{"id":1042,"date":"2020-06-17T06:54:18","date_gmt":"2020-06-17T06:54:18","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=1042"},"modified":"2022-10-21T11:28:23","modified_gmt":"2022-10-21T11:28:23","slug":"how-to-figure-out-switch-and-port-via-tcpdump","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-figure-out-switch-and-port-via-tcpdump\/","title":{"rendered":"How to figure out switch and port via tcpdump"},"content":{"rendered":"<p style=\"margin-top: 5pt; padding-top: 0; margin-bottom: 5pt; padding-bottom: 0; line-height: 1.2;\">Okay if you have ever worked in a place where their network was complete choas with no documentation or network maps to help you figure out where something resides.<\/p>\n<p>You can sometimes use tcpdump to help you figure out where the server is sitting by using tcpdump.<br \/>\n<strong><span style=\"text-decoration: underline;\"><br \/>\nSyntax<\/span><\/strong><\/p>\n<p style=\"margin-top: 0pt; padding-top: 0; margin-bottom: 5pt; padding-bottom: 0; line-height: 1.2;\"><em>tcpdump -nn -v -i &lt;NIC_INTERFACE&gt; -s 1500 -c 1 &#8216;ether[20:2] == 0x2000&#8217;<\/em><\/p>\n<p><em><br \/>\n<\/em><em><\/em><\/p>\n<p style=\"margin-top: 0pt; padding-top: 0; margin-bottom: 8pt; padding-bottom: 0; line-height: 1.3;\"><strong>Example<\/strong>:<\/p>\n<p><em><span style=\"color: #444444; background-color: #ffffff;\">root@ansible<\/span><span style=\"color: #444444; background-color: #ffffff;\">:~ # <\/span><span style=\"color: #444444; background-color: #ffffff;\">tcpdump<\/span><span style=\"color: #444444; background-color: #ffffff;\"> &#8211;<\/span><span style=\"color: #444444; background-color: #ffffff;\">nn<\/span><span style=\"color: #444444; background-color: #ffffff;\"> -v &#8211;<\/span><span style=\"color: #444444; background-color: #ffffff;\">i<\/span><span style=\"color: #444444; background-color: #ffffff;\"> eth<\/span><span style=\"color: #444444; background-color: #ffffff;\">0<\/span><span style=\"color: #444444; background-color: #ffffff;\"> -s 1500 -c 1 &#8216;ether[20:2] == 0x2000&#8217;<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">tcpdump<\/span><span style=\"color: #444444; background-color: #ffffff;\">: listening on eth3, link-type EN10MB (Ethernet), capture size 1500 bytes<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">03:25:22.146564 CDPv2, <\/span><span style=\"color: #444444; background-color: #ffffff;\">ttl<\/span><span style=\"color: #444444; background-color: #ffffff;\">: 180s, checksum: 692 (unverified), length 370<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Device-ID (0x01), length: 11 bytes:&nbsp;<\/span><strong><span style=\"color: #990000; background-color: #ffffff;\">&#8216;<\/span><span style=\"color: #990000; background-color: #ffffff;\">switch<\/span><span style=\"color: #990000; background-color: #ffffff;\">-sw<\/span><span style=\"color: #990000; background-color: #ffffff;\">02<\/span><span style=\"color: #990000; background-color: #ffffff;\">&#8216;&nbsp;<\/span><\/strong><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Address (0x02), length: 13 bytes: IPv4 (1) 192.168.1.15<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Port-ID (0x03), length: 15 bytes:<\/span><span style=\"color: #990000; background-color: #ffffff;\">&nbsp;<\/span><strong><span style=\"color: #990000; background-color: #ffffff;\">&#8216;Ethernet0\/<\/span><span style=\"color: #990000; background-color: #ffffff;\">1<\/span><span style=\"color: #990000; background-color: #ffffff;\">&#8216;<\/span><\/strong><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Capability (0x04), length: 4 bytes: (0x00000028): L2 Switch, IGMP snooping<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Version String (0x05), length: 220 bytes:<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Cisco Internetwork Operating System Software<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;IOS &#8482; C2950 Software (C2950-I6Q4L2-M), Version 12.1(14)EA1a, RELEASE SOFTWARE (fc1)<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Copyright (c) 1986-2003 by cisco Systems, Inc.<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Compiled Tue 02-Sep-03 03:33 by <\/span><span style=\"color: #444444; background-color: #ffffff;\">Nicola tesla<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Platform (0x06), length: 18 bytes: &#8216;cisco WS-C2950T-24&#8217;<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Protocol-Hello option (0x08), length: 32 bytes:<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;VTP Management Domain (0x09), length: 6 bytes: &#8216;<\/span><span style=\"color: #444444; background-color: #ffffff;\">ecomrd<\/span><span style=\"color: #444444; background-color: #ffffff;\">&#8216;<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;Duplex (0x0b), length: 1 byte: full<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;AVVID trust bitmap (0x12), length: 1 byte: 0x00<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">&nbsp; &nbsp;AVVID untrusted ports <\/span><span style=\"color: #444444; background-color: #ffffff;\">CoS<\/span><span style=\"color: #444444; background-color: #ffffff;\"> (0x13), length: 1 byte: 0x00<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">1 packets captured<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">2 packets received by filter<\/span><\/em><br \/>\n<em><span style=\"color: #444444; background-color: #ffffff;\">0 packets dropped by kernel<br \/>\n<\/span><\/em><br \/>\n<span style=\"color: #444444; background-color: #ffffff;\">root@ansible:~ #<\/span><\/p>\n<p>Written by Nick Tailor<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Okay if you have ever worked in a place where their network was complete choas with no documentation or network maps to help you figure out where something resides. You can sometimes use tcpdump to help you figure out where the server is sitting by using tcpdump. Syntax tcpdump -nn -v -i &lt;NIC_INTERFACE&gt; -s 1500 -c 1 &#8216;ether[20:2] == 0x2000&#8217;<a href=\"https:\/\/nicktailor.com\/tech-blog\/how-to-figure-out-switch-and-port-via-tcpdump\/\" class=\"read-more\">Read More &#8230;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[138,124],"tags":[],"class_list":["post-1042","post","type-post","status-publish","format-standard","hentry","category-linux","category-network-stuff"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=1042"}],"version-history":[{"count":3,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1042\/revisions"}],"predecessor-version":[{"id":1595,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/1042\/revisions\/1595"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=1042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=1042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=1042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}