![Provide the protocol as an argument to display only traffic for a specific protocol, for example
tcp, udp, icmp, arp:
# tcpdump protocol
For example to display traffic only for the tcp traffic :
# tcpdump tcp
4. Filtering based on source or destination port
To filter based on a source or destination port:
# tcpdump src port ftp
# tcpdump dst port http
2.Netstat
Netstat is a common command line TCP/IP networking available in most versions of Windows,
Linux, UNIX and other operating systems. Netstat provides information and statistics about
protocols in use and current TCP/IP network connections. The Windows help screen
(analogous to a Linux or UNIX for netstat reads as follows:
Displays protocol statistics and current TCP/IP network connections.
NETSTAT -a -b -e -n -o -p proto -r -s -v interval
-a Displays all connections and listening ports.
-b
Displays the executable involved in creating each connection or listening port. In
some cases well-known executables host multiple independent components, and in
these cases the sequence of components involved in creating the connection or
listening port is displayed. In this case the executable name is in [] at the bottom, on
top is the component it called, and so forth until TCP/IP was reached. Note that this
option can be time-consuming and will fail unless you have sufficient permissions.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p
proto
Shows connections for the protocol specified by proto; proto may be any of: TCP,
UDP, TCPv6, or UDPv6. If used with the -s option to display per-protocol statistics,
proto may be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s
Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP,
ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option may be used to specify a subset
of the default.
-v
When used in conjunction with -b, will display sequence of components involved in
creating the connection or listening port for all executables.](https://image.slidesharecdn.com/nwlab-ex1-220803173208-1a226286/85/nwlab-ex1-pdf-2-320.jpg)
![interval
Redisplays selected statistics, pausing interval seconds between each display. Press
CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current
configuration information once.
Syntax
netstat [-a] [-e] [-n] [-o] [-p Protocol] [-r] [-s] [Interval]
Parameters
Used without
parameters
displays active TCP connections.
-a
Displays all active TCP connections and the TCP and UDP ports on which the
computer is listening.
-e Displays Ethernet statistics, such as the number of bytes and packets sent and](https://image.slidesharecdn.com/nwlab-ex1-220803173208-1a226286/85/nwlab-ex1-pdf-3-320.jpg)
![received. This parameter can be combined with -s.
-n
Displays active TCP connections, however, addresses and port numbers are
expressed numerically and no attempt is made to determine names.
-o
Displays active TCP connections and includes the process ID (PID) for each
connection. You can find the application based on the PID on the Processes
tab in Windows Task Manager. This parameter can be combined with -a, -n,
and -p.
-p
Shows connections for the protocol specified by Protocol. In this case, the
Protocol can be tcp, udp, tcpv6, or udpv6. If this parameter is used with -s to
display statistics by protocol, Protocol can be tcp, udp, icmp, ip, tcpv6, udpv6,
icmpv6, or ipv6.
-s
Displays statistics by protocol. By default, statistics are shown for the TCP,
UDP, ICMP, and IP protocols. If the IPv6 protocol for Windows XP is installed,
statistics are shown for the TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6
protocols. The -p parameter can be used to specify a set of protocols.
-r
Displays the contents of the IP routing table. This is equivalent to the route
print command.
Interval
Redisplays the selected information every Interval seconds. Press CTRL+C to
stop the redisplay. If this parameter is omitted, netstat prints the selected
information only once.
/? - Displays help at the command prompt.
3. Ifconfig
In Windows, ipconfig is a console application designed to run from the Windows
command prompt. This utility allows you to get the IP address information of a Windows
computer. It also allows some control over active TCP/IP connections. Ipconfig replaced the
older winipcfg utility.
Using ipconfig
From the command prompt, type ipconfig to run the utility with default options. The output
of the default command contains the IP address, network mask, and gateway for all physical
and virtual network adapter
Syntax
ipconfig [/all] [/renew [Adapter]] [/release [Adapter]] [/flushdns] [/displaydns] [/registerdns]
[/showclassid Adapter] [/setclassid Adapter [ClassID]]
Parameters
Used without
parameters
displays the IP address, subnet mask, and default gateway for all adapters.
/all Displays the full TCP/IP configuration for all adapters. Without this](https://image.slidesharecdn.com/nwlab-ex1-220803173208-1a226286/85/nwlab-ex1-pdf-4-320.jpg)
![parameter, ipconfig displays only the IP address, subnet mask, and default
gateway values for each adapter. Adapters can represent physical interfaces,
such as installed network adapters, or logical interfaces, such as dial-up
connections.
/renew
[Adapter]
Renews DHCP configuration for all adapters (if an adapter is not specified) or
for a specific adapter if the Adapter parameter is included. This parameter is
available only on computers with adapters that are configured to obtain an IP
address automatically. To specify an adapter name, type the adapter name
that appears when you use ipconfig without parameters.
/release
[Adapter]
Sends a DHCPRELEASE message to the DHCP server to release the current
DHCP configuration and discard the IP address configuration for either all
adapters (if an adapter is not specified) or for a specific adapter if the Adapter
parameter is included. This parameter disables TCP/IP for adapters
configured to obtain an IP address automatically. To specify an adapter name,
type the adapter name that appears when you use ipconfig without
parameters.
