How to use the command 'ipsumdump' (with examples)

Ipsumdump is a command-line tool that provides a streamlined, human, and machine-readable ASCII summary of network traffic, primarily from TCP/IP packet data. This utility is particularly useful for network administrators and cybersecurity professionals who analyze network traffic for troubleshooting or security monitoring. By extracting and presenting specific pieces of information from packet capture (PCAP) files, ipsumdump allows for quick and easy inspection of network data, aiding in various network analysis tasks.

Use case 1: Print the source and destination IP addresses of all packets in a PCAP file

Code:

ipsumdump --src --dst path/to/file.pcap

Motivation:

When analyzing network traffic, it is often crucial to determine the communication pattern between different hosts. By extracting only the source and destination IP addresses from a PCAP file, you can quickly identify which nodes are communicating within the network. This is particularly helpful in identifying patterns of network traffic, discovering potential sources of anomalies, and understanding network behavior without diving into the complete packet details.

Explanation:

• --src: This option instructs ipsumdump to include the source IP address of each packet in the output. The source IP address indicates the origin of the packet.

• --dst: This option specifies that the destination IP address of each packet should be included in the output. The destination IP address indicates where the packet is headed.

• path/to/file.pcap: This argument specifies the path to the PCAP file that contains the packet data to be analyzed. The PCAP file is often generated or captured using packet sniffing tools like tcpdump or Wireshark.

Example Output:

192.168.0.5 -> 93.184.216.34
10.0.0.1 -> 151.101.129.69
192.168.0.8 -> 172.217.14.238

Each line represents a packet, showing the source IP address on the left and the destination IP address on the right, separated by ->.

Use case 2: Print the timestamps, source address, source port, destination address, destination port, and protocol of all packets read from a given network interface

Code:

ipsumdump --interface eth0 -tsSdDp

Motivation:

Real-time monitoring of network traffic can be crucial for maintaining network health and security. By capturing packets directly from a network interface with timestamps, source and destination addresses, ports, and protocols, you can get a comprehensive view of ongoing data exchanges. This use case is particularly valuable for diagnosing network issues, monitoring live traffic for unauthorized access or data flows, and understanding traffic patterns in real time.

Explanation:

• --interface eth0: This option specifies that ipsumdump should capture packets from the network interface named eth0. Interfaces vary between systems, and eth0 is a common default identifier for a network adapter in Linux environments, though it might differ based on your configuration.

• -t: This flag adds a timestamp to the output for each packet, showing the time at which the packet was captured. Timestamps are essential for time-based analysis and correlation of events.

• -s: This flag includes the source IP address in the output, indicating where the packet originated.

• -S: This flag includes the source port number, useful for identifying the service or application layer port from which the traffic was sent.

• -d: This flag inserts the destination IP address in the output, indicating where the packet is headed.

• -D: This flag includes the destination port number, useful for identifying the service or application layer port that is the target of the packet.

• -p: This flag appends the protocol used to the output, such as TCP, UDP, or ICMP, providing context on the type of communication being carried out.

Example Output:

1622540402.485000 192.168.0.10:46758 -> 93.184.216.34:80 TCP
1622540403.120000 192.168.0.11:22 -> 10.0.0.2:8080 TCP
1622540403.567000 172.217.4.206:443 -> 192.168.0.2:53155 TCP

This output shows each packet’s capture timestamp, source IP and port, destination IP and port, and the protocol used.

Use case 3: Print the anonymised source address, anonymised destination address, and IP packet length of all packets in a PCAP file

Code:

ipsumdump --src --dst --length --anonymize path/to/file.pcap

Motivation:

In many scenarios, especially when sharing network data for analysis or research outside the organization, it is essential to protect sensitive information such as IP addresses. Anonymization ensures that such data remains confidential while still allowing for pattern analysis or data trend observation. Displaying packet lengths in conjunction with anonymized addresses allows analysts to gain insights into data flow without compromising security.

Explanation:

• --src: This specifies that the source IP address should be included in the output. However, in conjunction with --anonymize, these addresses will be anonymized.

• --dst: This specifies that the destination IP address should be included in the output, and it will also be anonymized.

• --length: This adds the IP packet length to the output, which is useful for understanding the size of data being transferred, helping in bandwidth usage analysis or spotting unusually large packets that may indicate a data exfiltration attempt.

• --anonymize: This option ensures that IP addresses are anonymized. Instead of displaying actual IP addresses, they are replaced with abstract identifiers while maintaining unique but non-revealing representations.

• path/to/file.pcap: The path to the PCAP file to analyze, containing the packet data.

Example Output:

[ANON] -> [ANON] 1500
[ANON] -> [ANON] 60
[ANON] -> [ANON] 1080

In this anonymized output, [ANON] represents the anonymized addresses, and numbers represent the packet lengths.

Conclusion:

Ipsumdump is a versatile tool that simplifies the analysis of network traffic by providing readable summaries of packet data. Whether examining communication patterns, monitoring live traffic, or ensuring data privacy through anonymization, ipsumdump offers essential functionalities and easy access to critical network information. Using it effectively can enhance network monitoring and analysis endeavors, making it a valuable asset in any network administrator or cybersecurity professional’s toolkit.