Capturing from any linux

Linux cooked-mode capture (SLL)

This is the pseudo-protocol used by libpcap on Linux to capture from the «any» device and to capture on some devices where the native link layer header isn’t available or can’t be used. (For example, the Linux PPP code doesn’t reliably supply a PPP header to libpcap — it’s usually either absent, meaning that the packet type isn’t available, or contains extra random gunk in some but not all packets, as happens on some PPP-over-ISDN interfaces — so the SLL pseudo-link-layer is used on PPP interfaces. It’s used on the «any» device because not all interfaces on a machine necessarily have the same link-layer type, but, in order for capture filters to work, all packets on an interface must have the same type of link-layer header.)

When capturing from the «any» device, or from one of those other devices, in Linux, the libpcap doesn’t supply the link-layer header for the real «hardware protocol» like Ethernet, but instead supplies a fake link-layer header for this pseudo-protocol.

(For those who are curious, «SLL» stands for «sockaddr_ll»; capturing in «cooked mode» is done by reading from a PF_PACKET/SOCK_DGRAM socket rather than the PF_PACKET/SOCK_RAW socket normally used for capturing. Using SOCK_DGRAM rather than SOCK_RAW means that the Linux socket code doesn’t supply the packet’s link-layer header. This means that information such as the link-layer protocol’s packet type field, if any, isn’t available, so libpcap constructs a synthetic link-layer header from the address supplied when it does a recvfrom() on the socket. On PF_PACKET sockets, that address is of type sockaddr_ll, where «ll» presumably stands for «link layer»; the fields in that structure begin with sll_. See the packet(7) man page on a Linux system for more details.)

History

XXX — add a brief description of SLL history

Protocol dependencies

• This is a pseudo protocol, so there’s no lower layer (the next upper layer will be IP for example)

Example traffic

Screen shot of a SLL frame from SampleCaptures file: sll.pcap

Wireshark

The SLL dissector is fully functional.

Preference Settings

There are no SLL specific preference settings.

Example capture file

XXX — Add a simple example capture file to the SampleCaptures page and link from here (see below). Keep this file short, it’s also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically.

Display Filter

A complete list of SLL display filter fields can be found in the display filter reference

Show only the SLL-based traffic:

Capture Filter

You cannot directly filter SLL protocols while capturing; if you’re capturing on the «any» device or on any network interface where libpcap uses cooked mode, all traffic is SLL traffic.

External links

Discussion

SLL (последним исправлял пользователь GuyHarris 2020-01-04 09:26:46)

Источник

Top 8 Best Screen Capture Tools for Linux

Liza Brown

Sep 13, 2021• Proven solutions

A picture is worth a thousand words. That’s so true when you want to show somebody how to do something. While it is easy to capture the screen on your iPhone or Android phone, even in Windows and Mac which each of them provides a built-in screen capture feature. For Linux users, taking a shot of your screen on Ubuntu Linux does not need to be a complicated task too.

Though there are many screen capture tools for Linux available on the market, to make things easier, consider the top 8 screen capture tools for Linux mentioned below. These are eight of the best tools that are excellent when it comes to user-friendliness, allowing you to take screenshots or record screen in a snap.

Some of these tools are only used to capture screenshots and edit the captured images, while some also allow you to capture the whole activity on your screen, namely, record whatever happening on your Linux screen. Hope it is helpful for you to find the best screen capture tool based on your needs.

In case that you want to record the screen activity including gaming play video and the webcam video on your Windows PC or Mac computer, you can try one of the best recording software: Wondershare Filmora below:

Top 8 Best Linux Screen Capture Tools [Taking Screenshots & Recording Desktop Screen]

1. Shutter

If you are looking for an easy to use screen capture tool for Linux, Shutter is one of the most popular option that should not be missed. It will allow you to capture the entire screen or just a portion of it. One thing that most people enjoyed is how you can immediately edit the images that have been captured. You can highlight specific parts of the captured images and leave important notes. This is unlike in the case of other screen capture tools where you will be required to use an external tool for editing images. It also has an integrated feature that will allow you to easily share the captured and edited images, such as in online forums. Even if it is your first time using this screen shot tool, you will not experience any complication as it is built with the needs of users in mind.

2. Imagemagick

Imagemagick is a free open-source software for displaying, converting and editing images and vector image files with the support of more than 200 image formats. It also comes with the ability to take screenshot on Linux by using a rich set of commands.

With Imagemagick screen capture tool, you can take a screenshot of the entire screen or the currently active window, or take the screenshot of a selected area of the screen.

For the detailed information about how to use Imagemagick, please visit its official website here.

3. Gimp

Gimp is one of the most comprehensive and free image manipulation software available on Linux. It is also a free open source image editor with the ability to edit, resize and retouch images and take screenshots of the whole or fixed area of the screen as well.

Taking screenshot with GIMP is easy, just click Create Screenshot option from the File menu, and then select the area that you want to take a screenshot. After screenshot, you can also apply some effects or edit the image per need.

4. Kazam

Whether it is screenshot or screencast, Kazam will prove to be handy. The video file of the screen recording can be played in VP8/WebM format. Aside from visuals, this tool will also allow users to record an accompanying audio from a compatible source. If you are using Ubuntu, to get this app, you simply have to type “sudo apt-get install kazam”. Kazam is excellent because it offers versatility. If you do not want to record the entire screen, you will have the option to record only a selected area. It is also a good thing that it is a light file that won’t consume too much memory space. However, it does not come without any problem. Many of those who have used such complained about the lack of webcam viewer. It is also not usable in all configurations.

5. GNOME Screenshot

GNOME Screenshot is a default utility which comes along with Ubuntu in GNOME desktop used to taking screenshots or recording the screen activity. It is a powerful screenshot tool to capture the whole screen or a particular area of the screen for Linux. You can use the shortcut keys to take a screenshot and record the screencast or take a screenshot in the GNOME Screenshot GUI.

In the GUI interface, you can choose to grab the whole desktop screenshot, grab the currently active window or select a particular area to grab. You can also set up the effects such as including the pointer or including the windows border and apply some effects.

6. ScreenStudio

This Java-based screen capture application is known for its excellent performance, as well as user-friendly interface. It can be ran on any distribution; you only have to make sure that you have “avconv” installed on your computer. The team behind the creation of this screen casting tool continuously creates improvements for better user experience. You will be able to record in either MP4 or FLV format. The quality and size of the recording can also be easily changed. There is no need to have extensive technical knowledge to make the most out of this application. Adding a text overlay is also possible, making it excellent when it comes to customization. If you are using this application, make sure to frequently check for updates to be provided with an improved way of using such tool.

7. Simple Screen Recorder

As the name implies, it can make screen recording a task that you can easily accomplish. It was created to offer users with a simple app from Linux screen recording. It comes with sensible default settings, which means that there is no need to change any option to enjoy basic screen capture functionality. Through the improvements, however, the simple functionality has been added with more options for customization, making it a more extensive tool. It comes with a QT-based graphical interface, and it is also faster than the performance of ffmpeg/avconv and VLC. It also allows recording the entire screen or a portion of it. Audio synchronization is also possible with this screencast tool. There is an integrated hot key, which can be pressed anytime to pause video recording.

8. Record My Desktop

This is the screen capturing tool that started it all for Linux as this is the first of its kind. While it offers several options for screen recording, one of its significant drawbacks is that there is no option for just taking a screenshot. There is also no included webcam viewer. With this tool, you will have the option to pause and resume video recording. The tool is generally divided into two parts. The first part is a command line tool, which is basically the one that is responsible for capturing and encoding. The second part is an interface that exposes the functionality of the program.

That’s the top 8 best screen capture tools for Linux we have picked in 2018, hope you can achieve your purpose whether it is taking screenshots on Linux or recording desktop screen. In case that you are looking for more best screen recording options, check the best screen recorders for all platforms.

Источник

Используем tcpdump для анализа и перехвата сетевого трафика

Утилита tcpdump — отличный инструмент командной, который способен перехватывать и анализировать сетевой трафик. Может оказаться большим подспорьем при решении сетевых проблем. Пакеты можно сохранить в файл и анализировать позже. Рекомендуется время от времени запускать эту утилиту, чтобы следить за своей сетью.

• Вывод tcpdump
• Установка tcpdump
• Опции tcpdump
• Фильтры tcpdump:
  • Фильтр выражений
  • Фильтр портов
  • Фильтр хостов
  • Комбинирование фильтров
• Сохранение заголовков в файл
• Просмотр сведений о пакете
• Вывод

Вывод tcpdump

Утилита tcpdump позволяет проверять заголовки пакетов TCP/IP и выводить одну строку для каждого из пакетов. Она будет делать это до тех пор, пока не нажать Ctrl + C.

Давайте рассмотрим одну строку из примера вывода:

Каждая строка включает:

• Метка времени Unix (20: 58: 26.765637)
• протокол (IP)
• имя или IP-адрес исходного хоста и номер порта (10.0.0.50.80)
• имя хоста или IP-адрес назначения и номер порта (10.0.0.1.53181)
• Флаги TCP (Flags [F.]). Указывают на состояние соединения и могут содержать более одного значения:
  • o S — SYN. Первый шаг в установлении соединения
  • F — FIN. Прекращение соединения
  • — ACK. Пакет подтверждения принят успешно
  • P — PUSH. Указывает получателю обрабатывать пакеты вместо их буферизации
  • R — RST. Связь прервалась
• Порядковый номер данных в пакете. (seq 1)
• Номер подтверждения. (ack 2)
• Размер окна (win 453). Количество байтов, доступных в приемном буфере. Далее следуют параметры TCP
• Длина полезной нагрузки данных. (length 0)

Установка tcpdump

В дистрибутивах на основе Debian tcpdump можно установить с помощью команды APT:

В дистрибутивах на основе RPM tcpdump можно установить с помощью YUM:

В RHEL 8 с использование DNF:

Опции tcpdump

Запускать tcpdump нужно с правами root. Tcpdump включает в себя множество опций и фильтров. При запуске tcpdump без каких-либо параметров произойдет перехват всех пакетов, проходящих через интерфейс по умолчанию.

Вывести список доступных системе сетевых интерфейсов, в которых tcpdump может захватывать пакеты:

Очень полезно для систем, в которых нет команды для вывода списка интерфейсов.

Для захвата пакетов, проходящих через определенный интерфейс, используйте -i с именем интерфейса. Если не указать имя, тогда tcpdump подберет первый обнаруженный сетевой интерфейс.

• -v увеличивает количество отображаемой информации о пакетах
• -vv дает еще более подробную информацию

По умолчанию tcpdump преобразует IP-адреса в имена хостов, а также использует имена служб вместо номеров портов.

• -n Если DNS не работает или вы не хотите, чтобы tcpdump выполнял поиск имени.

• -c захватывает только набор строк, например, 5:

• -tttt для использования более удобных временных меток (по умолчанию используются временные метки Unix)

Фильтры tcpdump

Фильтр выражений

Фильтр выражений выбирает, какие заголовки пакетов будут отображаться. Если фильтры не применяются, отображаются все заголовки пакетов.

Самые распространенные фильтры :

Фильтр портов

Фильт портов используется для просмотра пакетов, поступающих на определенный порт:

Фильтр хостов

Для перехвата пакетов, приходящих или исходящих от определенного хоста. Например, IP-адрес 10.0.2.15:

Для перехвата пакетов определенных типов протоколов. Например, icmp, на интерфейсе eth1:

Комбинирование фильтров

Фильтры можно комбинировать с помощью операторов:

Это позволит писать команды, которые могут более точно изолировать пакеты. Например, пакеты с определенного IP-адреса и для определенного порта:

Если нужно перехватить все пакеты кроме ICMP, используем оператор NOT:

Сохранение заголовков в файл

Вывод tcpdump может довольно быстро перемещаться по экрану. В таких случаях можно сохранить заголовки пакетов в файле с опцией -w. Вывод сохраняется в файлы с расширением .pcap.

Следующая команда сохраняет 10 строк вывода интерфейса eth1 в icmp.pcap.

Прочитать этот файл можно с помощью опции -r

Просмотр сведений о пакете

Пока мы видели только заголовки пакетов, а для просмотра содержимого нужно использовать параметр -A. Вывод содержимого будет в формате ASCII.

С помощью опции -X можно отобразить вывод в шестнадцатеричном формате, правда, это не сильно помогает в тех случаях, когда соединение зашифровано.

Вывод

Утилита tcpdump проста в настройке и освоении. Необходимо лишь немного разобраться с:

После чего tcpdump станет отличным помощником в вопросах обеспечения безопасности вашей сети.

Источник