tcpdump, BPF Filters, eBPF & TCP Stack Deep Dive

Byte 0:   Version (4 bits) | IHL (4 bits)
Byte 1:   TOS = DSCP (6 bits) | ECN (2 bits)
Bytes 2-3: Total Length
Bytes 4-5: Identification
Byte 6:   IP Flags (3 bits) | Fragment Offset (13 bits)
Byte 7:   (fragment offset continued — use 6:2 mask 0x1FFF)
Byte 8:   TTL
Byte 9:   Protocol  (6=TCP, 17=UDP, 1=ICMP, 47=GRE)
Bytes 10-11: Header Checksum
Bytes 12-15: Source Address
Bytes 16-19: Destination Address
Bytes 20+:  Options (if IHL > 5)

bits 7-2 = DSCP (6 bits)
bits 1-0 = ECN  (2 bits)
  00 = Not ECN-Capable Transport (Non-ECT)
  01 = ECN Capable Transport (ECT(1))
  10 = ECN Capable Transport (ECT(0))
  11 = Congestion Experienced (CE)

Bit 7 (0x80) = Reserved (must be 0)
Bit 6 (0x40) = DF  (Don't Fragment)
Bit 5 (0x20) = MF  (More Fragments)

Bytes 0-3:  Version (4b) | Traffic Class (8b) | Flow Label (20b)
Bytes 4-5:  Payload Length
Byte 6:     Next Header  (same protocol numbers as IPv4 Protocol field)
Byte 7:     Hop Limit
Bytes 8-23: Source Address (128-bit)
Bytes 24-39: Destination Address (128-bit)

Bytes 0-1:  Source Port
Bytes 2-3:  Destination Port
Bytes 4-7:  Sequence Number
Bytes 8-11: Acknowledgment Number
Byte 12:    Data Offset (4b) | Reserved (3b) | NS flag (1b)
Byte 13:    TCP Flags: CWR | ECE | URG | ACK | PSH | RST | SYN | FIN
Bytes 14-15: Window Size
Bytes 16-17: Checksum
Bytes 18-19: Urgent Pointer
Bytes 20+:  Options

Bit 7 (0x80) = CWR  (Congestion Window Reduced)
Bit 6 (0x40) = ECE  (ECN-Echo)
Bit 5 (0x20) = URG
Bit 4 (0x10) = ACK
Bit 3 (0x08) = PSH
Bit 2 (0x04) = RST
Bit 1 (0x02) = SYN
Bit 0 (0x01) = FIN

Bytes 0-1: Source Port
Bytes 2-3: Destination Port
Bytes 4-5: Length
Bytes 6-7: Checksum

Byte 0:   Type
Byte 1:   Code
Bytes 2-3: Checksum
Bytes 4-7: Type-specific (e.g., ID + Sequence for Echo)

Bytes 0-5:  Destination MAC
Bytes 6-11: Source MAC
Bytes 12-13: EtherType (0x0800=IPv4, 0x0806=ARP, 0x86DD=IPv6, 0x8100=802.1Q)
Bytes 14+:  Payload

Bytes 12-13: 0x8100 (TPID)
Bytes 14-15: PCP (3b) | DEI (1b) | VLAN ID (12b)
Bytes 16-17: EtherType (0x0800 for IPv4)
Bytes 18+:   Payload (so IP header starts at ether[18])

# Source/destination IP
src host 192.168.1.1
dst host 192.168.2.2
host 1.1.1.1              # either direction

# Protocol field (byte 9)
ip[9]=6                   # TCP
ip[9]=17                  # UDP
ip[9]=1                   # ICMP
ip[9]=47                  # GRE

# TTL (byte 8)
ip[8]=255                 # TTL=255 (often Cisco routers)
ip[8]=64                  # TTL=64 (Linux default)

# DF flag (Don't Fragment) — byte 6 upper bits
ip[6] & 0x40 = 0x40       # DF set
ip[6] & 0x20 = 0x20       # MF set (fragmented packet, not last)
ip[6] & 0x80 = 0x00       # Reserved bit clear (should always be)

