# tcpdump

* capture HTTPS ClientHello packets and use tshark to extract Hostnames:

```
tcpdump "tcp port 443 and (tcp[((tcp[12] & 0xf0) >>2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >>2)+5] = 0x01)" -w output.pcap

tshark -r output.pcap  -Tfields -e tls.handshake.extensions_server_name -Y 'tls.handshake.extension.type == 0' | sort | uniq
```

* capture HTTP (80) traffic and print headers

```
tcpdump -A -s 10240 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r 's/^........(GET |HTTP\/|POST |HEAD )/\n\1/g'
```

* filter packets with a TTL less than 32 (TTL is the 8th byte in the header):

```
tcpdump -v ip and 'ip[8]<32'
```

* summarise IPs from a pcap:

```
tcpdump -ntr file.pcap | awk '{print $2}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2}'
```

* summarise IPs from a pcap (with packet count per IP):

```tcpdump
```

## capture traffic encapsulated IPIP traffic based on IP address

* first convert the IP to hex [here](https://www.browserling.com/tools/ip-to-hex)
* then run:

```
tcpdump -l ip[32:4] = 0x0a6fc802  or ip[36:4] = 0x0a6fc802”
```

## capture traffic and send it to a remote location:

* listen on port 12345 on the remote:

```
nc -l -p 12345 > /home/user/somefile.pcap
```

* tcpdump and pipe it to the remote with netcat (or nc):

```
# nc

tcpdump -n -U -s 0 -i <interface> not port 12345 -w - | nc <remote IP> 12345

#  ncat

tcpdump -n -U -s 0 -i <interface> not port 12345 -w - | ncat <remote IP> 12345
```