacy Issues• Tcpdump/tshark/wireshark allow you to monitor other people’s traffic• WARNING: Do NOT use these to violate privacy or security• Use filtering to restrict packet analysis to only the traffic associated with your assignment. E.g., for project #1:– tcpdump –s 0 –w all_pkts.trace tcp port 778818Wireshark System Overview1019Wireshark Interface20Demonstration• Questions?1121Other Useful Tools• IPsumdump– Handy “Swiss army knife” for displaying in ASCII fields of interest in packet trace files – http://www.cs.ucla.edu/~kohler/ipsumdump/– For instructions to use IPsumdump on EECS instructional accounts, see slide “Appendix: IPsumdump on EECS instructional accounts”• Libpcap– Unix packet capture library on which tcpdump/tshark are built– http://www.tcpdump.org/22Assignment Requirements• tcpdump -w <dump_file_name> -s 0options must be used for the traces submitted as part of the assignments– tshark doesn’t require -s 0 (default)• Appropriately name each dump file you submit and briefly describe what each dump file contains/illustrates in the README file associated with the assignment submission1223Cheat Sheet – Commonly Used Tcpdump Options• -n Don’t convert host addresses to names. Avoids DNS lookups. It can save you time.• -w <filename> Write the raw packets to the specified file instead of parsing and printing them
View Full Document
Unlocking...