/flushdns
Flushes and resets the contents of the DNS client resolver cache. During DNS
troubleshooting, you can use this procedure to discard negative cache entries
from the cache, as well as any other entries that have been added
dynamically.
/displaydns
Displays the contents of the DNS client resolver cache, which includes both
entries preloaded from the local Hosts file and any recently obtained
resource records for name queries resolved by the computer. The DNS Client
service uses this information to resolve frequently queried names quickly,
before querying its configured DNS servers.
/registerdns
Initiates manual dynamic registration for the DNS names and IP addresses
that are configured at a computer. You can use this parameter to
troubleshoot a failed DNS name registration or resolve a dynamic update
problem between a client and the DNS server without rebooting the client
computer. The DNS settings in the advanced properties of the TCP/IP
protocol determine which names are registered in DNS.
/showclassid
Adapter Displays the DHCP class ID for a specified adapter. To see the DHCP
class ID for all adapters, use the asterisk (*) wildcard character in place of
Adapter. This parameter is available only on computers with adapters that
are configured to obtain an IP address automatically.
/setclassid
Adapter [ClassID] Configures the DHCP class ID for a specified adapter. To set
the DHCP class ID for all adapters, use the asterisk (*) wildcard character in
place of Adapter. This parameter is available only on computers with
adapters that are configured to obtain an IP address automatically. If a DHCP
class ID is not specified, the current class ID is removed.
Examples:
Ipconfig To display the basic TCP/IP configuration for all adapters
ipconfig /all To display the full TCP/IP configuration for all adapters](https://image.slidesharecdn.com/nwlab-ex1-220803173208-1a226286/85/nwlab-ex1-pdf-5-320.jpg)
![Traceroute uses Internet Control Message Protocol (ICMP) echo packets with variable time to
live (TTL) values. The response time of each hop is calculated. To guarantee accuracy, each
hop is queried multiple times (usually three times) to better measure the response of that
particular hop.
tracert www.google.com
With the tracert command shown above, we're asking tracert to show us the path from the
local computer all the way to the network device with the hostname www.google.com.
Tracing route to www.l.google.com [209.85.225.104]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 10.1.0.1
2 35 ms 19 ms 29 ms 98.245.140.1
3 11 ms 27 ms 9 ms te-0-3.dnv.comcast.net [68.85.105.201]
...
13 81 ms 76 ms 75 ms 209.85.241.37
14 84 ms 91 ms 87 ms 209.85.248.102
15 76 ms 112 ms 76 ms iy-f104.1e100.net [209.85.225.104]
Trace complete.
tracert -j 10.12.0.1 10.29.3.1 10.1.44.1 www.google.com](https://image.slidesharecdn.com/nwlab-ex1-220803173208-1a226286/85/nwlab-ex1-pdf-7-320.jpg)
nwlab-ex1.pdf
- 1. EX.NO:1 Learn to use commands like tcpdump, netstat, ifconfig, nslookup and traceroute. Capture ping and traceroute PDUs using a network protocol analyzer and examine AIM: To Learn to use commands like tcpdump, netstat, ifconfig, nslookup and traceroute 1. Tcpdump The tcpdump utility allows you to capture packets that flow within your network to assist in network troubleshooting. The following are several examples of using tcpdump with different options. Traffic is captured based on a specified filter. Options Description -D Print a list of network interfaces. -i Specify an interface on which to capture. -c Specify the number of packets to receive. -v, -vv, -vvv Increase the level of detail (verbosity). -w Write captured data to a file. -r Read captured data from a file. Many other options and arguments can be used with tcpdump. The following are some specific examples of the power of the tcpdump utility. 1. Display traffic between 2 hosts To display all traffic between two hosts (represented by variables host1 and host2): # tcpdump host host1 and host2 2. Display traffic from a source or destination host only To display traffic from only a source (src) or destination (dst) host: # tcpdump src host # tcpdump dst host 3. Display traffic for a specific protocol
- 2. Provide the protocol as an argument to display only traffic for a specific protocol, for example tcp, udp, icmp, arp: # tcpdump protocol For example to display traffic only for the tcp traffic : # tcpdump tcp 4. Filtering based on source or destination port To filter based on a source or destination port: # tcpdump src port ftp # tcpdump dst port http 2.Netstat Netstat is a common command line TCP/IP networking available in most versions of Windows, Linux, UNIX and other operating systems. Netstat provides information and statistics about protocols in use and current TCP/IP network connections. The Windows help screen (analogous to a Linux or UNIX for netstat reads as follows: Displays protocol statistics and current TCP/IP network connections. NETSTAT -a -b -e -n -o -p proto -r -s -v interval -a Displays all connections and listening ports. -b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions. -e Displays Ethernet statistics. This may be combined with the -s option. -n Displays addresses and port numbers in numerical form. -o Displays the owning process ID associated with each connection. -p proto Shows connections for the protocol specified by proto; proto may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s option to display per-protocol statistics, proto may be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6. -r Displays the routing table. -s Displays per-protocol statistics. By default, statistics are shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6; the -p option may be used to specify a subset of the default. -v When used in conjunction with -b, will display sequence of components involved in creating the connection or listening port for all executables.