# Fragment offset — bytes 6-7, lower 13 bits
ip[6:2] & 0x1FFF != 0     # non-zero fragment offset (not first fragment)

# Total length (bytes 2-3)
ip[2:2] = 123             # specific total length

# Identification field (bytes 4-5)
ip[4:2] = 0x3805          # specific identification value

# Header checksum (bytes 10-11)
ip[10:2] = 0x4051

# DSCP — byte 1 upper 6 bits (& 0xFC)
ip[1] & 0xfc = 0x00       # CS0 (default, best effort)
ip[1] & 0xfc = 0x28       # CS2 (0x10 << 2 = 0x28... actually DSCP 10 = 0x28)
ip[1] & 0xfc = 0xb8       # EF (Expedited Forwarding, decimal 46 << 2 = 0xb8)

# ECN — byte 1 lower 2 bits
ip[1] & 0x03 = 0x01       # ECT(1)
ip[1] & 0x03 = 0x02       # ECT(0)
ip[1] & 0x03 = 0x03       # CE (Congestion Experienced)
ip[1] & 0x03 = 0x00       # Non-ECT

# Port filters (preferred high-level syntax)
tcp port 443
tcp dst port 22
tcp src port 1024

# SYN packets only
tcp[13] = 2               # SYN (no ACK)
tcp[13] & 0x02 = 0x02     # SYN bit set (matches SYN and SYN+ACK)

# SYN+ACK
tcp[13] = 18              # 0x12 = SYN+ACK

# RST
tcp[13] & 0x04 = 0x04     # RST bit set

# FIN
tcp[13] & 0x01 = 0x01     # FIN bit set

# PSH+ACK (data packets)
tcp[13] = 24              # 0x18 = PSH+ACK

# ECN flags in TCP
tcp[13] & 0x40 = 0x40     # ECE (ECN-Echo) set
tcp[13] & 0x80 = 0x80     # CWR (Congestion Window Reduced) set

# SYN with ECN negotiation (SYN+ECE+CWR = 0xC2)
tcp[13] = 0xC2

# SYN+ACK with ECE (server agrees to ECN = 0x52)
tcp[13] = 0x52

# Sequence number (bytes 4-7)
tcp[4:4] = 0              # ISN=0 (might indicate spoofing or test traffic)

# ACK number (bytes 8-11)
tcp[8:4] = 0              # ACK=0 (should be 0 on SYN only)

# Urgent pointer (bytes 18-19)
tcp[18:2] = 0             # Urgent not active

# Data offset = header length in 32-bit words (upper 4 bits of byte 12)
tcp[12] & 0xF0 = 0x50     # 20-byte header (standard, no options)
tcp[12] & 0xF0 = 0x60     # 24-byte header
tcp[12] & 0xF0 = 0x80     # 32-byte header (with full timestamp options)

# Detect port scans: SYN with no other flags
'tcp[13] = 2 and not src net 10.0.0.0/8'

# Detect NULL scan (no flags)
tcp[13] = 0

# Detect XMAS scan (FIN+PSH+URG)
tcp[13] = 0x29

# Source/destination port
udp port 53               # DNS
udp dst port 514          # Syslog
udp src port 123          # NTP

# Raw offset filters (8-byte header, data at offset 8)
udp[0:2] = 123            # source port = 123
udp[2:2] = 443            # destination port = 443
udp[4:2] = 22             # length field = 22

# DNS query (in UDP payload, data at udp[8])
# QR bit = 0 means query, bit 7 of byte 2 of DNS header = udp[10] bit 7
udp[10] & 0x80 = 0x00     # DNS query (QR=0)
udp[10] & 0x80 = 0x80     # DNS response (QR=1)

# DNS opcode (bits 3-6 of byte 2)
udp[10] & 0x78 = 0x00     # standard query
udp[10] & 0x78 = 0x08     # inverse query
udp[10] & 0x78 = 0x10     # server status

# DNS authoritative answer
udp[10] & 0x04 = 0x00     # non-authoritative
udp[11] & 0x80 = 0x80     # recursion available

# Type
icmp[0] = 8               # Echo Request (ping)
icmp[0] = 0               # Echo Reply
icmp[0] = 3               # Destination Unreachable
icmp[0] = 11              # Time Exceeded (TTL expired)

