LABORATORY / WORK_2 / отчёт_Козырев

15.

sudo -tcpdump -lvvnnSXX -c 2 -l | tee out.log ((src host 172.16.100.21 and dst host 172.16.100.88) or (src host 172.16.100.88 and dst host 172.16.100.21)) and (tcp[tcpflags] and (tcp-psh or tcp-psh,ack)) and (tcp and src port < 1024) and (portrange 49000-65535) and (less 200)

11:46:56.182153 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.100.28 tell 172.16.100.39, length 46
	0x0000:  ffff ffff ffff d027 88cf e15b 0806 0001  .......'...[....
	0x0010:  0800 0604 0001 d027 88cf e15b ac10 6427  .......'...[..d'
	0x0020:  0000 0000 0000 ac10 641c 0000 0000 0000  ........d.......
	0x0030:  0000 0000 0000 0000 0000 0000            ............
11:46:56.438058 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.100.29 tell 172.16.100.39, length 46
	0x0000:  ffff ffff ffff d027 88cf e15b 0806 0001  .......'...[....
	0x0010:  0800 0604 0001 d027 88cf e15b ac10 6427  .......'...[..d'
	0x0020:  0000 0000 0000 ac10 641d 0000 0000 0000  ........d.......
	0x0030:  0000 0000 0000 0000 0000 0000            ............
11:46:56.694059 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.16.100.32 tell 172.16.100.39, length 46
	0x0000:  ffff ffff ffff d027 88cf e15b 0806 0001  .......'...[....
	0x0010:  0800 0604 0001 d027 88cf e15b ac10 6427  .......'...[..d'
	0x0020:  0000 0000 0000 ac10 6420 0000 0000 0000  ........d.......
	0x0030:  0000 0000 0000 0000 0000 0000            ............
11:46:56.720788 STP 802.1d, Config, Flags [none], bridge-id 8070.00:22:91:ce:85:80.8023, length 43
	message-age 6.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s
	root-id 8000.00:0a:04:ce:56:c0, root-pathcost 33
	0x0000:  0180 c200 0000 0022 91ce 85a3 0026 4242  .......".....&BB
	0x0010:  0300 0000 0000 8000 000a 04ce 56c0 0000  ............V...
	0x0020:  0021 8070 0022 91ce 8580 8023 0600 1400  .!.p.".....#....
	0x0030:  0200 0f00 0000 0000 0000 0000            ............
11:46:56.797477 IP (tos 0x0, ttl 64, id 22343, offset 0, flags [DF], proto TCP (6), length 62)
    172.16.100.39.40512 > 172.16.100.21.11100: Flags [P.], cksum 0x69cc (correct), seq 3167979898:3167979908, ack 2082545181, win 14300, options [nop,nop,TS val 2957816793 ecr 3250687], length 10
	0x0000:  d027 88cf e290 d027 88cf e15b 0800 4500  .'.....'...[..E.
	0x0010:  003e 5747 4000 4006 c315 ac10 6427 ac10  .>WG@.@.....d'..
	0x0020:  6415 9e40 2b5c bcd3 897a 7c21 1e1d 8018  d..@+\...z|!....
	0x0030:  37dc 69cc 0000 0101 080a b04c b3d9 0031  7.i........L...1
	0x0040:  99ff 0301 0000 0000 05a0 0384            ............
11:46:56.797549 IP (tos 0x0, ttl 64, id 22344, offset 0, flags [DF], proto TCP (6), length 53)
    172.16.100.39.40512 > 172.16.100.21.11100: Flags [P.], cksum 0x4cef (correct), seq 3167979908:3167979909, ack 2082545181, win 14300, options [nop,nop,TS val 2957816794 ecr 3250687], length 1
	0x0000:  d027 88cf e290 d027 88cf e15b 0800 4500  .'.....'...[..E.
	0x0010:  0035 5748 4000 4006 c31d ac10 6427 ac10  .5WH@.@.....d'..
	0x0020:  6415 9e40 2b5c bcd3 8984 7c21 1e1d 8018  d..@+\....|!....
	0x0030:  37dc 4cef 0000 0101 080a b04c b3da 0031  7.L........L...1
	0x0040:  99ff 29                                  ..)
11:46:56.797571 IP (tos 0x0, ttl 64, id 22345, offset 0, flags [DF], proto TCP (6), length 56)
    172.16.100.39.40512 > 172.16.100.21.11100: Flags [P.], cksum 0x75c4 (correct), seq 3167979909:3167979913, ack 2082545181, win 14300, options [nop,nop,TS val 2957816794 ecr 3250687], length 4
	0x0000:  d027 88cf e290 d027 88cf e15b 0800 4500  .'.....'...[..E.
	0x0010:  0038 5749 4000 4006 c319 ac10 6427 ac10  .8WI@.@.....d'..
	0x0020:  6415 9e40 2b5c bcd3 8985 7c21 1e1d 8018  d..@+\....|!....
	0x0030:  37dc 75c4 0000 0101 080a b04c b3da 0031  7.u........L...1
	0x0040:  99ff 0000 0027                           .....'
11:46:56.797597 IP (tos 0x0, ttl 64, id 17225, offset 0, flags [DF], proto TCP (6), length 52)
    172.16.100.21.11100 > 172.16.100.39.40512: Flags [.], cksum 0xa8fd (correct), seq 2082545181, ack 3167979913, win 235, options [nop,nop,TS val 3251687 ecr 2957816793], length 0
	0x0000:  d027 88cf e15b d027 88cf e290 0800 4500  .'...[.'......E.
	0x0010:  0034 4349 4000 4006 d71d ac10 6415 ac10  .4CI@.@.....d...
	0x0020:  6427 2b5c 9e40 7c21 1e1d bcd3 8989 8010  d'+\.@|!........
	0x0030:  00eb a8fd 0000 0101 080a 0031 9de7 b04c  ...........1...L
	0x0040:  b3d9                                     ..
11:46:56.797699 IP (tos 0x0, ttl 64, id 22346, offset 0, flags [DF], proto TCP (6), length 91)
    172.16.100.39.40512 > 172.16.100.21.11100: Flags [P.], cksum 0x7cee (correct), seq 3167979913:3167979952, ack 2082545181, win 14300, options [nop,nop,TS val 2957816794 ecr 3250687], length 39
	0x0000:  d027 88cf e290 d027 88cf e15b 0800 4500  .'.....'...[..E.
	0x0010:  005b 574a 4000 4006 c2f5 ac10 6427 ac10  .[WJ@.@.....d'..
	0x0020:  6415 9e40 2b5c bcd3 8989 7c21 1e1d 8018  d..@+\....|!....
	0x0030:  37dc 7cee 0000 0101 080a b04c b3da 0031  7.|........L...1
	0x0040:  99ff 0000 001e 00a0 a96f ba42 5d41 4aaa  .........o.B]AJ.
	0x0050:  f435 2b76 d7c4 f300 0000 0200 0000 0000  .5+v............
	0x0060:  0000 0008 0000 0000 00                   .........
11:46:56.797849 IP (tos 0x0, ttl 64, id 17226, offset 0, flags [DF], proto TCP (6), length 191)
    172.16.100.21.11100 > 172.16.100.39.40512: Flags [P.], cksum 0xa2ff (correct), seq 2082545181:2082545320, ack 3167979952, win 235, options [nop,nop,TS val 3251688 ecr 2957816794], length 139
	0x0000:  d027 88cf e15b d027 88cf e290 0800 4500  .'...[.'......E.
	0x0010:  00bf 434a 4000 4006 d691 ac10 6415 ac10  ..CJ@.@.....d...
	0x0020:  6427 2b5c 9e40 7c21 1e1d bcd3 89b0 8018  d'+\.@|!........
	0x0030:  00eb a2ff 0000 0101 080a 0031 9de8 b04c  ...........1...L
	0x0040:  b3da 2900 0000 8600 0000 1e00 a0a9 6fba  ..)...........o.
	0x0050:  425d 414a aaf4 352b 76d7 c4f3 0000 0002  B]AJ..5+v.......
	0x0060:  0000 0000 0000 0000 0800 0000 0001 0000  ................
	0x0070:  0002 0030 0000 000b 0000 0000 0100 0000  ...0............
	0x0080:  4c00 7b00 3800 6500 3900 3900 3700 6400  L.{.8.e.9.9.7.d.
	0x0090:  3800 3400 2d00 6500 6200 6200 3900 2d00  8.4.-.e.b.b.9.-.
	0x00a0:  3400 3300 3000 6600 2d00 3800 6600 3700  4.3.0.f.-.8.f.7.
	0x00b0:  3200 2d00 6400 3400 3500 6400 3900 3800  2.-.d.4.5.d.9.8.
	0x00c0:  3200 3100 3900 3600 3300 6400 7d         2.1.9.6.3.d.}

