Hey guys and welcome back. So there is one more command that we want to learn about with
respect to this current exam objective and that command is TCP dump. So if we go into
the man page for TCP dump, we can see here this is going to allow us to dump traffic
on a network. Simply put, this is going to allow us to see the contents of packets on
a network interface. So you can conceptualize this as a type of packet sniffer, allowing
us to view traffic traversing our local network. Now one thing to say here is that even though
the name happens to suggest that all TCP dump will do will allow you to capture TCP based
traffic. That is really more the common use of the tool indeed. It can also support capturing
things like UDP and ICMP so on and so forth. So don't let the name fool you is what I'm saying.
Now let's just have a brief look at how we can use this tool. What we could just say is TCP
dump and if we hit enter, of course I have to use super user privileges. I'm always forgetting
that. Let's type in my password. Look at all this information blasting down the screen right now.
Okay. So what I'm going to do is I'm going to press Ctrl Z to stop this. Clearly we have way
too much information, but the good news is, is that with TCP dump we can actually control
the output. Just like we could with the pin command, we could specify the count i.e. the
number of packets we want to capture. So I could say TCP dump and I could say dash C and of course
I better use super user privileges. Forgetting that again. And I'll say dash C with the value 10
i.e. just capture and print 10 packets. If I hit enter, check this out now. We just captured
10 packets and printed them out. Now realistically, if you happen to have multiple interfaces,
maybe say interface ethernet zero, interface ethernet one, interface ethernet two, so on
so forth, you may want to actually be picky and actually select a particular interface on
which to listen. So what we could do here is, is we could say sudo TCP dump and we could use the
dash i flag and then specify a particular interface. Now as it transpires, I only have one
ethernet interface that is ENP zero S3. So if I hit enter, we're going to get the same information
blasting on through. But you'll be happy to know we can actually combine and chain these commands
like accountness to maybe say seven packets, but do a space there actually. So that we're only
going to target a particular interface for account of seven. So if I hit enter now, we can
particularly hone in on this traffic traversing the local network. Now you may notice here is that
we're getting information relating to IP the protocol, but also getting information relating
to the particular sockets, ie the IP address and the port number. We can actually filter this
information if we so wish. So let's say I wanted to exact a little bit more control, I could say
sudo TCP dump. And all I want to get is information coming from a particular source. So I could say
source 192 168 0.1. And if I hit enter, we're just going to be listening for traffic that is sourced
from this IP address. Now as it transpires, it doesn't seem like much is coming through on that IP
address. So what I'll do is I'll just stop this right now. Let me try it with the IP address of
source 0.39. And I will count for 20 packets. Now look at this here. We've just pulled out 20 packet
captures that are sourced from this particular IP address. And we can see the port number here.
And it's going to my IPv0 dot SSH. Simply put, this is my Windows machine, establishing this SSH
connection. And all we're doing here is sniffing that out. Similarly, I could say sudo TCP dump,
and I could target traffic going for a particular destination by using the DST keyword. And I will
give my IP address. So any traffic that is destined for me, there is my IP address. And I will say
count of 25 packets. If I enter, we're getting the same type of information we are filtering on
anything that is coming to this IP address as a destination. Now if I want to target maybe say a
port, I could say sudo TCP dump, and I could find absolutely anything that is destined for port number
22. And again, I'll just say see to capture maybe 15 packets. If I enter, we are seeing all the
connections, which in this case just happens to be coming from the one computer. But if there were
multiple connections, we would capture them all here. So long as that connection had a destination
port of 22, ie the connection was an SSH based connection, which is port number 22. Similarly,
if I want to maybe grab anything that is sourced from this port, we'll get the same information
just a different way. So I'll say from the source port of 49763, and I'll just capture four packets,
if I enter same type of deal. So lots of ways to control this data, as opposed to just saying TCP
dump and being absolutely overwhelmed by the constant stream of information, particularly if
you happen to be on a large network, where there are tons and tons of devices all communicating. So
the TCP dump command is indeed very, very useful for being able to monitor traffic traversing your
local network. Like I say, there are many more options that we have left unexplored. If you go
through the man page, you can see all these different switches to control the particular
outputs. We can do things like the dash W flag, which will allow us to actually write the data
to a particular file as opposed to printing that data onto the terminal screen. And when you happen
to create one of these files, it's actually going to be written in binary. So if you want to be able
to read that file afterwards, you can then use the dash R flag to read that packet capture file. But
like I say, there are a whole ton of different options available using the TCP dump command. And
as always, I'd recommend you do some exploration and labbing on your own. Okay, so that is us for
our introduction into the TCP dump command. I hope this has been informative for you. And I'd like
to thank you for viewing.