tcpdump

• capture HTTPS ClientHello packets and use tshark to extract Hostnames:

tcpdump "tcp port 443 and (tcp[((tcp[12] & 0xf0) >>2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >>2)+5] = 0x01)" -w output.pcap

tshark -r output.pcap  -Tfields -e tls.handshake.extensions_server_name -Y 'tls.handshake.extension.type == 0' | sort | uniq

• capture HTTP (80) traffic and print headers

tcpdump -A -s 10240 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r 's/^........(GET |HTTP\/|POST |HEAD )/\n\1/g'

• filter packets with a TTL less than 32 (TTL is the 8th byte in the header):

tcpdump -v ip and 'ip[8]<32'

• summarise IPs from a pcap:

tcpdump -ntr file.pcap | awk '{print $2}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2}'

• summarise IPs from a pcap (with packet count per IP):

capture traffic encapsulated IPIP traffic based on IP address

• first convert the IP to hex here
• then run:

tcpdump -l ip[32:4] = 0x0a6fc802  or ip[36:4] = 0x0a6fc802”

capture traffic and send it to a remote location:

• listen on port 12345 on the remote:

nc -l -p 12345 > /home/user/somefile.pcap

• tcpdump and pipe it to the remote with netcat (or nc):

# nc

tcpdump -n -U -s 0 -i <interface> not port 12345 -w - | nc <remote IP> 12345

#  ncat

tcpdump -n -U -s 0 -i <interface> not port 12345 -w - | ncat <remote IP> 12345