Mastering `tcpdump`: Packet Capture & Basic Filtering

1. What is tcpdump?

tcpdump is a command-line packet analyzer. It allows you to intercept and display network packets that are being transmitted or received over a network. Think of it as the command-line equivalent of Wireshark.

Most Linux distributions, including Arch, come with tcpdump pre-installed. You can verify this with which tcpdump. If for some reason it's not there, you can install it with sudo pacman -S tcpdump.

Let's watch a short introduction.

A crucial point to remember is that capturing network packets requires elevated privileges because tcpdump needs to listen on a network interface in a special "promiscuous mode."

So, almost all tcpdump commands you run will start with sudo. To stop a capture, you simply press Ctrl+C.

2. Core Concepts: Interfaces, Output, and Saving

Before we dive into filtering, let's cover a few essential concepts.

Selecting a Network Interface (-i)

A computer can have multiple network interfaces (e.g., a wired eth0/enp... interface, a wireless wlan0 interface, and the lo loopback interface for local traffic). You must tell tcpdump which interface to listen on.

You can list available interfaces using ip a (which you know) or tcpdump -D.

# List interfaces tcpdump can use
sudo tcpdump -D




# Example: Capture on the 'eth0' interface
sudo tcpdump -i eth0

Understanding the Output

When you run tcpdump, each line represents one packet. Let's break down a typical line:

A standard tcpdump line looks something like this:
21:28:43.123456 IP your_pc.45678 > some_server.https: Flags [S], seq 12345, win 64240, options [mss 1460], length 0

• 21:28:43.123456: The timestamp of the capture.
• IP: The protocol (in this case, IPv4).
• your_pc.45678: The source hostname and port.
• >: The direction of traffic.
• some_server.https: The destination hostname and port.
• Flags [S]: TCP flags (e.g., S for SYN, . for ACK, P for PUSH, F for FIN).
• The rest is additional protocol-specific information.

By default, tcpdump tries to resolve IP addresses and port numbers to names (e.g., 8.8.8.8 becomes dns.google and port 53 becomes domain). This can be slow. Use the -n flag to show numeric IP addresses and -nn to show numeric ports as well.

sudo tcpdump -i eth0 -nn

Saving and Reading Captures (-w and -r)

Displaying packets in the terminal is useful for real-time monitoring, but for detailed analysis, you'll want to save the capture to a file. This is done with the -w (write) flag, creating a .pcap (packet capture) file.

This .pcap file can then be analyzed later with tcpdump using the -r (read) flag, or with graphical tools like Wireshark.

Here is the process:

1. Capture and write to a file: sudo tcpdump -i eth0 -w my_capture.pcap
2. Read from the file: tcpdump -r my_capture.pcap (Note: sudo is not needed to read a file).

3. Basic Filtering: Isolating the Traffic You Need

Capturing all traffic on an interface can be overwhelming. The true power of tcpdump comes from its filtering capabilities. Filters are expressions that tell tcpdump what packets to show you.

For a great overview of the most common filters, let's turn to a textual resource.

Let's consolidate and practice these filters.

Filter Primitives

Filters are built from one or more primitives. The main types are:

• host: Filters for traffic involving a specific IP address or hostname.
  • sudo tcpdump -nn -i eth0 host 8.8.8.8 (traffic to or from 8.8.8.8)
• net: Filters for traffic within a whole network range.
  • sudo tcpdump -nn -i eth0 net 192.168.1.0/24
• port: Filters for traffic using a specific port.
  • sudo tcpdump -nn -i eth0 port 443 (HTTPS traffic)
• proto: Filters for a specific protocol. You can also just use the protocol name.
  • sudo tcpdump -i eth0 icmp
  • sudo tcpdump -i eth0 udp

Filter Qualifiers

You can make primitives more specific with qualifiers:

• src: Matches the source address/port.
  • sudo tcpdump -nn -i eth0 src host 192.168.1.10
• dst: Matches the destination address/port.
  • sudo tcpdump -nn -i eth0 dst port 22

Combining Filters

You can combine these expressions using logical operators:

• and (or &&): All conditions must be true.
• or (or ||): At least one condition must be true.
• not (or !): Inverts the condition.

When combining filters, it's good practice to wrap the filter expression in single quotes ' to prevent the shell from interpreting special characters.

Example: Capture TCP traffic from host 192.168.1.100 that is NOT going to port 22 (SSH).

sudo tcpdump -nn -i eth0 'src host 192.168.1.100 and tcp and not dst port 22'

The HackerSploit video provides excellent demonstrations of these filters in action.

For a quick reference of many useful commands, Daniel Miessler's article "A tcpdump Tutorial with Examples" is an invaluable resource to bookmark. Don't worry about memorizing it all; just know that it's there when you need a specific command.

4. Hands-On Lab

Time to practice. For this lab, you'll need two terminals open.

• Terminal 1: Where you'll run tcpdump.
• Terminal 2: Where you'll generate traffic.

First, find your active network interface name (e.g., eth0, enp0s3, wlan0) with ip a. I'll use eth0 in the examples below—replace it with your own.

Activity 1: Capture ICMP Traffic (Ping)
We'll start by capturing ping requests.

1. In Terminal 1, start tcpdump to listen for ICMP traffic. The -c 5 flag will stop the capture after 5 packets.

   sudo tcpdump -nn -i eth0 -c 5 icmp
   

2. In Terminal 2, send a few pings to a public DNS server.

   ping -c 2 8.8.8.8
   

3. Observe the output in Terminal 1. You will see the ICMP "echo request" and "echo reply" packets.

Activity 2: Capture DNS Traffic
Let's see what a DNS query looks like. DNS typically uses UDP port 53.

1. In Terminal 1, start listening on UDP port 53.

   sudo tcpdump -nn -i eth0 -c 2 'udp port 53'
   

2. In Terminal 2, use dig to perform a DNS lookup.

   dig archlinux.org
   

3. You'll see the DNS query from your machine to your DNS resolver in Terminal 1.

Activity 3: Capture and Save Web Traffic
Now, let's tie this into our last lesson. We'll capture the traffic generated by curl.

1. In Terminal 1, start tcpdump to capture traffic to or from example.com on port 80 and save it to a file named webtraffic.pcap.

   sudo tcpdump -i eth0 -w webtraffic.pcap 'host example.com and port 80'
   

2. In Terminal 2, use curl to download the page.

   curl http://example.com
   

3. Once curl finishes, stop the capture in Terminal 1 by pressing Ctrl+C. You'll see a summary of packets captured.
4. Finally, inspect the contents of your saved file.

   tcpdump -nn -r webtraffic.pcap
   

   You will see the TCP three-way handshake, the HTTP GET request, and the server's response, all from the file you just created.

Conclusion

Excellent work. You have now learned how to capture, filter, and inspect network traffic from the command line—a fundamental skill for any security professional.

Key Takeaways:

• tcpdump is a command-line packet sniffer that requires sudo to run.
• Always specify an interface with -i (list them with tcpdump -D). Use -nn to prevent name resolution for cleaner output.
• The most crucial workflow is capturing to a file with -w for later analysis with -r or other tools like Wireshark.
• Filtering is essential. Master the use of primitives (host, port, net, proto) and combine them with qualifiers (src, dst) and logical operators (and, or, not).

Next Lesson Preview:
We've seen how to download files and how to inspect the traffic they generate. Next, we need a secure way to transfer files between machines, a common task when moving tools or loot during a penetration test. In our next lesson, we will learn how to transfer files securely between machines using scp.