Taking a TCPDUMP on Linux OS and Writing the packets to CAP file (Wireshark Readable)

Summary: 

In this post, we are going to quickly take a TCP Dump (Capture packets) on a linux server and write the output to a CAP file that is WireShark readable. 

Problem or Goal: 

Used to capture and analyze packets when troubleshooting network/communication problems. 

Cause: 

N/A

Solution (Examples): 

a) TCP Dump on a single physical interface to capture DNS (port 53) packets

#tcpdump -i eth0 -s 2000 -w /tmp/name_of_trace_file.cap port 53

b) TCP Dump on a bonded interface to capture HTTP (port 80) packets

#tcpdump -i bond1 -s 2000 -w /tmp/name_of_trace_file.cap port 80

Note: "-s 2000" limits the packet length to 2000bytes, default packet length is 1024bytes use "-s 0" to remove the packet length limit. 

Problem Solved?

You can then transfer the file by SFTP to your laptop and read it with Wireshark 

How to capture tcp dump on juniper srx 5800 and analyze file using wireshark

Summary: 

How to take a tcp dump on Juniper SRX 5800. This tcp dump is of file type .pcap and can be analyzed using third party tools like wireshark.

Problem or Goal:

To analyze traffic traversing the firewall using wireshark

Cause:

For troubleshooting purposes

Solution:

Reference: How to create a PCAP packet capture on high-end SRX devices

Example:

Edit the config as below:

#set security datapath-debug capture-file my-capture
#set security datapath-debug capture-file format pcap
#set security datapath-debug capture-file size 1m
#set security datapath-debug capture-file files 5
#set security datapath-debug maximum-capture-size 1500
#set security datapath-debug action-profile do-capture event np-egress packet-dump
#set security datapath-debug action-profile do-capture event np-ingress packet-dump
#set security datapath-debug packet-filter my-filter action-profile do-capture
#set security datapath-debug packet-filter my-filter destination-prefix x.x.x.x/x
#commit 

To start the debug:

>request security datapath-debug capture start

To stop the debug:

>request security datapath-debug capture stop

You can use this command to show the captured packets, but the output doesn't make sense, you will have to export the file into third party tools like wireshark:

>show security datapath-debug capture

Before you pick the file to analyze it with wireshark, run this command:

>start shell user root
Password :
root% pwd
If you are not in /var/log;


root@% cd /var/log
root@% e2einfo -Ccapture -Snormalize -I my-capture -F my-capture.pcap
sucessfully convert 124 packets

root@% ls -ltr




You can use tools like WinSCP to copy the file from the SRX device to your computer.




When troubleshooting is finished, remove all datapath-debug configuration, including the datapath-debug configuration for packet capturing (packet-dump) which needs to be started/stopped manually. If any part of the debugging configuration remains active, it will continue using the resources of the device (CPU/memory).




#delete security datapath-debug

#commit




Problem Solved?

Yes.

TCP Dump - WireShark Capture/Snoop on a Unix/Linux interface - Free Script

Here is a free tool to capture live packets on a Unix/Linux interface and analyze the captured packets using WireShark.

Simple Procedure:
1. Download the tcpdump tool here
2. Unzip the file
3. Transfer the file to the server whose interface you want to snoop
4. You might want to change the file permissions to make it executable (command: #chmod 777 file_name)
5. Identify the interface name that you want to snoop (command: #ifconfig -a)
6. Run the script: ./tcpdump -i eth88 -s 0 -w filename.cap
     where:

• -i eth88 refers to the specified listening network interface.
• -s 0 indicates that the message length is not limited. By default, 1,024 bytes is captured from each packet.
• -w filename.cap directly writes the packet into the file without analysis or printout. replace filename with the actual name of the file.