Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

Neohapsis > Archives > Bugtraq> 2000-01

Bugtraq Archives: Re: tcpdump under RedHat 6.1

Re: tcpdump under RedHat 6.1

Subject: Re: tcpdump under RedHat 6.1
From: Ken Lyon (kenVORTEXCORP.COM)
Date: Sat Jan 22 2000 - 04:38:07 CST

Next message: Jonah Kowall: "Re: Vulnerabilities in Checkpoint FW-1 version 3.x and maybe 4.x"
Previous message: FEAR Advisories: "*BSD procfs vulnerability"
In reply to: Francois Morris: "Re: tcpdump under RedHat 6.1"
Reply: Ken Lyon: "Re: tcpdump under RedHat 6.1"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I found that -n affects the src and dest IPs and -nn will add the port numbers.
Note the newly added second field after the datetime stamp.
Courtney and Trojan PERLs will have to change the line[] array to add 1 to each position _after 0.
line[1] becomes line[2], etc.

...ken

**************************
Another problem is that the -e flag doesn't work correctly. For an outgoing
packet
the source MAC address is 0:0:0:0:0:0, for an incoming packet the destination
MAC address is 0:0:0:0:0:1. I have this problem with tcpdump-3.4-16,
with tcpdump-3.4-10 copied from another machine the source and destination
addresses are correct.

John Comeau wrote:

> Another nice gotcha is that -p now means the opposite of its old
> behavior (and what its manpage still reads): rather than disabling
> promiscuous mode, it now enables same (default is now nonpromiscuous -
> all you'll see is your own traffic plus broadcast and multicast) - jc
>
> Renaud Deraison wrote:
> >
> > RedHat 6.1 comes bundled with a modified version of tcpdump, which has
> > the ability to listen on all the interfaces at once, which is nice.
> >
> > However, the output format has changed. Whereas a typical tcpdump
> > line was :
> >
> > time source.port > dest.port:[.....]
> >
> > It is now :
> >
> > time interface > source.port > dest.port:[....]
> > or
> > time interface < source.port > dest.port:[....]
> >
> > If you explicitely ask tcpdump to listen on one interface, the
> > output will be :
> >
> > time > source.port > dest.port:[....]
> > or
> > time < source.port > dest.port:[....]
> >
> > Also, the 'port' is no longer a numeric value. It is taken from
> > /etc/services, even with the -n option set.
> >
> > This new behavior will make a lot of programs that use tcpdump's
> > output panic or produce bogus output. I think shadow is affected,
> > but it's not the only one.
> >
> > I have been looking through the man page, and I could not find an option
> > to issue a backward compatible output. What is worst is that
> > tcpdump --version will show up the same version numbers (3.4) than
> > the older tcpdumps, so this problem will only be detected at runtime.
> >
> > So, if you have written your own custom scripts or if some of the programs
> > you use are relying on tcpdump, then install the tcpdump that comes
> > bundled with RH 6.0, or modify your scripts so that they can handle this
> > modification.
> >
> > -- Renaud
> >
> > (apologies if this was already known)
> >
> > --
> > Renaud Deraison
> > The Nessus Project
> > <A TARGET=nonlocal HREF="/external/http://www.nessus.org">http://www.nessus.org>
>
> --
> John Comeau - Chief Operating Officer
> Dialtone Internet - Extremely Fast Web Systems
> 954-581-0097 fax://954-581-7629
> <A HREF="mailto:jcomeaudialtoneinternet.net">jcomeaudialtoneinternet.net</A>
> <A TARGET=nonlocal HREF="/external/http://www.dialtoneinternet.net">http://www.dialtoneinternet.net>

--
François MORRIS                Lab. Minéralogie-Cristallographie,
4, place Jussieu               F-75252 PARIS
Phone: +33 (0) 1 44 27 52 42   Fax: +33 (0) 1 44 27 37 85
E-mail: <A HREF="mailto:morrislmcp.jussieu.fr">morrislmcp.jussieu.fr</A> URL: <A TARGET=nonlocal HREF="/external/http://www.lmcp.jussieu.fr/~morris">http://www.lmcp.jussieu.fr/~morris>

Next message: Jonah Kowall: "Re: Vulnerabilities in Checkpoint FW-1 version 3.x and maybe 4.x"
Previous message: FEAR Advisories: "*BSD procfs vulnerability"
In reply to: Francois Morris: "Re: tcpdump under RedHat 6.1"
Reply: Ken Lyon: "Re: tcpdump under RedHat 6.1"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Mon Jan 24 2000 - 06:48:38 CST