Scribd
Upload
4 views

UnderstandingPCAPFilesandPacketCapture-StudyGuide

The document provides an overview of packet capture and analysis, detailing the principles of packet capture, the libpcap library, and methods for capturing and analyzing packets. It discusses the structure of PCAP files, their limitations, and security risks associated with handling captured data. Additionally, it outlines best practices for managing PCAP files to ensure security and privacy.

Uploaded by

vanis131203
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
4 views

UnderstandingPCAPFilesandPacketCapture-StudyGuide

The document provides an overview of packet capture and analysis, detailing the principles of packet capture, the libpcap library, and methods for capturing and analyzing packets. It discusses the structure of PCAP files, their limitations, and security risks associated with handling captured data. Additionally, it outlines best practices for managing PCAP files to ensure security and privacy.

Uploaded by

vanis131203
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

Packet Capture and Analysis

Packet Capture Principles


Definition: Packet capture is the process of collecting data as it travels over a network.
Sniffers: Also known as packet analyzers, are programs that intercept network traffic.
libpcap: An open-source, portable packet capture library that forms the core of tools like
tcpdump, dsniff, nmap, snort, ettercap.
Network Card Operation:
The network card checks if the destination MAC address matches its own.
If it matches, an interrupt request is generated.
The network card driver timestamps received data and copies it from the card buffer to a
memory block in kernel space.
The driver determines the packet type (Ethernet type field) and passes it to the appropriate
protocol handler.
The IP packet handler performs checks (e.g., packet corruption, destination).
IP headers are removed, and the remainder is passed to the next protocol handler (TCP or
UDP).
This process repeats until data reaches the application layer.
Sniffer Process: Packets go through the same process, but the network driver also sends a
copy of received/transmitted packets to the packet filter in the kernel.
Packet Filters: Enable packet capture; by default, they let any packet through, but they can
offer advanced filtering capabilities.
Privileges: Most systems require administrator privileges to use packet capture due to
security risks.

libpcap Library
Overview: Provides a high-level interface to network packet capture systems.
History: Created in the 1990s by McCanne, Leres, and Jacobson at the Lawrence Berkeley
National Laboratory.
Objective: To create a platform-independent API, eliminating the need for system-dependent
packet capture modules in each application.
Languages: Designed to be used from C and C++, but wrappers exist for Perl, Python, Java,
C#, Ruby.
Operating Systems: Runs on most UNIX-like operating systems (Linux, Solaris, BSD, HP-UX)
and Windows (WinPcap/NPCAP).
Maintenance: Maintained by the Tcpdump Group.
Resources: Full documentation and source code are available at https://www.tcpdump.org
and https://www.winpcap.org (for WinPcap).

Capturing Packets with libpcap


1. Find a Network Interface:

char *pcap_lookupdev(char *errbuf): Returns a pointer to a string containing the name of the
first suitable network device for packet capture. If a specific network interface is not specified
by the end user, pcap_lookupdev will find one to listen on.
errbuf: A user-supplied buffer to store an error message if something goes wrong. Must be at
least PCAP_ERRBUF_SIZE (currently 256) bytes.

1. Open the Network Interface:

pcap_t *pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, char *errbuf):
Opens a network interface for packet capture.

1. Capture Packets: Several options exist:

const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h): Returns the first packet that
arrives on the network interface.
device: Name of the network interface.
snaplen: Maximum number of bytes to capture. A value of 65535 should be enough to
hold any packet from any network.
promisc: Whether to put the network interface in promiscuous mode (accepting packets
not destined for it). Specify 1 for promiscuous and 0 for non-promiscuous.
to_ms: Kernel wait time (in milliseconds) before copying captured information from kernel
space to user space.
errbuf: Error buffer.
int pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user): Collects packets and
processes them using a user-defined function (callback). Returns when cnt packets have
been captured (negative cnt returns only on error). The user argument is passed to the
callback function.
int pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user): Similar to
pcap_loop, but returns when the to_ms timeout specified in pcap_open_live elapses.

1. Packet Processing Function Prototype:

void function_name(u_char *user, const struct pcap_pkthdr *pkthdr, const u_char *packet):
This is the prototype for the callback function used with pcap_loop and pcap_dispatch.

user: The user argument passed to pcap_loop or pcap_dispatch.


pkthdr: Pointer to a structure containing information about the captured packet
(timestamp, size).
packet: Pointer to the raw packet data.

Packet Header Structure (pcap_pkthdr):

struct pcap_pkthdr {
struct timeval ts; // Timestamp of capture
bpf_u_int32 caplen; // Number of bytes that were stored
bpf_u_int32 len; // Total length of the packet
};

ts: Timestamp of capture.


caplen: Number of bytes stored (may be less than len if snaplen is smaller than the packet
size).
len: Total length of the packet.
Analyzing Captured Packets
1. Data Link Type:

Determine the underlying data link type to interpret headers correctly.


int pcap_datalink(pcap_t *p): Returns the link layer type of the opened device.
Common types include Ethernet, Wi-Fi, Fiber Distributed Data Interface (FDDI), PPP.

