Packets coming inbound and outbound from a network interface contain a treasure trove of information that can be useful for troubleshooting purposes. Using the command tcpdump allows you to view the contents of the packets in real time, or it can be saved to a file for inspection later on.
This article will show some of the common tasks I use tcpdump for.
How to view Cisco Discovery Protocol
This is not always available. Cisco Discovery Protocol is a management protocol that Cisco uses to communicate a great deal of information about a network connection. It can tell you what switch and port the server is connected to, if there are connectivity issues due to the wrong duplex being set and can also help identify if the server is on the wrong VLAN. It can also show the management interface and operating system of the switch, amongst other things.
An example of how to run it and grepping for the fields I generally need is below::
[root@web01 ~]# tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000' | egrep "Device-ID|Address|Port-ID"
Device-ID (0x01), length: 24 bytes: 'switch27.nyc4.example.com'
Address (0x02), length: 13 bytes: IPv4 (1) 10.1.0.11
Port-ID (0x03), length: 18 bytes: 'GigabitEthernet0/9'
Management Addresses (0x16), length: 13 bytes: IPv4 (1) 10.1.0.11
Confirm traffic is flowing
Lets assume you have vlan tagging in place on the server, but for some reason that vlan cannot ping the gateway. You can check to see if your network interface is at least configured correcting by checking for ARP traffic by:
1. On another terminal, ping the target gateway.
2. Then in the other terminal, run:
[root@web01 ~]# tcpdump -i eth0 -nn -e vlan tcpdump: WARNING: eth0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 18:08:58.039740 63:b3:d2:5c:dd:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 14, p 0, ethertype ARP, Request who-has 192.168.22.1 tell 192.168.22.100, length 28 18:08:59.039934 63:b3:d2:5c:dd:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 14, p 0, ethertype ARP, Request who-has 192.168.22.1 tell 192.168.22.100, length 28 18:09:00.041922 63:b3:d2:5c:dd:dc > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 14, p 0, ethertype ARP, Request who-has 192.168.22.1 tell 192.168.22.100, length 28
This tells me that the server is sending out ARP requests successfully over VLAN 14, but no responses are coming back.
Check the payload of any traffic coming in over port 80
This example will provide you output similar to what you would see on an IDS. It is highly useful to be able to determine exactly what was accessed and what the web server responded with.
[root@web01 ~]# tcpdump -nnvvXS 'tcp port 80' ... GET /bogus HTTP/1.1 Host: www.example22.com User-Agent: curl/7.54.0 Accept: */* ... 0x0030: 89c5 4347 4745 5420 2f62 6f67 7573 2048 ..CGGET./bogus.H 0x0040: 5454 502f 312e 310d 0a48 6f73 743a 2077 TTP/1.1..Host:.w 0x0050: 7777 2e65 7861 6d70 6c65 3232 2e63 6f6d ww.example22.com 0x0060: 0d0a 5573 6572 2d41 6765 6e74 3a20 6375 ..User-Agent:.cu 0x0070: 726c 2f37 2e35 342e 300d 0a41 6363 6570 rl/7.54.0..Accep 0x0080: 743a 202a 2f2a 0d0a 0d0a t:.*/*.... ... HTTP/1.1 404 Not Found Date: Wed, 16 May 2018 02:51:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips Content-Length: 203 Content-Type: text/html; charset=iso-8859-1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /bogus was not found on this server.</p> </body></html> 0x0000: 4500 01b3 fe88 4000 4006 2fda a5e3 44b3 E.....@.@./...D. 0x0010: 182d 081f 0050 b35f c379 bddd 7fc3 db3c .-...P._.y.....< 0x0020: 8018 00e3 0c88 0000 0101 080a 89c5 435a ..............CZ 0x0030: 2681 c10b 4854 5450 2f31 2e31 2034 3034 &...HTTP/1.1.404 0x0040: 204e 6f74 2046 6f75 6e64 0d0a 4461 7465 .Not.Found..Date 0x0050: 3a20 5765 642c 2031 3620 4d61 7920 3230 :.Wed,.16.May.20 0x0060: 3138 2030 323a 3531 3a31 3620 474d 540d 18.02:51:16.GMT. 0x0070: 0a53 6572 7665 723a 2041 7061 6368 652f .Server:.Apache/ 0x0080: 322e 342e 3620 2843 656e 744f 5329 204f 2.4.6.(CentOS).O 0x0090: 7065 6e53 534c 2f31 2e30 2e32 6b2d 6669 penSSL/1.0.2k-fi