3

I can ask tcpdump to show me GRE encapsulated packets quite simply with tcpdump -ni any proto gre:

15:02:57.209082 IP 10.14.0.3 > 10.14.0.2: GREv0, key=0x1, length 106: IP 10.10.10.11 > 10.10.10.1: ICMP echo request, id 21073, seq 2784, length 64
15:02:57.209138 IP 10.14.0.2 > 10.14.0.3: GREv0, key=0x1, length 106: IP 10.10.10.1 > 10.10.10.11: ICMP echo reply, id 21073, seq 2784, length 64
15:02:57.345098 IP 10.14.0.2 > 10.14.0.3: GREv0, key=0x1, length 74: IP 169.254.192.1 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 50, authtype none, intvl 2s, length 20

But is it possible to filter for example only encapsulated icmp packets, or any other arbitrary expression?

DazWorrall
  • 131

3 Answers3

5

Since this was of use to me, updating this answer.

If you want to look at a proto inside of another proto, you can't just use proto in the match.

protochain works like proto, however it specifically changes the offset for the next match for this exact purpose.

Instead use:

protochain GRE && proto ICMP

Source: pcap-filter(7)

mc2lagrange
  • 59
  • 1
    From reading the documentation of protochain I would have expected the filter to be written the opposite way: proto GRE && protochain ICMP. – kasperd Jan 04 '16 at 22:47
4

In case your tcpdump version does not support protochain like the one in Debian 8 for example, you can manually calculate the position, where the protocol number of the ip packet within the GRE tunnel is determined.

ICMP has protocol number 0x01. And it is stored in the 10th byte of the packet. GREv0 has 24 bytes, plus nine (because one counts from zero) equals 33:

tcpdump -i any proto 47 and ip[33]=0x01
Samveen
  • 1,873
MPW
  • 41
  • Hello @Samveen - Why is 33 and not 47 ? Where are the 14 bytes of Ethernet after the GRE pkt ? I'm struggling with BPF and I'd like to know better. Thanks – Kyrol Apr 01 '20 at 14:42
  • 1
    @Kyrol That would be because tdpcump is working on the IP packets, where the ethernet frames are already stripped. – Samveen Jul 07 '20 at 09:07
3

tcpdump uses pcap filter syntax

Filter XX within YY;

proto YY && proto XX

ICMP inside GRE:

proto GRE && proto ICMP
befzz
  • 139