TCPDUMP

                     tcpdump is the premier network analysis tool for information securityprofessionals. Having a solid grasp of this über-powerful application is mandatory for anyone desiring a thorough understanding of TCP/IP. Many prefer to use higher level analysis tools such as EtherealWireshark, but I believe this to usually be a mistake.
                In a discipline so dependent on a true understanding of concepts vs.rote learning, it's important to stay fluent in the underlying mechanics of the TCP/IP suite. A thorough grasp of these protocols allows one to troubleshoot at a level far beyond the average analyst, but mastery of the protocols is only possible through continued exposure to them.
It's also important to note that tcpdump only takes the first 68 96 bytes of data from a packet by default. If you would like to look at more, add the -s number option to the mix, where number is the number of bytes you want to capture. I recommend using 0 (zero) for a snaplength, which gets everything. Here's a short list of the options I use most:

• -i any : Listen on all interfaces just to see if you're seeing any traffic.
• -n : Don't resolve hostnames.
• -nn : Don't resolve hostnames or port names.
• -X : Show the packet's contents in both hex and ASCII.
• -XX : Same as -X, but also shows the ethernet header.
• -v, -vv, -vvv : Increase the amount of packet information you get back.
• -c : Only get x number of packets and then stop.
• -s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.
• -S : Print absolute sequence numbers.
• -e : Get the ethernet header as well.
• -q : Show less protocol information.
• -E : Decrypt IPSEC traffic by providing an encryption key.

Basic Usage
So, based on the kind of traffic I'm looking for, I use a different combination of options to tcpdump, as can be seen below:
Basic communication // see the basics without many options
# tcpdump -nS

Basic communication (very verbose) // see a good amount of traffic, with verbosity and no name help
# tcpdump -nnvvS

A deeper look at the traffic // adds -X for payload but doesn't grab any more of the packet
# tcpdump -nnvvXS
Heavy packet viewing // the final "s" increases the snaplength, grabbing the whole packet
# tcpdump -nnvvXSs 1514

Useful Examples

• host look for traffic based on IP address (also works with hostname if you're not using -n)
  # tcpdump host 1.2.3.4
• src, dst find traffic from only a source or destination (eliminates one side of a host conversation)
  # tcpdump src 2.3.4.5
  # tcpdump dst 3.4.5.6
• net capture an entire network using CIDR notation
  # tcpdump net 1.2.3.0/24
• proto : works for tcp, udp, and icmp. Note that you don't have to type proto
  # tcpdump icmp
• port : see only traffic to or from a certain port # tcpdump port 3389
• src, dst port : filter based on the source or destination port
  # tcpdump src port 1025
  # tcpdump dst port 389
• src/dst, port, protocol : combine all three
  # tcpdump src port 1025 and tcp
  # tcpdump udp and src port 53
• You also have the option to filter by a range of ports instead of declaring them individually, and to only see packets that are above or below a certain size.
  Port Ranges : see traffic to any port in a range 
  #tcpdump portrange 100-250
• Packet Size Filter : only see packets below or above a certain size (in bytes)
  #tcpdump less 32
  #tcpdump greater 128
  [ You can use the symbols for less than, greater than, and less than or equal / greater than or equal signs as well. ]

Writing to a File                              

Capture all Port 80 Traffic to a File
# tcpdump -s 1514 port 80 -w capture_file

Read Captured Traffic back into tcpdump
# tcpdump -r capture_file
We can use expressions as well.

1. AND 
2. and or &&
3. OR 
4. or or ||
5. EXCEPT 
6. not or !

More Examples
# TCP traffic from 10.5.2.3 destined for port 3389
tcpdump -nnvvS and src 10.5.2.3 and dst port 3389
# Traffic originating from the 192.168 network headed for the 10 or 172.16 networks
tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or172.16.0.0/16
# Non-ICMP traffic destined for 192.168.0.2 from the 172.16 network
tcpdump -nvvXSs 1514 dst 192.168.0.2 and src net and not icmp
# Traffic originating from Mars or Pluto that isn't to the SSH port
tcpdump -vv src mars and not dst port 22

# Traffic that's from 10.0.2.4 AND destined for ports 3389 or 22(incorrect)
tcpdump src 10.0.2.4 and (dst port 3389 or 22)

# Traffic that's from 10.0.2.4 AND destined for ports 3389 or 22(correct)
tcpdump 'src 10.0.2.4 and (dst port 3389 or 22)'

Extra Ordinary
You can also filter based on specific portions of a packet, as well as combine multiple conditions into groups. The former is useful when looking for only SYNs or RSTs, for example, and the latter for even more advanced traffic isolation.
[ Hint: An anagram for the TCP flags: Unskilled Attackers Pester RealSecurity Folk ]
All URGENT (URG) packets
# tcpdump 'tcp[13] & 32!=0'
All ACKNOWLEDGE (ACK) packets
# tcpdump 'tcp[13] & 16!=0'
All PUSH (PSH) packets

