Open Source Security Tools : Practical Guide to Security Applications part 21. Few frontline system administrators can afford to spend all day worrying about security. But in this age of widespread virus infections, worms, and digital attacks, no one can afford to neglect network defenses. Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. | Page 179 Thursday June 24 2004 12 39 PM TCP IP Packet Headers 179 Combinations Descriptions aarp Shorter version of the ether proto statement for trapping traffic matching the Ethernet protocol of aarp. decnet Shorter version of the ether proto statement for trapping traffic matching the Ethernet protocol of DECnet. iso Shorter version of the ether proto statement for trapping traffic matching the Ethernet protocol of iso. stp Shorter version of the ether proto statement for trapping traffic matching the Ethernet protocol of stp. ipx Shorter version of the ether proto statement for trapping traffic matching the Ethernet protocol of ipx. netbeui Shorter version of the ether proto statement for trapping traffic matching the Ethernet protocol of netbeui. vlan vlan_id Captures packets based on the VLAN standard. It can be used by itself or by specifying vlan_id. tcp An abbreviated form of the statement ip proto tcp. udp An abbreviated form of the statement ip proto udp. icmp An abbreviated form of the statement ip proto icmp. iso proto protocol Captures OSI packets with a protocol type ofprocotol. Allowable OSI protocol types are clnp esis and isis. clnp An abbreviated form of the above statement using clnp for protocol. esis An abbreviated form of the iso proto protocol statement using esis for protocol. isis An abbreviated form of the iso proto protocol statement using isis for protocol. Page 180 Thursday June 24 2004 11 47 AM 180 Chapter 6 Network Sniffers Tcpdump Examples The following are several practical examples of ways to use Tcpdump. View All Traffic to and from a Particular Host If you want to monitor only traffic to and from a specific host you can filter everything else out with the simple host expression. For example to monitor a host with the IP address the statement would look like this tcpdump -n host Watch Only Traffic Coming in or out on a Certain Port If you want to track usage of a .
