Hello,
I was wondering what would be a good command/method for mapping network using tcpdump. Will filtering traffic based on well known port range and then using uniq command do the job? Appreciate your input.

Thanks
salo

In promiscuous mode you should be seeing everything in your subnet segment so there's no apparent need for a BPF filter I'd say: just awk the IP field and uniq it. But I'm wondering what the emphasis actually is on: mapping the network or using tcpdump? If it's the latter: why? Are you thinking of passive recon or something? Or are there other factors you haven't told us about?

It is for passive recon and for both "mapping the network as well as use of tcpdump". I am not as comfortable with awk as I am tcpdump. Can u recommend some strategy?..
Thanks

one more thing I also need to find out what services and servers are running in the network. That is why I was thinking of using ports.

thanks

any one?

Using the port numbers along with IP addresses is a fairly reliable method of mapping out servers on your network. You can dump out the collected data with the "tcpdump -r" command and save the output to a text file, or just dump the network data in real time. You will need to do some scripting to manipulate the data though. For example you will likely only want to retain the destination IP address and port numbers. You can pipe this data to a text file and then sort it and run the uniq command against the output. This will give you a list of IP addresses and the ports in use.
You should then be able to guess at the server type given the range of ports in use.
You will need to set mirror/monitor ports on your switches so you have enough visability of your network traffic.