LinuxCBT BPF 教程笔记：深入网络过滤与分析

###LinuxCBT Berkeley Packet Filters Edition###

Tasks:
 1. Install 'tcpdump' - Debian or TCPDump-compliant utilitiy. i.e. Snort, WireShark, etc.
  a. 'aptitude install tcpdump' - requires: 'libpcap' to gain low-level access to network packets
Note: Packets enter the kernel from the wire (network stack)

Features:
 1. Developed @ UC Berkeley and became popular in the 1990s with BSD Unix, spawned to: Unix | Linux
 2. Integrated with TCPDump (WinDump) and compliant tools: Snort, WireShark (Ethereal), etc.
 3. Filtration of OSI layers: 2-7
 4. Results in less generated/lost data
 5. Primitives: 
   a. name (hostname (FQDN or short)) or number (typcially IP address or IPX, etc.)
combined with one or more qualifiers
 6. Packet Filtering based on criteria: primitives
Note: Primitives form criteria which serve as the basis of packet filters
 7. 3-Qualifiers: Type, Direction, Protocol
 8. Ability to search for packets of specific lenghts: 'greater (>=)', 'less(<=)' primitives
 9. VLAN (802.1Q) parsing via: 'vlan' primitive
10. Negation of queries(filters): '!' or 'not'
11. Concatenation: '&&' or 'and' - facilitates ANDing of rules
12. Alternation: '||' or 'or' - i.e. A search for TCP:53 'or' UDP:53 to trap DNS traffic
13. TCPDump and compliant tools, auto-prefix packets with kernel time: 'hh:mm:ss:frac'
frac=microsecond
14. TCPDump defaults to a display of layers 2-4


### Type - Qualifier###
Features:

 1. 4-Types
  a. 'host' - default (presumed when no 'type' has been specified)
  b. 'net'
  c. 'port'
  d. 'portrange'

Tasks:
 1. Explore 'host' type - Captures ALL traffic to-or-from 'host'
  a. 'tcpdump host 192.168.75.1' - captures traffic to-or-from the router
Note: This occurs because both: 'src' and 'dst' fields of packet are parsed

Note: This is ARP traffic with: 192.168.75.1 as both src and destination
10:00:32.634006 arp who-has 192.168.75.34 tell 192.168.75.1 (src)
10:00:37.633076 arp who-has 192.168.75.1 tell linuxcbtbuild1.local (src)
10:00:37.633408 arp reply 192.168.75.1 is-at 00:1a:2f:e3:f2:40 (oui Unknown)

 2. Explore 'net' type - Captures ALL traffic to-or-from 'net'
  a. 'tcpdump -v net 192.168.75.0/24' - captures traffic from /24 'net'
  a1. 'tcpdump -v net 192.168.75' - same as above
  b. 'tcpdump -v net 192.168.75.0/30' - narrows subnet considerably
NOte: Your host MUST fall within the confines of the '/30' to see traffic from other hosts within that '/30'
Note: Except if 'port-mirroring' is in use, which can copy ALL interesting traffic from various VLANs to your switch port

  c. 'tcpdump -v net 192.168.75.0 mask 255.255.255.0' - /24

 3. Explore 'port' type - Captures ALL traffic to-or-from 'port'
  a. 'tcpdump -v port 80'

 4. Explore 'portrange' type - Captures ALL traffic to-or-from 'portrange'
  a. 'tcpdump -v portrange 21-80'