Lesson 2.18: Precise packet filters: scans and surprises
A capture of even a few minutes holds thousands of packets. Filter expressions (the pcap-filter language that tcpdump, Wireshark capture filters and many sensors share) let you ask exact questions: only SYN packets, only one host's answers, everything except the noise. In the lab you read a capture from Northwind's web server, find a half-open port scan, count the ports it tried, list which ones answered, and remove the known traffic to uncover something nobody expected.
16 min
You will learn to
- Write pcap-filter expressions
- Match TCP flags (SYN, SYN-ACK, RST)
- Recognise a half-open scan
- Find which ports answered
- Use 'not' to remove known traffic
Key terms
- pcap-filter (BPF) expression
- A small language to select packets, compiled to Berkeley Packet Filter code.
- Primitives
- host, net, port, portrange, tcp/udp/icmp/arp, with src or dst.
- TCP flags
- Bits in the TCP header: SYN, ACK, FIN, RST, PSH, URG.
- Half-open (SYN) scan
- Sending SYNs and resetting after a SYN-ACK, never completing the handshake.
- Capture vs display filter
- BPF selects what is captured or read; Wireshark's display filters use a different syntax.
← MAC addresses, Ethernet and ARP · All lessons · Dangerous file permissions →