# Type + Code
icmp[0] = 11 and icmp[1] = 0   # TTL exceeded in transit
icmp[0] = 11 and icmp[1] = 1   # Fragment reassembly timeout
icmp[0] = 3 and icmp[1] = 3    # Port Unreachable

# ICMP Echo ID + Sequence
icmp[4:2] = 0x0840        # specific ICMP ID
icmp[6:2] = 0x0002        # sequence number = 2

# EtherType
ether[12:2] = 0x0800      # IPv4
ether[12:2] = 0x0806      # ARP
ether[12:2] = 0x86DD      # IPv6
ether[12:2] = 0x8100      # 802.1Q (VLAN tagged)

# 802.1Q VLAN ID (lower 12 bits of bytes 14-15)
ether[14:2] & 0x0FFF = 101       # VLAN 101

# 802.1Q: PCP priority (upper 3 bits of byte 14)
ether[14] & 0xE0 = 0x00           # priority 0 (best effort)

# Source MAC prefix (first 3 bytes = OUI)
ether[6:2] = 0x10f3 and ether[8] = 0x11  # specific OUI

# Destination MAC prefix
ether[0:2] = 0x10f3 and ether[2] = 0x11

# Inner TCP in GRE (plain GRE, no key/seq)
# Outer IP protocol = GRE (47)
ip[9] = 47

# Inner IPv4 header starts at ip[24] (after 20B outer IP + 4B GRE header)
ip[24] & 0xF0 = 0x40      # inner packet is IPv4

# Inner destination port (inner IP + 20B + TCP port at offset 2)
# inner TCP dst port at ip[46:2]
ip[46:2] = 443             # HTTPS inside GRE
ip[46:2] = 22              # SSH inside GRE

# Inner ICMP type inside GRE
ip[44] = 11                # TTL exceeded inside GRE
ip[45] = 1                 # code 1 (frag reassembly)

# Payload length (bytes 4-5)
ip6[4:2] = 0x0020         # payload = 32 bytes

# Next header (byte 6)
ip6[6] = 0x06             # TCP
ip6[6] = 0x11             # UDP
ip6[6] = 0x3a             # ICMPv6

# Hop limit (byte 7)
ip6[7] = 0x31             # hop limit = 49

# ECN in IPv6 Traffic Class (byte 1, bits 1-0)
ip6[1] & 0x03 = 0x03      # CE (Congestion Experienced)
ip6[1] & 0x03 = 0x00      # Non-ECT

# Inner TCP destination port in IPv6 (TCP header starts at byte 40)
ip6[42:2] = 443            # dst port 443
ip6[44:4] = 0x8b164221     # sequence number

# Catch all SYN packets (new connections) except from our monitoring host
tcpdump -n 'tcp[13] = 2 and not src host 10.0.0.1'

# Catch RST packets (connection resets — useful for detecting port scans)
tcpdump -n 'tcp[13] & 0x04 = 0x04'

# DNS exfiltration: long DNS queries (> 50 bytes of name data)
tcpdump -n 'udp port 53 and udp[4:2] > 60'

# ECN-capable connections
tcpdump -n 'tcp[13] = 0xC2'        # client offering ECN

# Fragmented packets (potential evasion)
tcpdump -n '(ip[6] & 0x20 = 0x20) or (ip[6:2] & 0x1FFF != 0)'

# ICMP tunneling detection (large ICMP packets)
tcpdump -n 'icmp[0] = 8 and ip[2:2] > 100'

# Null/XMAS scan detection
tcpdump -n 'tcp[13] = 0 or tcp[13] = 0x29'

# SYN flood: many SYN, no ACK back
tcpdump -n -c 1000 'tcp[13] = 2' | awk '{print $3}' | sort | uniq -c | sort -rn | head

# DSCP = EF (46 decimal = 0x2e, but shifted left 2 = 0xb8 as full byte value)
ip[1] & 0xfc = 0xb8

# Match any AF4x class (bits 7-4 = 0100 = 0x40, masked & 0xE0)
ip[1] & 0xe0 = 0x80

Client → Server:  SYN, ECE, CWR   (flags 0xC2: I support ECN)
Server → Client:  SYN, ACK, ECE   (flags 0x52: I also support ECN, agreed)
Client → Server:  ACK             (standard ACK, ECN negotiation complete)

