HP 800 User Manual page 258

Quarantined Networks
Determining Accessible Services Example
tcpdump -i eth0 -s0 -w /tmp/dns.pcap
waldo:~ # tcpdump -i eth0 -s0 port 53 and host 172.21.20.20
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:20:22.551309 IP 172.21.20.20.2586 > SA00.domain:
windowsupdate.microsoft.com. (45)
16:20:22.552492 IP SA00.domain > 172.21.20.20.2586:
16:20:50.529861 IP 172.21.20.20.2586 > SA00.domain:
windowsupdate.microsoft.com. (45)
16:20:50.531469 IP SA00.domain > 172.21.20.20.2586:
16:22:07.387959 IP 172.21.20.20.2586 > SA00.domain:
windowsupdate.microsoft.com. (45)
16:22:07.491558 IP SA00.domain > 172.21.20.20.2586:
windowsupdate.microsoft.nsatc.net., A SA00 (148)
7-8
The final list of accessible services for this example is shown in the following
figure.
Figure 7-3. Final List of Accessible Services Example
The complete tcpdump results for this example are shown below:
port 53 and host 172.21.20.20
49734+ A?
49734 NXDomain* 0/1/0 (96)
40773+ A?
40773 NXDomain* 0/1/0 (96)
12107+ A?
12107 2/1/1 CNAME