Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Wed Jan 18, 2017 7:41 pm


TCPdump & Wireshark tips & tricks - Different how-tos and some information I find interesting about the two most famous traffic analysis tools.

Author Message
mandrei99
Post  Post subject: Tcpdump icmp practical examples filtering on icmp type field and icmp code field  |  Posted: Wed Jan 14, 2015 5:00 am

Joined: Tue Aug 04, 2009 9:16 am
Posts: 245

Offline
 

Tcpdump icmp practical examples filtering on icmp type field and icmp code field

The manual for tcpdump shows how to use tcpdump expressions and primitives to build traffic capturing filters based on protocol field values, like specific icmp type and specific icmp code and specific source host.

Tcpdump also offers a way to filter packets with specified value in a specific protocol byte number, ie: we know icmp header first byte (0) is icmp type and second byte (1) is the icmp code so tcpdump allows to either use builtin primitives like "icmptype" and "icmpcode" or protocol byte number like "icmp[0]" and "icmp[1]".


Per RFC792 (https://tools.ietf.org/html/rfc792 below is icmp protocol header:

Code:
    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |     Code      |          Checksum             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                             unused                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Internet Header + 64 bits of Original Data Datagram      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+



Wikipedia page for icmp shows the full table of icmp types and icmp codes as well as their numerical codes: http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol.

Manual for tcpdumps shows us a list of available builtin primitives for icmp types and codes. Quote:
Quote:
Some offsets and field values may be expressed as names rather than as numeric values. The following protocol header field offsets are avail-
able: icmptype (ICMP type field), icmpcode (ICMP code field), and tcpflags (TCP flags field).

The following ICMP type field values are available: icmp-echoreply, icmp-unreach, icmp-sourcequench, icmp-redirect, icmp-echo, icmp-routerad-
vert, icmp-routersolicit, icmp-timxceed, icmp-paramprob, icmp-tstamp, icmp-tstampreply, icmp-ireq, icmp-ireqreply, icmp-maskreq, icmp-maskre-
ply.


Example based on the same manual:To print all icmp packets that are not ping packets (echo requests/replies):
Code:
tcpdump -nni eth0 "icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply"

or printing icmp packets that are not ping by using byte numbers and numerical codes for icmp type and icmp code:
Code:
tcpdump -nni eth0 "icmp[0] != 8 and icmp[0] != 0"

Tcpdump print only icmp traffic:


Code:
tcpdump -nni eth0 icmp

Tcpdump print only "Destination Unreachable" icmp type, "Fragmentation required and DF bit set" icmp code


Code:
tcpdump -nni eth0 icmp[0] = 3 and icmp[1] = 4





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Tcpdump icmp practical examples filtering on icmp type field and icmp code field"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Tcpdump: How to to capture only ICMP Fragmentation needed notifications

mandrei99

0

3652

Thu Aug 22, 2013 6:50 am

mandrei99 View the latest post

There are no new unread posts for this topic. Tcpdump: How to to capture only ICMP (ping) echo requests

mandrei99

0

81488

Thu Aug 22, 2013 6:39 am

mandrei99 View the latest post

There are no new unread posts for this topic. Tcpdump: How to to capture only ICMP (ping) echo replies

mandrei99

0

196

Thu Aug 22, 2013 6:41 am

mandrei99 View the latest post

There are no new unread posts for this topic. Tcpdump filter packets with specified ip identification in ip header

mandrei99

0

1710

Wed Jan 14, 2015 5:15 am

mandrei99 View the latest post

There are no new unread posts for this topic. Tcpdump - dump HTTP headers as ASCII and HEX

mandrei99

2

8850

Wed Jun 29, 2016 10:34 am

admin View the latest post

There are no new unread posts for this topic. Tcpdump: How to to capture only IP packets with specific DSCP class in IP header

admin

0

4903

Wed Apr 10, 2013 8:59 am

admin View the latest post

There are no new unread posts for this topic. tcpdump: How to capture frames with specific source destination mac address

mandrei99

0

10916

Mon Jan 12, 2015 10:36 am

mandrei99 View the latest post

There are no new unread posts for this topic. tcpdump -xx -XX - dump packet header and data in hex and ASCII format

admin

0

4312

Thu Mar 19, 2015 5:33 am

admin View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO