How to use the command tcpick (with examples)

The tcpick command is a packet sniffing and network traffic analysis tool. It allows users to capture and display TCP connections and data. It can also be used to monitor network traffic on a specific interface, host, or port. This article will provide examples of various use cases of the tcpick command.

Use case 1: Capture traffic on a specific interface, port, and host

Code:

sudo tcpick -i interface -C -h host -p port

Motivation:

This use case is useful when you want to capture and analyze network traffic on a specific interface, port, and host. For example, if you suspect there is unusual network activity on a specific interface, such as eth0, and want to monitor the traffic to a specific host and port, tcpick can help you do that.

Explanation:

• sudo: This command is used to run tcpick with administrative privileges. It is necessary to capture network traffic.
• tcpick: The command itself.
• -i interface: Specifies the interface to capture traffic from. Replace “interface” with the name of the interface you want to monitor, such as eth0 or wlan0.
• -C: This option enables color output, making it easier to distinguish different types of network packets.
• -h host: Specifies the host you want to capture traffic to/from. Replace “host” with the IP address or hostname you want to monitor.
• -p port: Specifies the port number you want to capture traffic to/from. Replace “port” with the desired port number.

Example output:

Capturing on interface eth0
Displaying TCP connections and data
Monitoring traffic to/from host 192.168.1.100, port 80

Use case 2: Capture traffic on port 80 (HTTP) of a specific host

Code:

sudo tcpick -i eth0 -C -h 192.168.1.100 -p 80

Motivation:

This use case is useful when you want to capture and analyze network traffic on a specific port of a host. For example, if you suspect there is suspicious HTTP traffic to a particular host, tcpick can help you monitor the traffic on port 80.

Explanation:

• sudo: This command is used to run tcpick with administrative privileges. It is necessary to capture network traffic.
• tcpick: The command itself.
• -i eth0: Specifies the interface to capture traffic from. In this example, we are using eth0.
• -C: This option enables color output, making it easier to distinguish different types of network packets.
• -h 192.168.1.100: Specifies the host you want to capture traffic to/from. Replace “192.168.1.100” with the IP address or hostname you want to monitor.
• -p 80: Specifies the port number you want to capture traffic to/from. In this example, we are using port 80 for HTTP traffic.

Example output:

Capturing on interface eth0
Displaying TCP connections and data
Monitoring traffic to/from host 192.168.1.100, port 80

Use case 3: Display help

Code:

tcpick --help

Motivation:

This use case is useful when you want to quickly access the help documentation for tcpick. The help information provides an overview of the available options and their usage.

Explanation:

• tcpick: The command itself.
• --help: This option displays the help information for tcpick. It provides a brief description of the command, its usage, and available options.

Example output:

tcpick version 0.2.1.11
tcpick -h
print_box | v | command: tcpick
print_box |   | version: 0.2.1.11
print_box |
print_box | v | usage: tcpick [options]
print_box |
print_box | v | options:
print_box |   |   -r|--print-data   print packet data (no protocol decode)
print_box |   |   -d|--rdecode  print packet data protocol decode
print_box |   |   --decode-script=PATH  script file to decode packets
print_box |   |   --save=DIR  save all packets within a session in the DIR directory
print_box |   |   --ascii  translate ip/tcp/udp packet to ascii
...

Conclusion:

The tcpick command is a powerful tool for capturing and analyzing TCP connections and data. It provides various options to capture and monitor network traffic on specific interfaces, hosts, and ports. The examples provided in this article demonstrate how tcpick can be used to capture traffic on specific interfaces, hosts, and ports, as well as display the help information.