sys-cmd tcpdump

sys-cmd tcpdump captures the packets passing through the interfaces of the route table selected in WEB-CLI. The packets are either written to the screen line by line or saved with | to-file to a pcap file that can be opened in tools such as Wireshark. It is the packet-level answer to the questions "Is a request coming to the VIP, is it being forwarded to the backend, is a response returning, is the connection being reset?".

Command Summary

TR7 WEB-CLI · sys-cmd tcpdump

# type tcpdump and press Tab: a free parameter

admin@TR7LBWAF01> sys-cmd tcpdump

<tcpdump-parameter-1>

 

# to the screen

admin@TR7LBWAF01> sys-cmd tcpdump <parameters> <filter>

# to a pcap file

admin@TR7LBWAF01> sys-cmd tcpdump <parameters> <filter> | to-file <file-name>

admin@TR7LBWAF01>  

Everything written after the word tcpdump is passed to the tool as it is. There is no mandatory field; if a filter is not written, all the packets on the interface are captured.

How It Works

Subject	Behavior
Context	It listens to the interfaces of the selected v-device and route table; for the traffic of another route table, route-table set is run first.
Capturing to the screen	The lines flow to the screen as the packets arrive.
Capturing to a file	When the line ends with | to-file <file-name>, the CLI makes tcpdump write the packets in the pcap format and with the full content up to 100000 bytes per packet. While the capture continues, no line comes to the screen.
The rejected parameters	A parameter that begins with -w or -r is rejected: -w not allowed for tcpdump, -r not allowed for tcpdump. The only way to write to a file is the to-file pipe.
Duration	If -c is not given, it listens without stopping; it is stopped with Ctrl+C.
Recording	Every run is written to the user logs, and the download of the file is recorded separately.

Frequently Used Parameters

Parameter	What it does	What is written after it
-i	Selects the interface to be listened to; any listens to all the interfaces	An interface name or any
-c	Stops when it captures the specified number of packets	A number (e.g. 500)
-n · -nn	Does not resolve the addresses (and with -nn the ports as well) to names	—
-A	Shows the packet content as text; for seeing unencrypted HTTP headers	—
-X	Shows the packet content as hexadecimal and text	—
-e	Adds the link layer header (the MAC addresses, the VLAN)	—
-v	Writes a more detailed analysis	—

Filter expressions are written after the parameters:

Expression	What it captures	Example
host	The packets whose source or destination is this address	host 10.20.0.30
src · dst	The packets whose source only or destination only is this address	src 203.0.113.7
port	The packets whose source or destination port is this	port 443
net	The packets related to the addresses in this subnet	net 10.20.0.0/24
tcp · udp · icmp	By protocol	udp port 53
and · or · not	Combines the expressions	host 10.20.0.30 and not port 22

Expressions that contain parentheses are put in single quotation marks: '(port 80 or port 443)'. Because the | character counts as a pipe even inside quotation marks, it cannot be used in a filter expression. The tables summarize the frequently used ones; the full list depends on the version of the tool on the device.

Examples

TR7 WEB-CLI · A) The 443 traffic coming to the VIP, 50 packets

admin@TR7LBWAF01> sys-cmd tcpdump -nn -i any -c 50 host 10.0.7.20 and port 443

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) Reset connections

admin@TR7LBWAF01> sys-cmd tcpdump -nn -i any 'tcp[tcpflags] & tcp-rst != 0'

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) Unencrypted HTTP headers

admin@TR7LBWAF01> sys-cmd tcpdump -nn -i any -A -c 20 host 10.20.0.30 and port 80

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) Take the backend traffic to a pcap file and download it

admin@TR7LBWAF01> sys-cmd tcpdump -nn -i any -c 2000 host 10.20.0.30 and port 8443 | to-file backend-8443.pcap

# it is downloaded with the address in the Link column

admin@TR7LBWAF01> sys-cmd file show backend-8443.pcap

# delete it when the work is finished

admin@TR7LBWAF01> sys-cmd file delete backend-8443.pcap

admin@TR7LBWAF01>  

TR7 WEB-CLI · E) Filter the DNS queries

admin@TR7LBWAF01> sys-cmd tcpdump -nn -i any udp port 53 | grep example.com

admin@TR7LBWAF01>  

Things to Know

A capture is started with a limit

A capture to a file without a filter or without -c fills the temporary disk area quickly (the area is 2G by default). It is started first with a narrow host / port filter and with -c; how full the area is is followed with file disk show.

• The file name. The name given with to-file contains only letters, digits, -, _ and .; the file appears in the output of file list.
• There is no printing to the screen. In a capture to a file, the to-file command does not take --stdout; because pcap is a binary format, it cannot be read on the screen.
• The /tmp/ note in the command help. The expression "/tmp directory for pcap outputs" that appears in the Tab help does not match the behavior of this version: -w is rejected, and the file is taken only with to-file.
• TLS content. The content of the 443 traffic appears encrypted; for the handshake steps ssldump is used.