From 3c051e70e5cfe32a0f2379c7a23320a9be88a0d2 Mon Sep 17 00:00:00 2001 From: johannst Date: Tue, 9 Jan 2024 21:31:09 +0000 Subject: deploy: 9679f071a80dddfa3dc33b084826ff8a16725ba4 --- network/firewall-cmd.html | 6 +- network/index.html | 3 +- network/nftables.html | 2 +- network/tcpdump.html | 8 +- network/tshark.html | 265 ++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 275 insertions(+), 9 deletions(-) create mode 100644 network/tshark.html (limited to 'network') diff --git a/network/firewall-cmd.html b/network/firewall-cmd.html index 257d19f..a1e248c 100644 --- a/network/firewall-cmd.html +++ b/network/firewall-cmd.html @@ -88,7 +88,7 @@

- + diff --git a/network/index.html b/network/index.html index 1c590f1..ae83c51 100644 --- a/network/index.html +++ b/network/index.html @@ -88,7 +88,7 @@

@@ -179,6 +179,7 @@

Network

diff --git a/network/nftables.html b/network/nftables.html index 58f8649..0c6bc77 100644 --- a/network/nftables.html +++ b/network/nftables.html @@ -88,7 +88,7 @@

diff --git a/network/tcpdump.html b/network/tcpdump.html index fa6b5a0..98d4a48 100644 --- a/network/tcpdump.html +++ b/network/tcpdump.html @@ -88,7 +88,7 @@

@@ -183,7 +183,7 @@ -w <file|-> Write pcap trace to file or stdout (-). -r <file> Read & parse pcap file. -

Some useful filters.

+

Some useful filters, for the full syntax see pcap-filter(7).

src <ip>                Filter for source IP.
 dst <ip>                Filter for destination IP.
 host <ip>               Filter for IP (src + dst).
@@ -211,7 +211,7 @@ ssh <host> tcpdump -i any -w - | sudo wireshark -k -i -
                                 
                             
 
-                            
+                            
                                 
                             
 
@@ -225,7 +225,7 @@ ssh <host> tcpdump -i any -w - | sudo wireshark -k -i -
                         
                     
 
-                    
+


diff --git a/network/tshark.html b/network/tshark.html
new file mode 100644
index 0000000..0b4754a
--- /dev/null
+++ b/network/tshark.html
@@ -0,0 +1,265 @@
+
+
+    
+        
+        
+        tshark - Notes
+
+
+        
+        
+        
+        
+        
+
+        
+        
+        
+        
+        
+        
+
+        
+        
+        
+
+        
+        
+        
+        
+
+        
+
+    
+    
+    
+        
+        
+
+        
+        
+
+        
+        
+
+        
+
+        
+        
+
+        
+            
+                Introduction
1. Tools
1.1. zsh
1.2. bash
1.3. fish
1.4. tmux
1.5. git
1.6. awk
1.7. emacs
1.8. gpg
1.9. gdb
1.10. gdbserver
1.11. radare2
1.12. qemu
1.13. pacman
1.14. dot
1.15. ffmpeg
2. Resource analysis & monitor
2.1. lsof
2.2. ss
2.3. pidstat
2.4. pgrep
2.5. pmap
2.6. pstack
3. Trace and Profile
3.1. strace
3.2. ltrace
3.3. perf
3.4. OProfile
3.5. time
4. Binary
4.1. od
4.2. xxd
4.3. readelf
4.4. objdump
4.5. nm
5. Development
5.1. c++filt
5.2. c++
5.3. glibc
5.4. gcc
5.5. cmake
5.6. make
5.7. ld.so
5.8. symbol versioning
5.9. python
5.10. gcov
5.11. pgo
6. Linux
6.1. systemd
6.2. coredump
6.3. ptrace_scope
6.4. cryptsetup
6.5. swap
6.6. input
6.7. acl
6.8. zfs
7. Network
7.1. tcpdump
7.2. tshark
7.3. firewall-cmd
7.4. nftables
8. Web
8.1. html
8.2. css
8.3. chartjs
9. Arch
9.1. x86_64
9.2. arm64
9.3. armv7
9.4. riscv
+            
+            
+                
+            
+        
+
+        
+        
+
+        
+
+            
+                                
+                
+                    
+                        
+                            
+                        
+                        
+                        
+                            
+                            
+                            
+                            
+                            
+                        
+                        
+                    
+
+                    Notes
+
+                    
+                        
+                            
+                        
+                        
+                            
+                        
+
+                    
+                
+
+                
+                    
+                        
+                    
+                    
+                        
+                        
+                        
+                    
+                
+
+                
+                
+
+                
+                    
+                        tshark (1)
+tshark [opts] -i <if>
+    --color         Colorize output.
+    -w <file|->     Write pcap trace to file or stdout (-).
+    -r <file>       Read & parse pcap file.
+    -f <filter>     Apply capture filter (see pcap-filter(7) or tcpdump).
+                    Only applicable during capturing.
+    -Y <filter>     Apply display filter.
+                    Only applicable during viewing capture.
+    -c <count>      Stop capturing after COUNT packets (INF by default).
+
+Some useful display filters.
+ip.addr != 192.168.1.0/24      Filter out whole ip subnet (source + destination).
+ip.dst == 192.168.1.42         Filter for destination ip address.
+tcp.dstport == 80              Filter for tcp destinatio port.
+!wg                            Filter out all wireguard traffic.
+
+tcp/udp/ssh/wg/...             Filter for protocol.
+
+"and/or/not/!" and "()" can be used to build filter expressions.
+
+
+Use tshak -G to list all fields that can be used in display filters.
+
+Examples
+Capture and filter packet to file
+# Capture TCP traffic with port 80 on interface eth0 to file.
+sudo tshark -i eht0 -f 'tcp and port 80' -w tx.pcap
+
+# View captured packets.
+sudo tshark -r tx.pcap
+
+# View captured packets and apply additionaly display filters.
+sudo tshark -r tx.pcap -Y 'ip.addr != 192.168.1.42'
+
+
+                    
+
+                    
+                        
+                            
+                                
+                            
+
+                            
+                                
+                            
+
+                        
+                    
+                
+            
+
+            
+                    
+                        
+                    
+
+                    
+                        
+                    
+            
+
+        
+
+
+
+
+        
+
+
+        
+        
+        
+
+        
+        
+        
+
+        
+
+
+    
+    
+
-- 
cgit v1.2.3