AltocumulusThe request that has been given me is to find any SOAP traffic from 2 sets of pools.
Pool 1 172.17.30.100 172.17.30.101 172.17.30.102
Pool 2 172.17.31.200 172.17.31.201 172.17.31.202
cany anyone help me with a tcpdump command that will give me all 80 and 443 traffic from pool 1 to pool 2 bidirectionaly?
CirrocumulusThe parameters to tcpdump I usually use are
tcpdump -i 0.0 -nn -p -e "thefilter"
where in your case "thefilter" would be something like
"(port 80 or port 443) and ((host 172.17.30.100 or host 172.17.30.101 or host 172.17.30.102) and ((host 172.17.31.200 or host 172.17.31.201 or host 172.17.31.202))"
Note that there's multiple ways to create a filter (As long as the syntax is correct and the logic OK they'll all work).
Note also this one will simoly list all the packet headers (Including VLAN) to the screen. If you want to save the packets out to a dumpfile for later analysis by something like wireshark, or decrypting with ssldump I'd use something like
tcpdump -i 0.0:nnn -p -s0 -w "somefilename" "thefilter"
to save the file out to "somefilename". Note the '-p' is an affectation more than anything else these days, especially with BigIP. It simply tells tcpdump not to put the interface into promiscuous mode. But I leave it there by force of habit 🙂
H