TCPDump - Revision history

Wayne-workman.28155 at 04:32, 12 May 2016

2016-05-12T04:32:51Z

2016-04-01T16:59:25Z

2016-01-26T13:28:31Z

2016-01-26T13:27:50Z

2015-07-24T22:22:32Z

Fixed grammar.

2015-07-24T22:20:31Z

Added TFTP example because it wasn't clear enough for some people.

2015-06-13T16:51:47Z

2015-06-13T16:48:20Z

fixed wireshark link

2015-06-13T16:45:50Z

added bits about transfering the issue.pcap file to another machine.

2015-04-17T06:07:39Z

@@ Line 21: / Line 21: @@
 <pre>tftp –i x.x.x.x get issue.pcap</pre>
 Obviously you need the TFTP windows component installed, and you should turn off your windows firewall.
@@ Line 27: / Line 28: @@
 [[Troubleshoot_TFTP]]

← Older revision		Revision as of 16:59, 1 April 2016
Line 30:		Line 30:


−	After the capture is completed and you've opened the PCAP file, please use the MAC address of the target host as the filter for sender & receiver. The below example filter basically does this: ( Show packet if Sending MAC equals xxxxxxx OR Receiving MAC equals xxxxxx )	+	After the capture is completed and you've opened the PCAP file with wireshark, please use the MAC address of the target host as the filter for sender & receiver. The below example filter basically does this: ( Show packet if Sending MAC equals xxxxxxx OR Receiving MAC equals xxxxxx )

@@ Line 34: / Line 34: @@
 Example Filter (change the MAC addresses):
-<pre>eth.dst == 00:0C:CC:76:4E:07 || eth.src==00:0C:CC:76:4E:07</pre>
+<pre>eth.dst == 00:0C:CC:76:4E:07 || eth.src == 00:0C:CC:76:4E:07</pre>
 Other usefull display filters are bootp (DHCP), tftp and http, for example:
 <pre>bootp || tftp</pre>

← Older revision		Revision as of 13:27, 26 January 2016
Line 36:		Line 36:
	<pre>eth.dst == 00:0C:CC:76:4E:07 \|\| eth.src==00:0C:CC:76:4E:07</pre>		<pre>eth.dst == 00:0C:CC:76:4E:07 \|\| eth.src==00:0C:CC:76:4E:07</pre>

−	Other usefull display filters are bootp (DHCP), tftp and http!	+	Other usefull display filters are bootp (DHCP), tftp and http, for example:
		+	<pre>bootp \|\| tftp</pre>

@@ Line 10: / Line 10: @@
-Run the above tcpdump command on the FOG machine, then start the remote target host. Wait until the remote target host fails, then stop tcpdump using '''ctrl+c''', transfer the PCAP file to your PC and examine it using [https://www.wireshark.org/ Wireshark].
+Run the above tcpdump command on the FOG machine, then start the remote target host. Wait until the remote target host fails, then stop tcpdump using '''ctrl+c'''. Then transfer the PCAP file to your PC and examine it using [https://www.wireshark.org/ Wireshark].
-You may get the issue.pcap file by a number of means. The most basic way is by placing the pcap file inside of the /tftpboot directory and then using TFTP to transfer the file to a Windows machine.
+You may get the issue.pcap file by a number of means. The most basic way is by placing the pcap file inside of the /tftpboot directory (or saving it there) and then using TFTP to transfer the file to a Windows machine.
 This would save the file to your /tftpboot directory, but you still need to specify the correct interface:

@@ Line 16: / Line 16: @@
 You can find examples of these transfer commands in these articles:
-*Troubleshoot TFTP
+*[[Troubleshoot TFTP]]
-*Troubleshoot FTP
+*[[Troubleshoot FTP]]
-*Troubleshoot NFS
+*[[Troubleshoot NFS]]

← Older revision		Revision as of 16:48, 13 June 2015
Line 10:		Line 10:


−	Run the above tcpdump command on the FOG machine, then start the remote target host. Wait until the remote target host fails, then stop tcpdump using '''ctrl+c''', transfer the PCAP file to your PC and examine it using [https://www.wireshark.org/ Wireshark.	+	Run the above tcpdump command on the FOG machine, then start the remote target host. Wait until the remote target host fails, then stop tcpdump using '''ctrl+c''', transfer the PCAP file to your PC and examine it using [https://www.wireshark.org/ Wireshark].

	You may get the issue.pcap file by a number of means. You may use TFTP (place the file inside /tftpboot) or FTP (place the file inside /images) or NFS (place the file inside /images) and then use the appropriate commands to transfer the files.		You may get the issue.pcap file by a number of means. You may use TFTP (place the file inside /tftpboot) or FTP (place the file inside /images) or NFS (place the file inside /images) and then use the appropriate commands to transfer the files.

← Older revision		Revision as of 16:45, 13 June 2015
Line 10:		Line 10:


−	Run the above tcpdump command on the FOG machine, then start the remote target host. Wait until the remote target host fails, then stop tcpdump using '''ctrl+c''', transfer the PCAP file to your PC and examine it using [https://www.wireshark.org/ Wireshark.]	+	Run the above tcpdump command on the FOG machine, then start the remote target host. Wait until the remote target host fails, then stop tcpdump using '''ctrl+c''', transfer the PCAP file to your PC and examine it using [https://www.wireshark.org/ Wireshark.
		+
		+	You may get the issue.pcap file by a number of means. You may use TFTP (place the file inside /tftpboot) or FTP (place the file inside /images) or NFS (place the file inside /images) and then use the appropriate commands to transfer the files.
		+
		+	You can find examples of these transfer commands in these articles:
		+
		+	*Troubleshoot TFTP
		+	*Troubleshoot FTP
		+	*Troubleshoot NFS
		+

← Older revision		Revision as of 06:07, 17 April 2015
Line 19:		Line 19:
	<pre>eth.dst == 00:0C:CC:76:4E:07 \|\| eth.src==00:0C:CC:76:4E:07</pre>		<pre>eth.dst == 00:0C:CC:76:4E:07 \|\| eth.src==00:0C:CC:76:4E:07</pre>

−	Other usefull display filters are 'bootp' (DHCP), 'tftp~~' (TFTP-traffic)~~ and 'http'!	+	Other usefull display filters are bootp (DHCP), tftp and http!