Conversation started Aug 21, 2012 at 19:27.
Scott Pack
Scott Pack
Aug 21, 2012 19:27
I'm feeling like an idiot here. Can someone explain to me why this works: tcpdump -nn -r ringbuffer.1345575972 | grep 10.10.10.15
But this does not: tcpdump -nn -r ringbuffer.1345575972 ip host 10.10.10.15
Iszi
Iszi
I don't have a *nix machine up to be able to man tcpdump for you just now, sorry.
Scott Pack
Scott Pack
My non-working statement is syntactically correct, as near as I can tell, based on every version of the man page I've checked.
Iszi
Iszi
Sure you're not missing a dash or something somewhere?
Scott Pack
Scott Pack
`EXAMPLES
To print all packets arriving at or departing from sundown:
tcpdump host sundown
`
Well, that failed
Iszi
Iszi
Wait... aren't most man pages online?
tcpdump.org/tcpdump_man.html
Scott Pack
Scott Pack
Aug 21, 2012 19:33
Though not necessarily the man page for the version that you're running.
Iszi
Iszi
Right...
Looks to me like you've got too many args after -r?
Scott Pack
Scott Pack
Either way, that is, by the docs, a syntactically correct expression.
Iszi
Iszi
Oh, wait. The rest of that is your [expression]
Scott Pack
Scott Pack
Indeed.
Iszi
Iszi
Well, crap. Now I need to find the PCAP filter man.
Scott Pack
Scott Pack
Aug 21, 2012 19:36
pcap-filter(7)
Jeff Ferland
Jeff Ferland
@Iszi quote the string
... nevermind
Iszi
Iszi
@JeffFerland Thought that was right for a second after you said it, too. That's ok.
Scott Pack
Scott Pack
NO IT'S NOT!
Iszi
Iszi
What's -nn? I don't see it in the man.
Scott Pack
Scott Pack
Don't resolve either IPs or ports
One n says don't resolve names, and the second does ports.
Iszi
Iszi
Aug 21, 2012 19:42
Okay, so you want to do a tcpdump without resolving IPs or Ports, output to ringbuffer.1345575972 and filter it to only IP packets to/from 10.10.10.15?
Scott Pack
Scott Pack
Well, reading from and existing pcap file.
Iszi
Iszi
Ah, right. I thought it seemed weird to use "r" to specify output.
Scott Pack
Scott Pack
-r for read. You use -wto write to a file.
Iszi
Iszi
Well, the only difference I see between your straight tcpdump command and your grep filter is that grep doesn't limit you to IP packets?
Scott Pack
Scott Pack
Strictly speaking, the ip could or could not be in there and I get the same results.
Iszi
Iszi
Aug 21, 2012 19:47
That's what I thought, too. I'm guessing you've tried it?
Scott Pack
Scott Pack
naturally
Now I'm trying a hex wise filter against those byte offsets in the ip header.
Iszi
Iszi
So, you just threw that in as a red herring is that it? Asshole.
Scott Pack
Scott Pack
When you pass an IP address 'host' and 'ip host' are functionally equivalent.
Iszi
Iszi
That's what you think. But, tools can be... well, tools, with regards to such things.
Hey @nealmcb
nealmcb
nealmcb
@Iszi :)
Scott Pack
Scott Pack
Aug 21, 2012 19:51
Hey @Neal!
Iszi
Iszi
Hehe. I'm in an online training class right now, and the instructor just turned up Stack Overflow while trying to show us what kind of info is available on the Internet about the subject.
Scott Pack
Scott Pack
I'm doing an online training that's being given by a Brazilian who looks full on Irish and sounds like he's from Minnesota.
Ah-HAH!
Vlans baby.
Iszi
Iszi
@ScottPack What's that got to do with anything?
Scott Pack
Scott Pack
libpcap is doing something stupid with the filters on tagged packets.
Iszi
Iszi
So, what's that got to do with... Oh! Hrm. Cute.
Scott Pack
Scott Pack
Aug 21, 2012 19:54
I have explicitly add the vlan id to my filter.
That is, tcpdump -nn -r ringbuffer.1345575972 vlan 100 and host 10.10.10.15
mfer
Iszi
Iszi
Right. 'Cause otherwise you could totally end up finding packets from a 10.10.10.15 on another VLAN, I guess.
Scott Pack
Scott Pack
Aug 21, 2012 20:09
This appears to be behavior introduced in newer versions of libpcap, for some definition of newer.
That is, I found it about 10 pages into a bug report for debian from 2005.
 
Conversation ended Aug 21, 2012 at 20:10.