3 ms·

Mentioning tcpflow here b/c it's one of the most useful networking related tools I know of that very few people even know about. What does it do? It can reass

Mentioning tcpflow here b/c it's one of the most useful networking related tools I know of that very few people even know about. What does it do? It can reassemble TCP packets back into the FULL body of the original message sent. e.g. if you make a HTTP GET request, it will show you the full text in a file stamped with the time, source and dest ips and port. Things I've found it REALLY useful for: - migrating a data center - for some reason, connection works fine on the old DC but seems to time out in weird ways in the new DC - No one can figure it out - I suggest using tcpflow - Turn out there was a setting in the new DC network hardware that was truncating larger packets and the authorization message was just over the threshold People always say "yeah, but Wireshark" which is true, that's a good tool too. That being said, there is just something about seeing the "raw" text of a message sent by a machine over the wire and being able to see it in text from the command line. https://github.com/simsong/tcpflow https://github.com/simsong/tcpflow

c0nsumer 4y ago
Thanks, this'll be interesting. One of my first go-tos in Wireshark is finding the interesting hosts I'm looking for, then using the built-in Follow TCP Stream to go deeper. I wonder if tcpflow would make this easier, or maybe just different, by effectively pre-slicing the capture into sessions.
hayst4ck 4y ago
`tshark` (from wireshark) sounds like a similar tool with pretty good protocol support (IIRC, it has been a long time since I've used it). By example: $ tshark -i lo -l -q -Y http -T fields -e frame.time -e _ws.col.Info -e http.file_data Running as user "root" and group "root". This could be dangerous. Capturing on 'Loopback: lo' Dec 19, 2022 04:07:12.419196072 UTC GET / HTTP/1.0 Dec 19, 2022 04:07:12.420560079 UTC HTTP/1.1 200 OK (text/plain) Hello World!\n Dec 19, 2022 04:07:12.504444583 UTC GET /favicon.ico HTTP/1.0 Dec 19, 2022 04:07:12.505691738 UTC HTTP/1.1 404 Not Found Because -l (flush every line to stdout) and -q (suppress packet counts) you can pipe the command to grep. $ tshark -i lo -l -q -Y http -T fields -e frame.time -e _ws.col.Info -e http.file_data 2>&1 | grep 404 Dec 19, 2022 04:09:46.361304160 UTC HTTP/1.1 404 Not Found More examples: https://hackertarget.com/tshark-tutorial-and-filter-examples/ https://hackertarget.com/tshark-tutorial-and-filter-examples...
mekster 4y ago
I've been using tcpick for a similar purpose to see if a HTTP request is reaching and not blocked elsewhere and to see the raw communication to check on headers.
whatbackup 4y ago
Not too familiar with tcpflow, thanks for your short write-up. Going to check it out.
jamal-kumar 4y ago
Flow analysis is such an essential skill that I'm surprised more people aren't on that tip. It's just so useful

c0nsumer 4y ago

Thanks, this'll be interesting. One of my first go-tos in Wireshark is finding the interesting hosts I'm looking for, then using the built-in Follow TCP Stream to go deeper. I wonder if tcpflow would make this easier, or maybe just different, by effectively pre-slicing the capture into sessions.

hayst4ck 4y ago

`tshark` (from wireshark) sounds like a similar tool with pretty good protocol support (IIRC, it has been a long time since I've used it). By example: $ tshark -i lo -l -q -Y http -T fields -e frame.time -e _ws.col.Info -e http.file_data Running as user "root" and group "root". This could be dangerous. Capturing on 'Loopback: lo' Dec 19, 2022 04:07:12.419196072 UTC GET / HTTP/1.0 Dec 19, 2022 04:07:12.420560079 UTC HTTP/1.1 200 OK (text/plain) Hello World!\n Dec 19, 2022 04:07:12.504444583 UTC GET /favicon.ico HTTP/1.0 Dec 19, 2022 04:07:12.505691738 UTC HTTP/1.1 404 Not Found Because -l (flush every line to stdout) and -q (suppress packet counts) you can pipe the command to grep. $ tshark -i lo -l -q -Y http -T fields -e frame.time -e _ws.col.Info -e http.file_data 2>&1 | grep 404 Dec 19, 2022 04:09:46.361304160 UTC HTTP/1.1 404 Not Found More examples: https://hackertarget.com/tshark-tutorial-and-filter-examples/ https://hackertarget.com/tshark-tutorial-and-filter-examples...

mekster 4y ago

I've been using tcpick for a similar purpose to see if a HTTP request is reaching and not blocked elsewhere and to see the raw communication to check on headers.

whatbackup 4y ago

Not too familiar with tcpflow, thanks for your short write-up. Going to check it out.

jamal-kumar 4y ago

Flow analysis is such an essential skill that I'm surprised more people aren't on that tip. It's just so useful