How to use the command ipsumdump (with examples)

The ipsumdump command is used to summarize TCP/IP dumps into a human and machine-readable ASCII format. It provides detailed information about packets in a pcap file or read from a network interface. This article will explore three different use cases of the command with examples.

Use case 1: Print the source and destination IP addresses

Code:

ipsumdump --src --dst path/to/file.pcap

Motivation: This use case is useful when we need to analyze the source and destination IP addresses of packets in a pcap file. It can help in network analysis, troubleshooting, or monitoring.

Explanation:

• --src flag: This flag prints the source IP addresses of the packets.
• --dst flag: This flag prints the destination IP addresses of the packets.
• path/to/file.pcap: This is the path to the pcap file we want to analyze.

Example output:

Source IP: 192.168.0.10
Destination IP: 172.16.0.5
Source IP: 192.168.0.20
Destination IP: 10.0.0.2
...

Use case 2: Print timestamps, source address, source port, destination address, destination port, and protocol

Code:

ipsumdump --interface eth0 -tsSdDp

Motivation: This use case is helpful when we want to analyze real-time network traffic on a specific network interface. It provides detailed information about each packet, including timestamps, source, and destination addresses and ports, and the protocol used.

Explanation:

• --interface eth0: This specifies the network interface to capture packets from.
• -tsSdDp: These options are used to specify the information to be printed for each packet. t is for timestamp, s for source address, S for source port, d for destination address, D for destination port, and p for the protocol.

Example output:

Timestamp: 2022-01-01 10:00:01.123456
Source IP: 192.168.0.10
Source Port: 12345
Destination IP: 172.16.0.5
Destination Port: 80
Protocol: TCP

Timestamp: 2022-01-01 10:00:02.987654
Source IP: 192.168.0.20
Source Port: 54321
Destination IP: 10.0.0.2
Destination Port: 443
Protocol: HTTPS
...

Use case 3: Print anonymised source address, anonymised destination address, and IP packet length

Code:

ipsumdump --src --dst --length --anonymize path/to/file.pcap

Motivation: This use case is useful when we want to analyze packet information while maintaining privacy. Anonymizing the source and destination IP addresses can be beneficial in scenarios where data confidentiality is required.

Explanation:

• --src flag: This flag prints the anonymized source IP addresses.
• --dst flag: This flag prints the anonymized destination IP addresses.
• --length flag: This flag prints the IP packet length.
• --anonymize flag: This flag anonymizes the IP addresses.
• path/to/file.pcap: This is the path to the pcap file we want to analyze.

Example output:

Anonymized Source IP: 192.168.0.1
Anonymized Destination IP: 172.16.0.1
IP Packet Length: 500
Anonymized Source IP: 192.168.0.2
Anonymized Destination IP: 172.16.0.2
IP Packet Length: 200
...

Conclusion:

The ipsumdump command is a powerful tool for analyzing TCP/IP dumps. By providing various options and flags, it allows users to extract specific information from pcap files or network interfaces. The three use cases discussed in this article demonstrate its versatility in printing different aspects of packet data. Whether it’s analyzing IP addresses, ports, timestamps, or packet length, ipsumdump can be a valuable addition to a network analyst’s toolkit.