- 3. interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once. Syntax netstat [-a] [-e] [-n] [-o] [-p Protocol] [-r] [-s] [Interval] Parameters Used without parameters displays active TCP connections. -a Displays all active TCP connections and the TCP and UDP ports on which the computer is listening. -e Displays Ethernet statistics, such as the number of bytes and packets sent and
- 4. received. This parameter can be combined with -s. -n Displays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names. -o Displays active TCP connections and includes the process ID (PID) for each connection. You can find the application based on the PID on the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and -p. -p Shows connections for the protocol specified by Protocol. In this case, the Protocol can be tcp, udp, tcpv6, or udpv6. If this parameter is used with -s to display statistics by protocol, Protocol can be tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6. -s Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. If the IPv6 protocol for Windows XP is installed, statistics are shown for the TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6 protocols. The -p parameter can be used to specify a set of protocols. -r Displays the contents of the IP routing table. This is equivalent to the route print command. Interval Redisplays the selected information every Interval seconds. Press CTRL+C to stop the redisplay. If this parameter is omitted, netstat prints the selected information only once. /? - Displays help at the command prompt. 3. Ifconfig In Windows, ipconfig is a console application designed to run from the Windows command prompt. This utility allows you to get the IP address information of a Windows computer. It also allows some control over active TCP/IP connections. Ipconfig replaced the older winipcfg utility. Using ipconfig From the command prompt, type ipconfig to run the utility with default options. The output of the default command contains the IP address, network mask, and gateway for all physical and virtual network adapter Syntax ipconfig [/all] [/renew [Adapter]] [/release [Adapter]] [/flushdns] [/displaydns] [/registerdns] [/showclassid Adapter] [/setclassid Adapter [ClassID]] Parameters Used without parameters displays the IP address, subnet mask, and default gateway for all adapters. /all Displays the full TCP/IP configuration for all adapters. Without this
- 5. parameter, ipconfig displays only the IP address, subnet mask, and default gateway values for each adapter. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. /renew [Adapter] Renews DHCP configuration for all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters. /release [Adapter] Sends a DHCPRELEASE message to the DHCP server to release the current DHCP configuration and discard the IP address configuration for either all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter disables TCP/IP for adapters configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters. /flushdns Flushes and resets the contents of the DNS client resolver cache. During DNS troubleshooting, you can use this procedure to discard negative cache entries from the cache, as well as any other entries that have been added dynamically. /displaydns Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. The DNS Client service uses this information to resolve frequently queried names quickly, before querying its configured DNS servers. /registerdns Initiates manual dynamic registration for the DNS names and IP addresses that are configured at a computer. You can use this parameter to troubleshoot a failed DNS name registration or resolve a dynamic update problem between a client and the DNS server without rebooting the client computer. The DNS settings in the advanced properties of the TCP/IP protocol determine which names are registered in DNS. /showclassid Adapter Displays the DHCP class ID for a specified adapter. To see the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. /setclassid Adapter [ClassID] Configures the DHCP class ID for a specified adapter. To set the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. If a DHCP class ID is not specified, the current class ID is removed. Examples: Ipconfig To display the basic TCP/IP configuration for all adapters ipconfig /all To display the full TCP/IP configuration for all adapters
- 6. ipconfig /renew "Local Area Connection" To renew a DHCP-assigned IP address configuration for only the Local Area Connection adapter ipconfig /flushdns To flush the DNS resolver cache when troubleshooting DNS name resolution problems ipconfig /showclassid Local To display the DHCP class ID for all adapters with names that start with Local ipconfig /setclassid "Local Area Connection" TEST To set the DHCP class ID for the Local Area Connection adapter to TEST 4. Nslookup The nslookup (which stands for name server lookup) command is a network utility program used to obtain information about internet servers. It finds name server information for domains by querying the Domain Name System. 5. traceroute Traceroute is a network diagnostic tool used to track the pathway taken by a packet on an IP network from source to destination. Traceroute also records the time taken for each hop the packet makes during its route to the destination.
- 7. Traceroute uses Internet Control Message Protocol (ICMP) echo packets with variable time to live (TTL) values. The response time of each hop is calculated. To guarantee accuracy, each hop is queried multiple times (usually three times) to better measure the response of that particular hop. tracert www.google.com With the tracert command shown above, we're asking tracert to show us the path from the local computer all the way to the network device with the hostname www.google.com. Tracing route to www.l.google.com [209.85.225.104] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms 10.1.0.1 2 35 ms 19 ms 29 ms 98.245.140.1 3 11 ms 27 ms 9 ms te-0-3.dnv.comcast.net [68.85.105.201] ... 13 81 ms 76 ms 75 ms 209.85.241.37 14 84 ms 91 ms 87 ms 209.85.248.102 15 76 ms 112 ms 76 ms iy-f104.1e100.net [209.85.225.104] Trace complete. tracert -j 10.12.0.1 10.29.3.1 10.1.44.1 www.google.com