tcpdump Fundamentals

Capture, read, and save packets from the command line before you ever open a GUI.

17 mintraffic-analysistcpdumppackets

What you will learn

-Capture live traffic on a chosen interface with tcpdump
-Read tcpdump's output line by line without guessing
-Save a capture to a pcap file for later analysis

Before you can attack a you have to see it. tcpdump is the fastest way to watch raw go by, and it lives on almost every Linux box you will ever land on. No GUI, no dependencies, just a and a screen. Learn it here and you can read traffic on a headless target the moment you a .

Pick the right interface

Packets arrive on an interface, so tcpdump needs to know which one to listen on. List them first, then capture.

attacker@kali

# list interfaces and their IPs

$ip -brief address

# interfaces tcpdump can actually open

$sudo tcpdump -D

# start sniffing on eth0

$sudo tcpdump -i eth0

Capturing needs because you are reading traffic below the normal socket layer. On a target where you are not root yet, tcpdump may simply refuse, which is itself a useful signal about your privilege level.

Read a single line

tcpdump prints one line per packet. It looks dense until you learn the shape:

Read it left to right: timestamp, , then source.port > dest.port, then the flags and sequence info. Flags [S] is a lone , the opening knock of a handshake. [S.] is SYN-ACK, [.] is a bare ACK, [P.] carries data, and [F.] starts a graceful close. Those five cover most of what you will see scroll past.

ClientServer

SYNseq=x

Client asks to open. Picks a random initial sequence number.

SYN-ACKseq=y, ack=x+1

Server agrees, sends its own sequence, acknowledges yours.

ACKack=y+1

Client confirms. The socket is now ESTABLISHED, data can flow.

CLOSED

The flags that keep it readable

Raw tcpdump is a firehose. Three flags tame it:

attacker@kali

# -n: do not resolve names, way faster and quieter

$sudo tcpdump -i eth0 -n

# -nn: no name or port lookups, -v: more detail

$sudo tcpdump -i eth0 -nn -v

# -c 20: stop after 20 packets, -A: print payload as ASCII

$sudo tcpdump -i eth0 -c 20 -A

-A is the one that makes fall out of cleartext protocols. Point it at or FTP traffic and you will see usernames and in plain view.

Save it for later

Watching live is fine for a quick look, but real analysis happens on a saved file you can replay and filter without touching the wire again.

attacker@kali

$sudo tcpdump -i eth0 -w capture.pcap

-w writes raw packets to a pcap file instead of printing. Read it back later with tcpdump -r capture.pcap or open it in Wireshark.

Capture first, analyze later

On an engagement you often get one shot at live traffic. Write everything to a pcap with -w, then do your filtering and stream-following offline. You keep the evidence, you can hand it to Wireshark, and you never miss a packet because you were busy typing a filter.

Which tcpdump flag saves raw packets to a file for later analysis?

Exercise

You want to sniff eth0, stop after 50 packets, and skip all DNS name lookups so it stays fast. Write the command.

-i picks the interface, -nn disables name and resolution, and -c sets the packet limit.

BPF Filters

Pick the right interface

Packets arrive on an interface, so tcpdump needs to know which one to listen on. List them first, then capture.

attacker@kali

# list interfaces and their IPs

$ip -brief address

# interfaces tcpdump can actually open

$sudo tcpdump -D

# start sniffing on eth0

$sudo tcpdump -i eth0

Read a single line

tcpdump prints one line per packet. It looks dense until you learn the shape:

ClientServer

SYNseq=x

Client asks to open. Picks a random initial sequence number.

SYN-ACKseq=y, ack=x+1

Server agrees, sends its own sequence, acknowledges yours.

ACKack=y+1

Client confirms. The socket is now ESTABLISHED, data can flow.

CLOSED

The flags that keep it readable

Raw tcpdump is a firehose. Three flags tame it:

attacker@kali

# -n: do not resolve names, way faster and quieter

$sudo tcpdump -i eth0 -n

# -nn: no name or port lookups, -v: more detail

$sudo tcpdump -i eth0 -nn -v

# -c 20: stop after 20 packets, -A: print payload as ASCII

$sudo tcpdump -i eth0 -c 20 -A

-A is the one that makes fall out of cleartext protocols. Point it at or FTP traffic and you will see usernames and in plain view.

Save it for later

Watching live is fine for a quick look, but real analysis happens on a saved file you can replay and filter without touching the wire again.

attacker@kali

$sudo tcpdump -i eth0 -w capture.pcap

-w writes raw packets to a pcap file instead of printing. Read it back later with tcpdump -r capture.pcap or open it in Wireshark.

Capture first, analyze later

Which tcpdump flag saves raw packets to a file for later analysis?

Exercise

You want to sniff eth0, stop after 50 packets, and skip all DNS name lookups so it stays fast. Write the command.

-i picks the interface, -nn disables name and resolution, and -c sets the packet limit.