Simpler IP Range Matching with Tshark Display Filters

In today's SANS ISC journal, the story IP Address Range Search with libpcap wonders how to accomplish the following:

...how to find SYN packets directed to natted addresses where an attempt was made to connect or scan a service natted to an internal resource. I used this filter for addresses located in the range 192.168.25.6 to 192.168.25.35.

The proposed answer is this:

tcpdump -nr file '((ip[16:2] = 0xc0a8  and ip[18] = 0x19 and ip[19] > 0x06)\
and (ip[16:2] = 0xc0a8 and ip[18] = 0x19 and ip[19] < 0x23) and tcp[13] = 0x02)'

I am sure it's clear to everyone what that means!

Given my low success rate in getting comments posted to the SANS ISC blog, I figured I would reply here.

Last fall I wrote Using Wireshark and Tshark display filters for troubleshooting. Wireshark display filters make writing such complex Berkeley Packet Filter syntax a thing of the past.

Using Wireshark display filters, a mere mortal could write the following:

tshark -nr file 'tcp.flags.syn and (ip.dst > 192.168.25.6 and ip.dst < 192.168.25.35)'

Note that if you want to be inclusive, change the > to >= and the < to <= .

To show that my filter works, I ran the filter against a file with traffic on my own 192.168.2.0/24 network, so I altered the last two octets to match my own traffic.

$ tshark -nr test.pcap 'tcp.flags.syn and (ip.dst > 192.168.2.103 and ip.dst < 192.168.2.106)'

137 2009-06-28 16:21:44.195504 74.125.115.100 -> 192.168.2.104 HTTP Continuation or non-HTTP traffic

You have plenty of other options, such as ip.src and ip.addr.

Which one do you think is faster to write and easier to understand?

Richard Bejtlich is teaching new classes in Las Vegas in 2009. Regular Las Vegas registration ends 1 July.

Comments

Eugene Kogan said…
Thanks for posting this. I had the exact same thought when I read the ISC blog solution. In this case, simpler is definitely better.
7:20 AM
Netfortius said…
Unfortunately I have never been able to compile tshark on HP-UX, whereas tcpdump was just fine ... so there is some use for the "old dog" :)

Stefan
1:33 PM
Jay Brown said…
I think there is something to be said about the granularity that the old school filters lend, and I myself, have been beating myself bout the head and neck to learn them (call me a glutton for punishment). I found some of the subtleties for filters in snort, tshark and wireshark annoyed me, but the old school filters were pretty universal. I agree though; for people who just want the job done, macros all the way......
11:10 AM
Anonymous said…
Totally agree. I tire of seeing hairy-chested uber-geek teeth-pulling methods of doing jobs that there should be simple methods to get done.

Netfortius: If you're doing network analysis on HP-UX, I think you're nuts. On the other hand, there are probably less tcpdump exploits constructed to compromise HP-UX than there are for tshark targets on linux...
9:30 AM
JimmytheGeek said…
Yeah - tcpdump, with its relatively primitive dissectors - is a safer platform than tshark. tshark does more, it's more complex, it has more vulnerabilities. That buys you the ability to do some neat stuff, but be aware of the cost.
5:50 PM
Anonymous said…
I have to disagree, tcpdump in various forms has been implemented on myriad of devices (most security
related) , while tethereal/tshark has been not. E.g. Checkpoint products (including Sofaware ones) / Fortinet products/ eSafe (Aladdin) / and list goes on.
All of them have tcpdump AND bf
filters capabilities and none has tshark ones.

So when doing live analysis on such devices I still have to remember bf filters syntax. And best way to remember it is to use it all the time. So even when I have the tshark luxury I still use tcpdump filters , and BTW the one above not that complex .
Cheers
3:58 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more