Jon Schipp covers GNU/Linux-specific tcpdump extensions, including long-format options, the --direction flag to filter inbound or outbound packets, and the any pseudo-interface that captures from all interfaces at once using linux_sll cooked capture format.
Chapters
In this video, we'll talk about some extensions and customizations that are done on the GNU/Linux version of tcpdump. The first one to talk about is the GNU long format options that are available. So let's do grep, and we'll do, uh, we're gonna match the double dash, and we need to escape them, otherwise the shell won't interpret this correctly, and we're gonna match the end of the line, and whoops, and then everything on the line, and then we're gonna do pipe to less. So now we actually have the double dash, or the GNU long options as they're called, available. And these aren't available on BSD or OS X, etc. So one of them that sticks out that's not available on those other systems, that's available just on GNU/Linux, is --number, which prints the— for every packet it prints, it numbers it. At the beginning of the line so you can keep track. --verdun is another one, and you can see there's a few more in here, but take a look at them and you can get acquainted with them. If you're looking to be cross-platform, then I recommend learning the short options so you'll be more, you'll be more able to use them across different platforms and operating systems. Okay, so now let's talk about a specific one that is only available on the GNU/Linux operating system, and that is the --direction option. So we can do, let's first go to the man page actually. Search for --direction. You can see that it chooses the directions for packets as they are captured. So this will not work on if you're reading from a file and it has to be on an interface. And this is a way that in this particular version of tcpdump since we're on GNU/Linux, there's a way in the kernel to actually figure out where the, what direction the packets are coming from. So if you want the short form, you can use the -q option up there. So -q, you can see there's 3 possible values: in, out, and in-out. And again, it says it's not available on platforms, to reiterate my point of this video. So let's go ahead and do this. We're gonna do -ni, we'll sniff on eth0, --direction, and we're going to look for trap packets that are only coming to this virtual machine. You can see just from looking at this, the, uh, source address here has not changed at all. .2.2, which if you look for eth0, it is not my machine because we told it only packets that are coming in. So those machines were sending data to me. Now let's go ahead and look for the out direction. Now, now it's only packets leaving that virtual machine or my computer, and you can see that's just me. All these packets just have my IP address. And then if we do in-out This is a way to do both, and that, and that is actually essentially the same thing as if you didn't specify a filter at all. Next up, let's talk about the any interface. So I'm going to go ahead and do ip link show. You can see these are my physical interfaces: the loopback, lo, eth0, and eth1. We don't see an interface called any, but you can actually specify an interface like this. And it will actually listen for packets. And this is actually a special pseudo interface that takes the packets from all the interfaces that could listen on and aggregates them whenever you choose, uh, the any interface. And they will— these— this aggregation of packets will become available to the any interface. So if you have multiple interfaces, you don't know where the traffic should be seen or where it's coming from, then you can use the any interface to specify that. Now, um, one thing to note if we do any head is that the output is a little different here. It says the link type is linux_sll, and to contrast that with an actual physical interface, you can see the link type is Ethernet. So to actually perform this aggregation using the pseudo interface, Linux has to do something— Artesipo has to do something special and a specific, um, ether or link layer, uh, cooked pseudo-header. And that's what this means, is cooked, it's made up. And if you go to, um, go to the browser here, we can say tcpdump, um, cooked header, and it actually has this under the headers type. So let's just search for cooked. There it is, Linux cooked capture encapsulation. And it actually has its own header type that's actually filled out that allows you to store the, all the, the real link layer stuff in here and then the payload data. But it actually has the cooked stuff above. So this is kind of how it works. So if you're ever in a sniffer tool and you see this and you don't understand what this means, Whenever you see that different output of Linux Cooked, just know that it's an abstraction and that there is a pseudo-header that is involved to actually handle the different, different packets from different interfaces, whether they're Ethernet or PPP or something else. It's just one way to make them all work together.