# tcpdump 'tcp[13] & 8!=0'
All RESET (RST) packets

# tcpdump 'tcp[13] & 4!=0'
All SYNCHRONIZE (SYN) packets
# tcpdump 'tcp[13] & 2!=0'
All FINISH (FIN) packets
# tcpdump 'tcp[13] & 1!=0'
All SYNCHRONIZE/ACKNOWLEDGE (SYNACK) packets
# tcpdump 'tcp[13]=18'

Useful commands

IPTables - Change Port of outgoing and incoming packets

Question: Is it possible to configure IPTables in a way that all outgoing packets to a certain IP and Port are altered with a different port and do the same for incoming packets?

I have to work with a server routinely and the Hoster decided that SSH access will only be possible on port 222 instead of the default 22.

This always causes a headache when ssh, scp or rsyncing. You always have to remember to add the port parameter

Answer: Yes it should certainly be possible to setup iptable rules to NAT outgoing traffic. You really should only need to create a rule that deals with the output traffic. You shouldn't need a rule to do anything to the returning packets. The state-ful nature of netfilter will deal with this for you.

You would probably need to use a rule like one of these.

# if you want to redirect requests from the local machine
iptables -t nat -A OUTPUT--destination remote.host.ip \
         -p tcp  --dport 22 -j DNAT --to-destination remote.host.ip:222

# if you want to redirect requests on a device inline
iptables -t nat -A PREROUTING --destination remote.host.ip \
         -p tcp  --dport 22 -j DNAT --to-destination remote.host.ip:222

Another simple solution would be to simply setup an SSH configuration file for the server and specify the port in your config.

# list of all names, you might commonly use for this host.
Host foo foo.example.org foo.example 
    # real hostname
    Hostname real.example.org 

    Port 222

Some Useful commands in linux.

To view all lines in single line of any text file

sed -e '/^$/d' file |  tr '\n' ' '

To Grep pattern with in a single command: ( will find shankar word and print only shankar)

grep -o 'shankar' file

To Grep 3rd field from matching pattern line  

awk '/Unix/{print $3}' file

To list all files starting with a and ending with cd. 

ls a?cd

There are few standard text processing tools which are used very often on the Unix-like system.

• No regular expression is used:
• cat(1) concatenates files and outputs the whole content.
• tac(1) concatenates files and outputs in reverse.
• cut(1) selects parts of lines and outputs.
• head(1) outputs the first part of files.
• tail(1) outputs the last part of files.
• sort(1) sorts lines of text files.
• uniq(1) removes duplicate lines from a sorted file.
• tr(1) translates or deletes characters.
• diff(1) compares files line by line

Basic regular expression (BRE) is used:

• grep(1) matches text with patterns.
• ed(1) is a primitive line editor.
• sed(1) is a stream editor.
• vim(1) is a screen editor.
• emacs(1) is a screen editor. (somewhat extended BRE)

Extended regular expression (ERE) is used:

• egrep(1) matches text with patterns.
• awk(1) does simple text processing.
• tcl(3tcl) can do every conceivable text processing: re_syntax(3). Often used   with tk(3tk).
• perl(1) can do every conceivable text processing. perlre(1).
• pcregrep(1) from the pcregrep package matches text with Perl Compatible Regular Expressions (PCRE) pattern.
• python(1) with the re module can do every conceivable text processing. See   "/usr/share/doc/python/html/index.html".
  See the ksh or sh-posix man page for more info on these. In bash you can use the help command.
  alias :-
  to list aliases
  let :-
  to do maths. Eg:- let x=2*4-5 ; echo $x
  set :-
  to list the current variables and their values.
  typeset -f :-
  to list functions
  typeset -i :-
  to list integer variables
  which :-
  to find where a program is (in some shells you use whence instead)

  Unix accessories

  See the corresponding man page for more info on these. Note that many of the commands have dozens of options that might save you needing to write code.
  wc:-
  This counts words lines and characters. To count the number of files in a directory, try ls | wc -l
  grep:-
  `grep Kwan /etc/passwd' prints all lines in /etc/passwd that include `Kwan'. The return value indicates whether any such lines have been found.
  sed:-
  a stream editor. Doing ls | sed s/a/o/g will produce a listing where all the 'a' characters become 'o'. Numerous tricks and tutorials are available from the Handy one-liners for SED file.
  basename:-
  Strips the directory and (optionally) suffix from a filename.
  tr:-
  Translates one set of characters to another set. For example, try

    echo "date" | tr d l

  The following does case conversion

    echo LaTeX | tr '[:upper:]' '[:lower:]'

