shell - Reading captured packet from command line with tcpdump -
i capturing traffic using:
tcpdump -i <interface> -nn -s0 -w ike2.pcap
then reading captured file using:
tcpdump -vvv -l -r ike2.pcap
while reading, first packet getting displayed as:
07:22:33.320142 ip (tos 0x0, ttl 64, id 0, offset 0, flags [df], length: 296) 10.0.0.1.isakmp > 10.0.0.2.isakmp: [udp sum ok] isakmp 2.0 msgid cookie ->: phase 1 #34[]: (#33) (#34) (#40) (#41) (#41)
i need details of packet. in isakmp ikev2 packet, interested extract values of 'encryption algorithm' , 'integrity algorithm' (i.e 'encr_3des' , 'auth_hmac_md5_96')
i can view values if inspect packet in wireshark. but, have shell script, cannot utilize wireshark. need these values tcpdump read command itself.
i assuming there might way print encryption , integrity algorithms used tcpdump read command. please help figure out.
captured packet:
i can view values if inspect packet in wireshark. but, have shell script, cannot utilize wireshark.
but perhaps utilize tshark.
shell tcpdump ipsec
No comments:
Post a Comment