Questions:
1- Write a tcpdump command to display all the packets your system sent to matrix. Do not do any name resolution for any fields in the packet but do display the physical addresses contained in the packets.
[root@localhost ~]# tcpdump -i eth1 -e dst host 142.204.140.90
Output: tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes 17:57:55.444652 00:16:76:1b:40:d2 (oui Unknown) > 00:0e:0c:4b:31:5c (oui Unknown), ethertype IPv4 (0x0800), length 114: 142.204.141.177.55212 >142.204.140.90.ssh: P 1362020055:1362020103(48) ack 2398231338 win 161 <nop,nop,timestamp 15530872 12456689> 17:57:55.445693 00:16:76:1b:40:d2 (oui Unknown) > 00:0e:0c:4b:31:5c (oui Unknown), ethertype IPv4 (0x0800), length 66: 142.204.141.177.55212 > 142.204.140.90.ssh: . ack 49 win 161 <nop,nop,timestamp 15530873 12471613> (...additional output removed...)
2- Write a tcpdump command to display all the packets sent to your system from matrix. Do not do any name resolution for any fields in the packet but do display the physical addresses contained in the packets.
[root@localhost ~]# tcpdump -i eth1 -e src host 142.204.140.90
Output: tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes 17:58:56.585343 00:0e:0c:4b:31:5c (oui Unknown) > 00:16:76:1b:40:d2 (oui Unknown), ethertype IPv4 (0x0800), length 66: 142.204.140.90.ssh > 142.204.141.177.55212: . ack 1362020247 win 83 <nop,nop,timestamp 12486897 15592012> (...additional output removed...)
3- Write a tcpdump command to display all the ARP packets captured in the packet file. Include the output in your answer.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts arp
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 20:31:39.142311 arp who-has 142.204.141.188 tell 142.204.141.129 20:31:39.142336 arp reply 142.204.141.188 is-at 00:16:76:1b:40:d2 (oui Unknown) 20:32:34.928721 arp who-has 142.204.141.188 tell 142.204.141.129 20:32:34.928737 arp reply 142.204.141.188 is-at 00:16:76:1b:40:d2 (oui Unknown)
4- Write a tcpdump command to display all the ICMP "echo-request" packets in the packet file. Include the output in your answer.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts icmp
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 20:31:34.141754 IP 142.204.141.188 > 142.204.140.90: ICMP echo request, id 46859, seq 1, length 64 20:31:34.142754 IP 142.204.140.90 > 142.204.141.188: ICMP echo reply, id 46859, seq 1, length 64 20:31:35.141701 IP 142.204.141.188 > 142.204.140.90: ICMP echo request, id 46859, seq 2, length 64 20:31:35.142683 IP 142.204.140.90 > 142.204.141.188: ICMP echo reply, id 46859, seq 2, length 64
5- Write a pipe line command, using tcpdump as part of the pipe line, to display the total number of packets belonging to the TELNET session between your system and matrix.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts tcp port 23 | wc -l
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 198
6- Do the same for the SSH session.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts tcp port 22 | wc -l
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 76
7- Write a pipe line command, using tcpdump as part of the pipe line, to display the total number of TCP packets in the packet file.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts tcp | wc -l
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 314
8- Do the same for UDP packets.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts udp | wc -l
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 30
9- Describe the steps you could use to find out all MAC addresses captured in the packet file. Include all the MAC addresses found in your answer.
Not answered yet...
10- Describe the steps you could use to find out the total number of bytes your system received from matrix.
[root@localhost ~]# tcpdump -r /tmp/lab3-pkts src 142.204.140.90 | wc -c
Output: reading from file /tmp/lab3-pkts, link-type EN10MB (Ethernet) 14639