tags : Networking, Network Programming, TCP&UDP, Security, Reverse Engineering

Tools

  • wireshark
  • dhcpdump
  • tcpdump
  • tshark
    • Tshark’s live output looks a lot nicer to me and easier to understand compared to tcpdump. But if I’m just writing a pcap file it doesn’t matter.
    • Also tshark can be used to extract specific fields that you can then log or manipulate with the usual sed/awk/grep utilities to analyze in specific scenarios.
  • ngrep
  • tcpflow
    • Reassembles the complete contents of a TCP connection by paying attention to sequence numbers.
  • nethogs
  • iperf
  • nprobe, ntopng

Comments

tshark+tcpdump

  • TCP tries really hard to avoid fragmentation, by setting the DF flag and reducing the MSS when it sees a PTB error.
  • Of course that sometimes fails, so if you still have TCP fragmented segments, the next best thing is to filter by source/destination address, saving to a PCAP file, then run tshark on that file with the “-2” flag which does packet reassembly.

Learning resources

Basics

Tactical

TLS

Wireshark

TCP

DNS

UDP/QUIC