Snooping the Network with Tcpdump
Observing packets on a live network effectively shows you what the kernel does with messages and how the network subsystem resolves address requests. From the raw IP packet to TCP, tcpdump is a tool that displays data on the network. For security, you need root access to run tcpdump.
By default, tcpdump uses promiscuous mode so that you can see everything on the network. Promiscuous mode manipulates the hardware interface directly to accept any and all messages.
The Balance of Network Ethics
Knowing how to do many things is very powerful and holds a lot of responsibility. With root privilege, you can do a lot good and a lot of harm to the network. When you install Linux on your computers, the distribution assumes that you act with the same good intentions as those who afforded you the ability to snoop others' packets. One effective way to destroy the Free Software movement is to abuse the power and trust that other good and well-intentioned people gave you.
Normally, the hardware interface adapter picks up only those messages that it recognizes from the ethernet address. Recall from Chapter 2 that every ethernet hardware adapter has a unique 6-byte ID. The adapter uses this ID to ignore all packets except for the ones that match the ID.
Programmable Ethernet IDs
Some OEMs (original equipment manufacturers) offer their network interface cards (either PCI or PCMCIA) that support a programmable MAC address (or ethernet ID). This makes mass production possible for a few card manufacturers while serving several hundred name-brand companies. Unfortunately, you may get a card that has a bogus ID, because the name-brand company did not program it correctly. This error can make your card non-unique on the network.
If you do not want promiscuous mode, you can turn it off with one of the options. Tcpdump has many options to help you filter out unwanted messages and select displayed data and data redirection. Here are a few interesting command-line options:
|
-a |
Try to assign names to network and broadcast addresses. This requires access to a nameserver. |
|
-c <count> |
Stop after getting the specified count of messages. |
|
-n |
Don't convert the node addresses to their names (this is useful when you don't have a name server). |
|
-p |
Don't put the interface into promiscuous mode. If you have a small network or cluster, seeing all the packets may be interesting. Otherwise, with promiscuous mode enabled, the network could easily overwhelm your computer. |
|
-v |
Print a slightly more verbose dump. This includes the time-to-live (TTL) field. |
|
-vv |
Print a lot more information in the dump. |
|
-w <file> |
Write the raw packet to a file. |
Tcpdump can run without any options, and it displays most information you need. You can also see interesting interactions, such as the ARP (address resolution protocol) asking for and acquiring the ethernet ID from the IP address. Here's an example capturing 100 verbose packets without a time stamp:
tcpdump -v -t -c 100
The -t option suppresses the time stamp. Because the messages often scroll off the screen very quickly, you may want to redirect the results to a file.
Tcpdump does have a few anomalies; for example, it does not pick up messages to itself. It does not see the packets from ping 127.0.0.1, because the network subsystem does not send those messages down to the lower protocol layers where tcpdump hooks in.