3

I am using tcpdump on OpenBSD and trying to learn it from a primer on it.

I want to capture a range of ports, but it seems how this is done has changed. I can't even find portrange as a keyword in the manual page which also suggests this.

# tcpdump portrange 100-65535 
tcpdump: syntax error

Not a thing:

# man tcpdump | grep portrange
# 

I assume that this has changed, or it is different on OpenBSD. If anyone could tell me what to do for this, since my first lessons we're going to be with something practical it would be great. It would be even better if someone told me about an updated primer on tcpdump.

OpenBSD comes with its own tcpdump which might be a fork, I'm not really sure.

4

portrange isn't there in OpenBSD's pcap-filter, but you can fake it.

tcpdump -i em0 tcp[2:2] > 79 and tcp[2:2] < 85

You can address parts of the packets and compare against them. First number is offset in the packet (starting at zero) and the second number is how many bytes to use. So the above example matches any tcp packet with a destination port of 80 to 84. You can also use <= and >= to make things more intuitive.

Matching against source port would be tcp[0:2]. UDP actually would be the same since ports are at the same offsets.

2

The display filters are handled by libpcap, and OpenBSD has its own libpcap and tcpdump, which don't necessarily pick up changes from tcpdump.org's libpcap and tcpdump.

If portrange doesn't work, the support for it is probably one of the things OpenBSD didn't pick up.

1

you should use man pcap-filter not man tcpdump

According to man pcap-filter :

dst portrange port1-port2
              True  if  the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a destination port value between port1 and port2.  port1 and port2 are interpreted
              in the same fashion as the port parameter for port.


   src portrange port1-port2
          True if the packet has a source port value between port1 and port2.

   portrange port1-port2
          True if either the source or destination port of the packet is between port1 and port2.

          Any of the above port or port range expressions can be prepended with the keywords, tcp or udp, as in:
               tcp src port port
          which matches only tcp packets whose source port is port.
  • Sadly portrange is not used anywhere inside my 'man pcap-filter' ... OpenBSD have changed things, probably so I read the damn thing. – John Tate Oct 6 '13 at 16:45
  • please use OpenBSD resources... – PersianGulf Oct 6 '13 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.