Re: TCP Dump Filters

From: Jared C. Lovell (lovell@blindfaith.org)
Date: 12/21/01 

Date: Fri, 21 Dec 2001 09:00:34 -0800 (PST)
From: "Jared C. Lovell" <lovell@blindfaith.org>
To: Mark Coleman <mcoleman@uniontown.com>

tcpdump can dump entire packets:

tcpdump -s 0 -w filename -i interface

Still not an IDS on it's own...

On Thu, 20 Dec 2001, Mark Coleman wrote:

> I believe that TCPDump just grabs packet headers, so it can't watch for
> anything in the payload, thus making it a poor choice for IDS beyond layer
> 4.
>
> I have seen it used to detect connections to boxen that should never happen
> for example, but NOT to see that an email attachment is called README.EXE.
>
> I may be wrong on this one, but I don't think I am. You need something like
> Snort for any good payload monitoring.
>
> -Mark
>
>
> ----- Original Message -----
> From: <JCFontelera@SolanoCounty.com>
> To: <focus-ids@securityfocus.com>
> Sent: Wednesday, December 19, 2001 4:25 PM
> Subject: TCP Dump Filters
>
>
> > Does anyone know a good web site that explains how
> > to create TCPDUMP or windump filters to detect all sorts of
> > attack signatures ?
> >
> > Thanks,
> > Jaime
>
>

Relevant Pages

  • Re: how to rotate a tcpdump file
    ... Therefore you're going to have to wrap tcpdump in a script to test the size ... restart tcpdump with a new dump file. ... depending on what data you're capturing there might be a really simple ... simply capturing 154202 packets will give you a 10MB dump file. ...
    (freebsd-questions)
  • Re: ntpd fails to synchronize on FreeBSD 6.3-STABLE
    ... 12 packets received by filter ... Then let the tcpdump go for about 15 minutes. ... Firewall on my router/gateway is disabled, ... # shutdown -r now ...
    (freebsd-stable)
  • Re: flooding an embedded device with isic and tcpreplay causing different results
    ... You can try use -nn option at tcpdump too, ... now I wondering why the tcpreplay attack don't f*** up the SOHO. ... The tcpdump isn't complete because of "dropped by kernel" packets - ... listening on eth0, link-type EN10MB, capture size ...
    (Pen-Test)
  • Re: Should route, but doesnt
    ... > I bought the Netgear box last June. ... > Packets get from the RedHat 7.2 box to my LAN or to the Internet. ... You might find it useful to watch the packets with tcpdump, ... with the private subnets. ...
    (comp.os.linux.networking)
  • RE: NFS regression? Odd delays and lockups accessing an NFS export.
    ... required length to catch whole packets." ... Odd delays and lockups accessing an NFS ... can you provide me with a binary tcpdump or wireshark dump? ... The kernel booted though, so that was okay. ...
    (Linux-Kernel)