Every once in a while we collect large PCAP files for analysis. However, there are times when we are looking for a summary list of either source or destination addresses in those PCAP that were seen over a period of time in those files. The two examples shown here represent two suspicious ports that I noticed targeted this week and wanted to know the source IPs of this traffic.

First, if needed, we need to remove the IP or IPs we don't want to include in our summary. If we are going to reuse a PCAP filter several times, it is better to create a libpcap filter in a file and use tcpdump -F filter to use it. (tcpdump -nr file.pcap -F parsing_filter).

Breaking down the filter

In order to be able to manipulate the data to our advantage, we need to determine what we are looking for. With our two examples, we are going to find which source IP addresses sent a TCP SYN packet to our gateway IP 192.168.21.32 to port 465 and 2522 with the number of occurrence that happened in each of the PCAP files.

My complete traffic parsing looks like this:

guy@seeker$ tcpdump -ntr 2010032501 'dst host 192.168.21.32 and tcp[13] = 0x02 and dst port 2522' | awk '{print $2}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2 "\t" $1 }'

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)
XX.169.170.84 10

Breaking Down each Sections

- Part 1 is the tcpdump switches and we are using -n (don't resolve), -t (don't print date/time) and -r 2010032501 (file name to replay).

- Part 2 is the libpcap filter ('dst host 192.168.21.32 and tcp[13] = 0x02 and dst port 2522') which filter all inbound TCP SYN packets (tcp[13] = 0x02) to our gateway (dst host 192.168.21.32) to TCP port 2522.

IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,nop,wscale 3,nop,nop,timestamp 895725079 0,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,nop,wscale 3,nop,nop,timestamp 895725088 0,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,nop,wscale 3,nop,nop,timestamp 895725098 0,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>
IP xx.169.170.84.50316 > 192.168.21.32.2522: S 2853915482:2853915482(0) win 65535 <mss 1412,sackOK,eol>

- Part 3 we add a pipe with awk (| awk '{print $2}') to print only the source IP from our tcpdump result. Field $2 (source IP) could be changed to $4 to use the destination address.

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316
xx.169.170.84.50316

- Part 4 we add a pipe with tr (| tr . ' ') to change the period to a space so we can remove the source port (50316) in the next step.

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316
xx 169 170 84 50316

- Part 5 we add a pipe with awk (| awk '{print $1"."$2"."$3"."$4}') to reconstruct the source IP address(es).

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84

- Part 5 we add a pipe with sort ( | sort) to sort our traffic by IPs. In this case we only have one source.

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84
xx.169.170.84

- Part 6 we add a pipe with uniq -c (| uniq -c) to count the number of times a source IP was see in the PCAP file.

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)

10 xx.169.170.84

- The last part is just for formatting purposes, we reverse the order of the last output and insert a tab (| awk ' {print $2 "\t" $1 }') to show the IPs in the first collumn and the number of time seen in the second.

reading from file 2010032501, link-type LINUX_SLL (Linux cooked)

xx.169.170.84 10

Another example with its results to destination port TCP 465.

guy@seeker$ tcpdump -ntr 2010032508 'dst host 192.168.21.32 and tcp[13] = 0x02 and dst port 465' | awk '{print $2}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2 "\t" $1 }'

reading from file 2010032508, link-type LINUX_SLL (Linux cooked)

XX.237.148.241 3
XXX.197.208.107 3
XXX.199.183.68 3
XXX.22.87.36 3

-----------

Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org