  You can also use it as follows, ``capturing" the output in a variable

    old="LaTeX"
    new=$(echo $old | tr '[:upper:]' '[:lower:]')

  test:-
  This program can be used to check the existence of a file and its permissions, or to compare numbers and strings. Note that ` if [ -f data3 ]' is equivalent to ` if test -f data3'; both check for a file's existence, but the [...] construction is faster - it's a builtin. Note that you need spaces around the square brackets. Some examples,

  if [ $LOGNAME = tpl ] # Did the user log in as tpl? 
  if [ $num -eq 6 ]     # Is the value of num 6?
  if [ $(hostname) = tw000 ] # Does hostname produce `tw000'?
                             # i.e. is that the machine name?

  sort:-
  `ls -l | sort -nr +4' lists files sorted according to what's in column 4 of ls -l's output (their size, usually).
  cut:-
  Extracts characters or fields from lines. cut -f1 -d':' < /etc/passwd prints all the uid's in the passwd file. The following code shows a way to extract parts of a filename.

  filename=/tmp/var/program.cc
  
  b=$(basename $filename)
  prefix=$(echo $b | cut -d. -f 1)
  suffix=$(echo $b | cut -d. -f 2)

  find:-
  finds files in and below directories according to their name, age, size, etc.

  Exercises

  Suppose in a directory that you wanted to change all the filenames ending in .f77 so that they instead ended in .f90. How would you go about it?If you're new to Unix you may need to find out how to change filenames. Typing apropos filename will list the programs and routines whose summaries mention filename. Alas, the most useful command isn't mentioned there. Typing apropos rename lists mv which is what you need.
  Maybe next you might try ``mv *.f77 *.f90''. Alas, this won't work - the shell will replace *.f77 by a list of filenames and the resulting command will fail. You need to use a loop of some sort. You also need a way to remove a suffix (look up basename) and how to add a new suffix. It's worth experimenting with a single name first. Do filename=test.f77 and see if you can produce a test.f90 string from $filename . One solution is

  for filename in *.f77
  do
    b=$(basename $filename .f77)
    mv $filename $b.f90
  done

  Here are some more exercises with useful man pages suggested. None of the solutions to these should be much more than a dozen lines long. Answers to some of these are in the next section.
  1. Change the args script supplied earlier so that if no argument is provided, ``They are'' isn't printed, and if exactly 1 argument is provided, ``... 1 argument'' rather than ``... 1 arguments'' is printed (use if)
  2. Read in two numbers from the keyboard and print their sum (see the read, echo and let commands in the shell manual page).
  3. Write a shell script that given a person's uid, tells you how many times that person is logged on. (who, grep, wc)
  4. Write a shell script called lsdirs which lists just the directories in the current directory (test).
  5. Write a shell script called see taking a filename name as argument which uses ls if   the file's a directory and more if the file's otherwise (test)
  6. Write a shell script that asks the user to type a word in, then tells the user how long that word is. (read, wc)
  7. In many versions of unix there is a -i argument for cp so that you will be prompted for confirmation if you are about to overwrite a file. Write a script called cpi which will prompt if necessary without using the -i argument. (test)
  8. Write a shell script that takes a uid as an argument and prints out that person's name, home directory, shell and group number. Print out the name of the group corresponding to the group number, and other groups that person may belong to. (groups, awk, cut. Also look at/etc/passwd and /etc/groups).
  9. Sort /etc/passwd using the uid (first field) as the key. (sort)
  10. Suppose that you want to write the same letter to many people except that you want each letter addressed to the senders personally. This mailmerge facility can be created using a shell script. Put the names of the recipients (one per line) in a file called names, create a texfile called template which has NAME wherever you want the person's name to appear and write a script (using sed) to produce a temporary file called letter from the template file.

Eval :-

Consider the following

word1=one
word2=two
number=1

The variable word$number has the value one but how can the value be accessed? If you try echo $word$number or even echo ${word$number} you won't get the right answer. You want $number processed by the shell, then the resulting command processed. One way to do this is to use eval echo \$word$number - the \ symbol delays the interpretation of the first $ character until eval does a second pass.

Alternative notations :-

((a=a<<2+3)) is the equivalent of let a="a<<2+3" - note that this variant saves on quotemarks.

  [[ -f /etc/passwd ]]
     echo the passwd file exists

is another way of doing

  if [ -f /etc/passwd ]
  then
     echo the passwd file exists
  fi

or you could use the logical && operator, which like its C cousin only evaluates the second operand if the first is true.

  [ -f /etc/passwd ] && echo the passwd file exists

Bash features:-

C-like for loops are possible.

for((i=1; $i<3; i=i+1))
do
  echo $i
done

Regular expressions (wildcard characters etc) can be used in some comparisons. In the following, ?[aeiou]? is a regular expression that matches a character followed by one of a, e, i , o ,u, followed by a character

for word in four six sly
do
  if [[ $word == ?[aeiou]? ]]
  then
    echo $word is 3 letters long with a central vowel
  else
    echo $word is not 3 letters long with a central vowel
  fi
done