TCPDUMP Filter not working

Kgeil · 03-06-2014, 11:49 AM

Hi, I'm trying to set up snort on Debian 6.06. It's connected to an HP procurve switch which is mirroring an entire vlan (103) to eth1 on the Debian box. I'm trying to use tcpdump to make sure that eth1 can see the mirrored traffic.

eth0 is set up with ip 10.103.16.25, and eth1 does not have an address configured. My workstation (initiating the ssh session) has an IP of 10.101.0.72.

If I invoke:

Code:

tcpdump -i eth0 not port 22

, Tcpdump excludes my ssh session just fine, but if I turn to eth1, and invoke:

Code:

tcpdump -n -i eth1 not port 22

, I get:

07:34:11.209830 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 87396:87656, ack 417, win 51, length 260
07:34:11.213857 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 87656:87820, ack 417, win 51, length 164
07:34:11.215302 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 85700, win 256, length 0
07:34:11.217899 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 87820:88080, ack 417, win 51, length 260
07:34:11.221864 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 88080:88244, ack 417, win 51, length 164
07:34:11.223368 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 86124, win 254, length 0
07:34:11.225919 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 88244:88504, ack 417, win 51, length 260
07:34:11.229818 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 88504:88668, ack 417, win 51, length 164
07:34:11.230756 IP 10.103.16.101.51010 > 192.168.3.245.53: 46940+ A? orda-12r2-sccm.orda.local. (43)
07:34:11.231282 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 86548, win 253, length 0
07:34:11.231590 IP 192.168.3.245.53 > 10.103.16.101.51010: 46940* 1/0/0 A 10.101.0.54 (59)
07:34:11.231898 IP 10.103.16.1.514 > 10.103.16.25.514: SYSLOG local0.info, length: 229
07:34:11.232910 IP 10.103.16.101.61633 > 10.101.0.54.80: Flags [S], seq 1622107933, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0

If I try to filter out my own workstation with:

Code:

tcpdump -n -i eth1 not host 10.101.0.72

I get:

07:15:59.855638 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 346620, win 256, length 0
07:15:59.860117 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 348168:348428, ack 1821, win 9, length 260
07:15:59.865854 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 348428:348592, ack 1821, win 9, length 164
07:15:59.867547 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 347044, win 254, length 0
07:15:59.873861 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 348592:348852, ack 1821, win 9, length 260
07:15:59.875029 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 347580, win 258, length 0
07:15:59.878048 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 348852:349112, ack 1821, win 9, length 260
07:15:59.882358 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 349112:349276, ack 1821, win 9, length 164
07:15:59.887251 IP 10.101.0.72.26226 > 10.103.16.25.22: Flags [.], ack 348004, win 256, length 0
07:15:59.887444 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 349276:349536, ack 1821, win 9, length 260
07:15:59.890602 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 349536:349700, ack 1821, win 9, length 164
07:15:59.897868 IP 10.103.16.25.22 > 10.101.0.72.26226: Flags [P.], seq 349700:349864, ack 1821, win 9, length 164

If anyone has ideas on where I'm going wrong, I'd love to hear.

Thanks,

Kevin

anomie · 03-07-2014, 11:43 AM

Your filter looks fine. My WAG is the port mirroring is somehow confusing tcpdump(8).

tcpdump(8) says, "He told me to exclude port 22 traffic for eth1. But I'm seeing port 22 traffic for eth0 - on eth1. So I'd better chatter about it". (Just a theory.)

Just for fun, try your invocation with the '-i any' option, a la:

Code:

# tcpdump -i any not port 22