Nfdump -O packets -A dstip -t ‘5-5’ -R cases/ -o ‘fmt:%da %pkt %fl %bpp’ ‘proto tcp and src ip 8.8.8.8 and flags S and not flags AFRPU and (dst ip 4.4.4.4 or dst ip 3.3.3.3 or dst ip 2.2.2.2)’ Nfdump -O packets -R cases/ -A srcip,dstip ‘proto tcp and src ip 8.8.8.8 and flags S and not flags AFRPU’ Show only session with SYN flag, order by packets, aggregate scr & dst ip’s.Nfdump -O bytes -o extended -R cases/ ‘ip 8.8.8.8’ -A proto Order by amount of bytes, Aggregate on proto type.Http.request and http.host contains “google” Obtain base64 code from follow stream in wireshark and save to fileĬat base64-from-url.txt | uridecode.py > native-base64.txtīase64 -di native-base64.txt > decode-base64.bin Sudo tcpdump -n -i eth0 -s 0 -w /cases/scan.pcap Sudo tcpdump -n -i eth0 -s 0 “arp and not ether dst ff:ff:ff:ff:ff:ff” Tshark -n -r /cases/*.pcap -T fields -E separator=/t -e frame.number -e frame.time -e http.referer -e okie -Y ‘ contains “dropbox”‘

Tshark -n -r /cases/*.pcap -Y ‘tcp.stream=27757’ -T fields -e tcp.segment_data > /cases/extract.txt Tshark -n -x -r /cases/*.pcap -Y ‘frame.number=27757’ -T fields -e tcp.stream

Tshark -n -r /cases/*.pcap -Y ‘http.host contains “dropbox.xom” and = “POST”‘ Tshark -n -r /cases/*.pcap -Y ‘http.host contains “google” and http.request’ Tshark -r /cases/*.pcap -Y ftp -T fields -e ip.src -e ip.dst | sort | uniq -c | sort –nr

Wireshark pcap ciphersuite