Learn / Networking Fundamentals / Reading Traffic

Filtering the Noise

guidedmedium 30 min · 100 points

First Bit is still up for grabs: be the first to finish this room.

In Watching Packets you read traffic on a quiet machine. Real machines aren't quiet. A busy server can push thousands of packets a second past you, and a capture you can't read is worth no more than no capture at all.

The answer is to say what you want before you start. In this room you'll learn tcpdump's filters and how to read the flags on a TCP connection, then use both to pull one conversation out of Milo's very noisy box.

CYB//RANGE Live lab

Task 1 Saying what you want

A filter goes at the end of the command, after the options. Only packets that match it are captured:

$ tcpdump -i lo -n port 9100
$ tcpdump -i lo -n host 10.66.0.20
$ tcpdump -i lo -n udp

The pieces you'll reach for constantly:

Filter	Matches
`host 10.66.0.20`	traffic to or from that address
`src host 10.66.0.20`	only traffic from it
`port 53`	traffic to or from that port
`dst port 53`	only traffic going to it
`tcp`, `udp`, `icmp`	one protocol

Join them with and, or and not:

$ tcpdump -i lo -n 'tcp and port 9100'
$ tcpdump -i lo -n 'udp and not port 9001'

Wrap a filter in single quotes once it has more than one word. It costs nothing when it isn't needed, and it saves you the moment a filter contains brackets, which the shell would otherwise try to interpret.

Filtering isn't just about tidy output. The filter is compiled and handed to the kernel, so packets you didn't ask for are discarded before tcpdump ever sees them. On a busy machine that's the difference between a capture that keeps up and one that quietly drops what you were after.

Which filter keyword matches traffic to or from one address? (One word.)

****

Which filter keyword limits a capture to one port? (One word.)

****

Which keyword joins two filter terms so that both must be true? (One word.)

***

Task 2 What the flags mean

A TCP connection is set up before any data moves, and tcpdump shows each step in the Flags [...] field:

$ tcpdump -i lo -n -c 4 port 9100
14:02:11.483927 IP 127.0.0.1.51234 > 127.0.0.1.9100: Flags [S], seq 1902847362, length 0
14:02:11.483951 IP 127.0.0.1.9100 > 127.0.0.1.51234: Flags [S.], seq 88136402, ack 1902847363, length 0
14:02:11.483969 IP 127.0.0.1.51234 > 127.0.0.1.9100: Flags [.], ack 1, length 0
14:02:11.484102 IP 127.0.0.1.51234 > 127.0.0.1.9100: Flags [P.], length 96

Shown	Flag	Means
`S`	SYN	please open a connection
`S.`	SYN-ACK	the other end agrees
`.`	ACK	acknowledging what arrived
`P.`	PSH	carrying data
`F.`	FIN	finished sending
`R`	RST	reset, go away

The first three lines are the three-way handshake, and seeing them tells you the connection was genuinely established, not merely attempted. The dot in S. and P. is the ACK flag riding along with another one, which is why almost everything after the first packet has a dot in it.

An R on its own is worth noticing. A machine sends one when a packet arrives for a port nothing is listening on, and the client turns it into Connection refused immediately. Getting no reply at all is a different thing entirely: the client waits and eventually times out. That difference is often the only clue about what sits between you and a machine, and it's the whole of the next room.

Which TCP flag does tcpdump show as [S]? (Three letters.)

***

Which letter does tcpdump print for a connection reset? (One letter.)

*

A TCP port with nothing listening answers with a reset. What does the client report? (Two words.)

********** *******

Task 3 Try it on a real machine

Milo's box is the busy one. Something floods it with metrics, and somewhere underneath, a sensor and an old backup agent are both still uploading.

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as milo.
Look at it raw first: tcpdump -i lo -n -c 40. This is what an unfiltered capture on a busy machine gets you.
Drop the chatter and see what's underneath: tcpdump -i lo -n tcp.
Take one conversation at a time with port 9100 and with port 9200, adding -A to read what each one uploads. Both send a key that looks the same. Only one of the two services is still in use, and the other's key went dead with it.
Something is also being refused every few seconds. Find it with tcpdump -i lo -n 'tcp[tcpflags] & tcp-rst != 0', or just watch for an R.

Most of the traffic here is metrics chatter. Which UDP port does it go to?

****

Every few seconds one connection is refused. Which port was it trying to reach?

****

The decommissioned agent still uploads. Which Host: name does it use? (Full name.)

******.****.***

Both uploaders send a key that looks the same, but only the sensor's is still live. What key do the sensor's uploads carry?

RZ{************************}