5.

sudo -tcpdump -lvnnSXX -c 2 -l | tee out.log ((src host 172.16.100.31 & dst host 172.16.100.88) || (src host 172.16.100.88 & dst host 172.16.100.31)) & (tcp[tcpflags] & tcp-syn !=0)

14:16:26.726275 IP (tos 0x0, ttl 64, id 25663, offset 0, flags [DF], proto TCP (6), length 53)
    172.16.100.39.53010 > 172.16.100.31.11100: Flags [P.], cksum 0x50be (correct), seq 3520795709:3520795710, ack 308526919, win 21157, options [nop,nop,TS val 769081278 ecr 3115495534], length 1
	0x0000:  d027 88cf e14b d027 88cf e15b 0800 4500  .'...K.'...[..E.
	0x0010:  0035 643f 4000 4006 b61c ac10 6427 ac10  .5d?@.@.....d'..
	0x0020:  641f cf12 2b5c d1db 143d 1263 bf47 8018  d...+\...=.c.G..
	0x0030:  52a5 50be 0000 0101 080a 2dd7 3fbe b9b2  R.P.......-.?...
	0x0040:  b06e 29                                  .n)
14:16:26.726394 IP (tos 0x0, ttl 64, id 25664, offset 0, flags [DF], proto TCP (6), length 95)
    172.16.100.39.53010 > 172.16.100.31.11100: Flags [P.], cksum 0x8096 (correct), seq 3520795710:3520795753, ack 308526919, win 21157, options [nop,nop,TS val 769081278 ecr 3115495534], length 43
	0x0000:  d027 88cf e14b d027 88cf e15b 0800 4500  .'...K.'...[..E.
	0x0010:  005f 6440 4000 4006 b5f1 ac10 6427 ac10  ._d@@.@.....d'..
	0x0020:  641f cf12 2b5c d1db 143e 1263 bf47 8018  d...+\...>.c.G..
	0x0030:  52a5 8096 0000 0101 080a 2dd7 3fbe b9b2  R.........-.?...
	0x0040:  b06e 0000 0027 0000 001e 00a0 a96f ba42  .n...'.......o.B
	0x0050:  5d41 4aaa f435 2b76 d7c4 f300 0000 0200  ]AJ..5+v........
	0x0060:  0000 0000 0000 0008 0000 0000 00         .............