TCP Protocol Analysis Access UMKC Home Page Slides

TCP Protocol Analysis Access UMKC Home Page Slides provided by Bob Cotter, updated by Shuai Zhao

UMKC Home Page 2

Ethereal Filter 3

TCP (First syn) 4

TCP (Syn+Ack) cs 423 -cotter 5

TCP (Second ack) 6

TCP (First packet – HTTP request) 7

TCP (ack for first data packet) 8

TCP – IP info cs 423 -cotter 9

Ethernet Frame cs 423 -cotter 10

Reassembled Packet 11

Follow TCP Stream cs 423 -cotter 12

cs 423 -cotter 13

tcpdump on Linux 1. On Windows: Win. Dump 2. Using Lib. Pacp library as Wireshark 3. Run tcpdump as root 14

tcpdump basic usage 1. sudo tcpdump –nnvv. S dst 134. 193. 116. 82 2. sudo tcpdump –vv. S dst 134. 193. 116. 82 3. sudo tcpdump –i any/eth 0/en 0 15

Look for traffic based on host name/protocol/ip block/port 1. 2. 3. 4. 5. sudo tcpdump host www. umkc. edu sudo tcpdump icmp/ip sudo tcpdump 192. 168. 0. 0/24 sudo tcpdump port 80 combination using “and” sudo tcpdump srcip port x. x and dstip y. y 16

tcpdump write/read 1. tcpdump –w filename 2. tcpdump –r captured file 17

Using wireshark read saved tcpdump file 18

Summary • TCP is a complex protocol, but tools are available to analyze it. • Client / Server Programs are widely used. • Analysis of the protocols (at all layers) can lead to a greater understanding of how the applications work. 19