This documentation explains how to use the tcpdump module. This enables collect data exchanged on a smartphone. This module is not compatible with Windows.
Pre-requisites
Global pre-requisites
Functional testrunner
Job.yml and config.yml files
PC connected in Ethernet.
Specific prerequisites to Linux
Activate connection sharing on the Linux computer: Network > Use as access point... > Switch on. Note that your computer must be on a wired network to be able to activate wifi connection sharing.
Connect your phone to the pc’s hotspot.
Check that the tcpdump package is installed on the Linux computer. tcpdump is installed by default on most Linux distributions. To check this, run the following command:
tcpdump --version
If the package is not installed, run the following command:
sudo apt install tcpdump
Specific prerequisites to Mac OS
Activate connection sharing on the Mac pc.
Click on the apple (top left), then on "System Preferences > Sharing". Uncheck the "Internet Sharing" box (if enabled).
Apply the following settings:
Share your connection from: Thunderbolt Ethernet
To computers using: Wifi
Wi-Fi Options...: enter the name of the network and the password
Then select the "Internet Sharing" checkbox. The wifi icon changes to an arrow pointing upwards.
Connect your phone to the computer's connection share.
Check that the tcpdump package is installed on the Mac OS computer. tcpdump is installed by default on most Mac OS. To check this, run the following command:
tcpdump --version
If the package is not installed, run the following command:
brew install tcpdump
Modification of job.yml
job: modules: tcpdump: true
Modifications of config.yml
target: ip: x.x.x.x # IP of the device to measure tcpdump: # tcpdump module used to get data gatewayIP: x.x.x.x # IP of the gateway used to filter data networkInterface: xxxx # Network interface used to detect data (wlp2s0...) keepPcap: false # If true, it keeps the pcap file at the end of the measures ipFilters: # Other IP addresses used to filter data apple: false # If true, it filters data related with 17.0.0.0/8
If the tcpdump module has been activated, you need to fill in the different values in the job.yml file.
To obtain information about the network interface corresponding to the connection share, you can use the ifconfig
command (Linux and Mac OS) or ipconfig
(Windows). This command identifies the list of networks available to your PC and the IP address of your PC on each network. You can use the IP address your phone has taken to find the name of the network you are looking for.
Here are the fields to fill in in detail :
target.ip : The IP address of the phone in the network shared by your PC. Normally this is an address of the type
10.42.0.x
(replace the x with the correct number)target.tcpdump.gatewayIP : This is the IP address of your PC (which acts as a gateway) in the shared network. This can be found using the
ifconfig
command. Normally it is :10.42.0.1
target.tcpdump.networkInterface : The name of the network interface on the shared network. This can be found using the
ifconfig
command. You can also obtain it by typing the commandsudo tcpdump -D
. The network interface corresponding to the shared connection begins with "wl" (Wireless Lan) on Linux.target.tcpdump.keepPcap : If the boolean is set to true, the pcap file is saved at the end of the measurements.
target.tcpdump.ipFilters : These are filters to remove certain network exchanges from the measurement. For measurements on iOS, set the "apple" boolean to true to filter IP addresses corresponding to 17.0.0.0/8 (Apple).
The IP of the telephone and the IP of the gateway must be in the same network. Normally the IPs are of the type
10.42.0.x
Launch of measures
Run the testrunner as usual:
./testrunner -jobFile job.yml -config config.yml
If the tcpdump module has been activated in the job.yml file, the root password will be requested on Linux and Mac OS when the testrunner is initialised.