# Capture ECN handshake
tcpdump 'tcp[13] = 0xC2 or tcp[13] = 0x52'

1. ECN-capable endpoints set ECT(0) or ECT(1) on IP packets
2. A congested router marks packets with CE (0x11 in ECN bits) instead of dropping
3. The receiver echoes CE back to the sender via ECE flag in TCP ACK
4. The sender reduces its congestion window and sets CWR in the next TCP segment
5. Receiver clears ECE once CWR is seen

# Check current ECN settings
sysctl -a | grep ecn

# Enable ECN
sysctl net.ipv4.tcp_ecn=1          # Enable ECN (request ECN in new connections)
sysctl net.ipv4.tcp_ecn=2          # Only respond to ECN requests (more conservative)
sysctl net.ipv4.tcp_ecn=0          # Disable ECN

# ECN fallback (if ECN negotiation fails, fall back to non-ECN)
sysctl net.ipv4.tcp_ecn_fallback=1

# Verify via sysctl
sysctl net.ipv4.tcp_ecn          # should return 1 if enabled
sysctl net.ipv4.tcp_ecn_fallback # should return 1

# Complete ECN negotiation capture
tcpdump -n 'tcp[13] & 0xC0 != 0'           # any ECN TCP flags (ECE or CWR)

# ECN-capable packets (ECT in IP)
tcpdump -n 'ip[1] & 0x03 != 0'             # ECT(0), ECT(1), or CE

# Congestion events (CE marked by router)
tcpdump -n 'ip[1] & 0x03 = 0x03'           # CE codepoint

# ECN echo (receiver signaling congestion back to sender)
tcpdump -n 'tcp[13] & 0x40 = 0x40'         # ECE bit set

# Congestion window reduced (sender acknowledging)
tcpdump -n 'tcp[13] & 0x80 = 0x80'         # CWR bit set

# Full ECN handshake SYN
tcpdump -n 'tcp[13] = 0xC2'

# Full ECN handshake SYN+ACK
tcpdump -n 'tcp[13] = 0x52'

// Hash map for tracking connections
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, struct ip_port);
    __type(value, u64);
    __uint(max_entries, 65536);
} connection_count SEC(".maps");

// Ring buffer for userspace communication
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 4096 * 1024);
} events SEC(".maps");

SEC("xdp")
int xdp_drop_syn_flood(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_PASS;

    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_PASS;
    if (ip->protocol != IPPROTO_TCP) return XDP_PASS;

    struct tcphdr *tcp = (void *)ip + (ip->ihl * 4);
    if ((void *)(tcp + 1) > data_end) return XDP_PASS;

    // Drop SYN packets from blocked IPs
    if (tcp->syn && !tcp->ack) {
        if (is_blocked(ip->saddr))
            return XDP_DROP;
    }
    return XDP_PASS;
}

sysctl kernel.unprivileged_bpf_disabled=1  # disable unprivileged eBPF
sysctl kernel.unprivileged_userns_clone=0  # disable user namespaces (Debian/Ubuntu)

# Live capture on interface, write to pcap
tcpdump -i eth0 -w /tmp/capture.pcap

# Read pcap file, verbose output
tcpdump -r capture.pcap -v

# No DNS resolution, show port numbers
tcpdump -n -nn

# Capture with snaplen 1500 (full packet)
tcpdump -s 1500

# Capture to rotating files (100MB each, keep 10)
tcpdump -C 100 -W 10 -w /tmp/capture.pcap

# Filter by host and port
tcpdump 'host 192.168.1.1 and port 443'

# Exclude SSH (port 22) to avoid capturing own session
tcpdump 'not port 22'

# Show hex and ASCII
tcpdump -X -s 0 'port 80'

# Capture HTTPS SNI (TLS Client Hello)
tcpdump -n 'tcp port 443 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x16030100'

# Detect SYN flood
tcpdump -n -c 10000 'tcp[13] = 2' 2>/dev/null | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Capture DNS traffic
tcpdump -n 'udp port 53 or tcp port 53'

# Capture ECN-related packets
tcpdump -n '(tcp[13] & 0xC0 != 0) or (ip[1] & 0x03 != 0)'