When it comes to sniffing traffic using a command line tool, DCP dump is the tool of choice for both
its power and simplicity is compatible with Wireshark, and that means that you can save the captured
back to a file and the later open that find Wireshark on the same or another machine for a visual inspection.
Let's see how he talks.
This dump is installed by default on any Linux distribution, the following comings will be executed
is good.
If you want to see what's hitting your interface, you execute DCP Dump minus.
I enter the name of the interface in this case, 88 zero.
Let's generate some traffic.
These are the basics.
I'm stopping the capture by pressing on control.
Plus, see?
If you want to see only the packets to or from an IP address, you add the host option.
DCP Dump Minus I into the interface host and an IP address, let's say eight eight eight eight eight
eight eight eight and in another terminal I'm going to ping that IP address.
It's capturing only the packets to or from that IP address.
And if you only want to see traffic in one direction or the other, you can use a Sarsae or DSTO like
this.
The estie medium dot com minus an option is used not to convert the addresses to names, you can use
an IP address or a domain name that will be translated to an IP address by your DNS server.
And these are the packets to medium that come.
To capture Bishkek's going to or from a particular network or Cybernet use the net option.
Net and the summit address.
And if you want to see pics of a specific application, use the port option, for example, I want to
see only a few tips paycheck's.
Part four hundred forty three, minus double V and minus 10 to produce more verbose output and print
additional Feliks, I have used minus double V..
This is a steeps traffic, if you want to see traffic going to or coming from a specific port, use
a Sarsae port or DST port options, for example.
I listen if only DNS queries and the Vietnamese UDP packets going to Port 53.
This is the part 53 minus five minus in.
You see, these are DNS queries, Haitink minus eight option will have the output include ASCII strings
from the capture.
This allows easy reading and the ability to pass the output using grep or rather Cumming's.
Let's try this filter.
DSD port at minus eight and minus 10 minus is optional.
And I'll visit an HTP site.
For example, info that certain that C.H..
By the way, this is the home of the first website.
You see the capture, if you use minus X instead minus three, you'll see both ASCII and hexadecimal
data.
I'm reloading the page.
This is the captured Pickett ex-con thinks is a string in here.
On the left side is hexadecimal data.
Let's go ahead and see how to save the captured data to a file it's often useful to save because it
captures into a file for analysis in the future.
These files are known as Peekapoo files and can be opened in Wireshark or other packet analysis tools,
including Tsipi Dump Self.
The right to a file use minus W option like this, in the next example, I want to save all HTP Paquita
to a file so Tsipi dump minus the name of the interface at the zero point eighty seven that C eight.
Minus W and the name of the fight, sorry, that C.H. that pick up.
It will save the package to this file.
And I'm generating some traffic, some HTP traffic.
When you want to stop the capture, you simply press on control.
Plus, see?
Twenty seven police have been captured and saved to that file.
To read the file at a later time with DCP dump used, miners are like these.
Note that when reading the file, all options we have seen are still available, for example, minus
and minus double V and minus X, an uppercase X.
At the end of this lecture, I want to show you some more advanced features of this dump week, psychological
end and or operators.
Let's suppose you want to capture only ICMP packet's going to a specific IP address, for example,
DCP dump minus 88 zero, ICMP the protocol and Post and the IP address, it will capture only ICMP packets
to or from this IP address.
OK, Abbink was running in the background.
These are the packets, but if I pick another IP address, let's say stack overflow dot com, you notice
that the packets are not captured.
And the last example I kept are HTP or ATP's traffic, for that, I have to use the logical or operator
like this Port 8D or port four hundred forty three.