Thursday, 15 March 2012

shell - Reading captured packet from command line with tcpdump -



shell - Reading captured packet from command line with tcpdump -

i capturing traffic using:

tcpdump -i <interface> -nn -s0 -w ike2.pcap

then reading captured file using:

tcpdump -vvv -l -r ike2.pcap

while reading, first packet getting displayed as:

07:22:33.320142 ip (tos 0x0, ttl 64, id 0, offset 0, flags [df], length: 296) 10.0.0.1.isakmp > 10.0.0.2.isakmp: [udp sum ok] isakmp 2.0 msgid cookie ->: phase 1 #34[]: (#33) (#34) (#40) (#41) (#41)

i need details of packet. in isakmp ikev2 packet, interested extract values of 'encryption algorithm' , 'integrity algorithm' (i.e 'encr_3des' , 'auth_hmac_md5_96')

i can view values if inspect packet in wireshark. but, have shell script, cannot utilize wireshark. need these values tcpdump read command itself.

i assuming there might way print encryption , integrity algorithms used tcpdump read command. please help figure out.

captured packet:

i can view values if inspect packet in wireshark. but, have shell script, cannot utilize wireshark.

but perhaps utilize tshark.

shell tcpdump ipsec

No comments:

Post a Comment