Re: Sniffing ranges of ips

[Jefferson Ogata <Jefferson.Ogata () noaa gov>]

Jefferson Ogata wrote:
> MMatos wrote:
>
> > I want to write a little program that analyses packets within a given 
> > ip range.
> >
> > My current problem is to set a filter that work with ip ranges.
> >
> > For example I want to dump all traffic that arrives to my box from ips 
> > 192.168.2.15 to 192.168.2.40
> > I could write all the ips in the range but that's not a good solution, 
> > so how can implement that filter correctly using the range?
> >
> > some kind of
> > $tcpdump "src 192.168.2.15/40"           :)
>
>
> Use the attached perl scripts, e.g.:
>
> tcpdump [options] `./genrange.pl 192.168.2.15 192.168.2.40 | 
> ./aggregate.pl | ./iptcpdump.pl src`

Or you can do something more utilitarian, such as:

tcpdump [options] '( ip[12:4] >= 0xc0a8020f ) and ( ip[12:4] <= 
0xc0a80228 )'

--
Jefferson Ogata <Jefferson.Ogata () noaa gov>
NOAA Computer Incident Response Team (N-CIRT) <ncirt () noaa gov>
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.