1. Network Layer Protocol:

For Ethernet networks, the ethertype field in the Ethernet header specifies the next protocol.
Common values:

1. Transport Layer Protocol:

If the network layer is IPv4, the protocol field in the IPv4 header indicates the transport layer
protocol. In IPv6 it is the next header field.
0x0800: IPv4
0x86DD: IPv6
0x0806: ARP
Common values:

1. Application Layer Protocol:

Application layer protocols are harder to distinguish. TCP port numbers can provide clues
(e.g., port 80 for HTTP).

1. Malformed Packets:

Handle malformed or corrupted packets.


0x06: TCP
0x11: UDP
0x01: ICMP
Check the overall size of the received packet.
Validate IP and TCP checksums.

Filtering Packets
Kernel-Level Filtering: The system's packet filter is used to reduce the amount of data copied
from kernel space to user space.
BSD Packet Filter (BPF): libpcap provides support for BPF-based packet filters.
Steps to Set a Filter:

1. Construct the filter expression.


2. Compile the expression into a BPF program.
3. Apply the filter.

Filter Expression Examples:


src host <address>: Returns packets with the specified source IP address.
dst port <port>: Returns packets with the specified destination TCP/UDP port.
not tcp: Returns packets that do not use the TCP protocol.
tcp[13] & 0x02 != 0 and (dst port 80 or dst port 8080): Returns TCP packets with the SYN
flag set and destination port 80 or 8080.
Compiling the Filter:
int pcap_compile(pcap_t *p, struct bpf_program *fp, char *str, int optimize, bpf_u_int32
netmask): Compiles the filter expression pointed to by str into BPF code.
fp: Pointer to a bpf_program structure (declared before the call to pcap_compile).
optimize: Whether to optimize the filter program for efficiency.
netmask: Network mask of the network (can be set to 0 unless testing for broadcast
addresses).

Setting the Filter:


int pcap_setfilter(pcap_t *p, struct bpf_program *fp): Inserts the compiled BPF program
into the kernel.

PCAP File Format


Definition: A common format for storing packet captures.
Content: Includes an exact copy of every byte of every packet as seen on the network (OSI
layers 2-7).
Origin: Developed alongside tcpdump and libpcap in the 1990s.
Compatibility: Easily read by various tools and software.

PCAP File Structure


A file header followed by zero or more packet records.

File Header Fields


Magic Number:
0xA1B2C3D4: Timestamp is seconds and microseconds.
0xA1B23C4D: Timestamp is seconds and nanoseconds.
Major Version: Typically 2.
SnapLen: Maximum number of octets captured from each packet.
LinkType: Describes the type of link the packets were captured from (assigned by
tcpdump.org). Example: 1 = IEEE 802.3 Ethernet.
FCS: Frame Check Sequence. If the "F" bit is set, the FCS field provides the number of 16-bit
words of FCS appended to each packet. Ethernet typically has a value of 2, indicating 32-bit
FCS.

Packet Record Fields


Timestamp (Seconds): Number of seconds elapsed since 1970-01-01 00:00:00 UTC.
Timestamp (Microseconds or Nanoseconds): Number of microseconds or nanoseconds
elapsed since the last full second.
Captured Packet Length: Number of octets captured from the packet (truncated if snaplen is
exceeded).
Original Packet Length: Actual length of the packet when transmitted.
Ethernet Frame Checksum (FCS): May or may not be captured.

Limitations of PCAP Files


Simple flat file with no index or extensibility.
Not designed for captures larger than a few hundred megabytes.
Lacks "Provenance" (no record of how/where packets were captured).

Alternatives to PCAP Files


PCAPNG (PCAP Next Generation): More extensible and portable, with additional information
(packet drops, DNS records, etc.).
ERF (Extensible Record Format): Adds provenance metadata, high-resolution timestamps,
and in-band packet loss auditing.

Security and Privacy Risks


PCAPs contain clear-text copies of potentially unencrypted private/sensitive information.
Sensitive information like passwords and usernames could be extracted.
Malware may be contained within packets.
May trigger virus scanners or IDS/IPS systems.
Data may be classified as protected information under GDPR, ADPPA, HIPAA, etc.

Managing PCAP Files


Careful naming is important.
Store packet data on a dedicated packet capture appliance with indexing.
Automate PCAP retrieval for security teams.
Encrypt PCAPs with password security and store them in secure locations with restricted
access.
Control access to systems generating PCAPs, assigning privileges only to cleared staff.

You might also like