Free MP3 Music Header Free MP3 Music Header Free MP3 Music Header
Chrome Strip
Chrome Strip

When we do not have access to a GUI, we can use something like the tcpdump utility.

Lets look at what happened in the password_crackng_filtered.pcap file.

#tcpdump -r password_crackng_filtered.pcap

TCPDUMP - Filtering Traffic
The output is overwhelming at first so let's try to get a better understanding of the IP addresses and ports involved by using the ask and sort commands.

#tcpdump -n -r password_cracking_filtered.pcap |awk -F" " '{prnt $3}' |sort -u |head

We can easily filter for destination or source IPs and ports with syntax similar to the following:

#tcpdump -n src host -r password_cracking_filtered.pcap
#tcpdump -n dst host -r password_cracking_filtered.pcap
#tcpdump -n port 80 -r password_cracking_filtered.pcap

We proceed to dump the actual traffic captured in the dump file in hex format, to see if we can glean any additional information fom the data that was transferred:

#tcpdump -nX -r password_crackng_filtered.pcap

In this example we are able to see what looks like http traffic on port 81 with a user agent of teh forest lobster.

TCPDUMP - Advanced Header Filtering
Tcpdump has some advanced header filtering options that can aid us with our pcap analysis.
We wold lke to filter out and display only the data packets in the dump which have the PSH and ASK flags turned on. As can be seen in the diagram on pae 73 of the manual, the TCP flags are defined in the 14th byte of TCP header.

To calculate the correct filter to use, we turn on the bits for the specific flags we need, n this example. the ACK and PSH flags - A & P respectively.

00011000 = 24 in decimal

Our command would look similar to the following - specifying that the 14th byte in the packets displayed should have ACK or PSH flags set.

#tcpdump -A -n 'tcp[13] = 24' -r password_cracking_filtered.pcap