tailieunhanh - Open Source Security Tools : Practical Guide to Security Applications part 20

Open Source Security Tools : Practical Guide to Security Applications part 20. Few frontline system administrators can afford to spend all day worrying about security. But in this age of widespread virus infections, worms, and digital attacks, no one can afford to neglect network defenses. Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. | Page 169 Thursday June 24 2004 12 32 PM Considerations for Network Sniffing 169 Running Tcpdump There are a number of filter operations you can perform on the output to look for a specific type of traffic or lessen the overall amount of output. Indeed on a busy network unfiltered Tcpdump output will cause your screen to scroll faster than you can read it However for a quick demo of the power of Tcpdump invoke it from the command line by simply typing tcpdump You will see all the TCP traffic passing your machine s Ethernet card unfiltered. It might look something like the example in Listing . Listing Tcpdump Example 12 25 . ack 1418369642 win 31856 nop nop timestamp 72821542 25475802 DF 12 25 . ack 1 win 40544 nop nop timestamp 25486047 72811295 DF 12 25 11414 PTR . 44 DF 12 25 11414 NXDomain - 0 1 0 113 12 25 11415 PTR . 42 DF 12 25 11415 NXDomain 0 1 0 119 12 25 1416 PTR . 44 DF 12 25 11416 1 0 0 69 12 25 arp who-has tell 12 25 arp reply is-at 0 6 25 9f 34 ac 12 25 11417 PTR . 42 DF Page 170 Thursday June 24 2004 11 47 AM 170 Chapter 6 Network Sniffers 12 25 11417 NXDomain 0 1 0 119 12 25 Trap 35 E enterpriseSpecific specific- trap 1 0 43525500 snmp This might look a little confusing at first but if you break it down it starts to make