Capture operations with tcpdump
You run long, rotating and remote captures safely, write byte-offset BPF filters and collect evidence while protecting personal data.
Level 301 · 15 lessons · 12 practice labs
Lessons
Long-running captures
- Ring buffers: capturing with -C, -W and -G without filling the disk
- Snaplen and disk planning: how many days you can keep
- Post-rotate hooks: compressing and hashing with -z
- Running a capture as a systemd service
- Short task: set up a 24-hour capture service limited to 2 GB
Advanced filters
- Byte-offset BPF: reading fields with tcp[13] and ip[6:2]
- Filtering on the first payload bytes with BPF
- Writing filters for VLAN-tagged and tunnelled traffic
- Compiling and checking a filter: tcpdump -d
- Short task: write a filter that captures only HTTP GET requests
Remote and responsible capture
- Capturing remotely over SSH and streaming into local Wireshark
- Dropping privileges: -Z and capture capabilities
- Privacy in capture: truncation, anonymisation and retention
- Preserving a PCAP as evidence: hash, time and record keeping
- Capstone: plan and run simultaneous capture on three servers during an incident
Practice labs
- A ring buffer rotating by size: Start a rotating capture of at most five 10 MB files with -C and -W.
- Hourly files and compression: Set hourly file rotation with -G and compress each closed file with -z.
- A capture service capped at 2 GB: Build a systemd capture service that uses at most 2 GB of disk and starts by itself after a reboot.
- Filter flags with tcp[13]: Capture only packets with SYN and ACK set together using a byte-offset filter.
- Capture only HTTP GET requests: Capture only GET requests with a BPF expression looking at the first four payload bytes.
- A filter on VLAN-tagged traffic: Filter one VLAN's DNS traffic in a VLAN-tagged capture and compile and explain the filter with tcpdump -d.
- Drop the capture to an unprivileged user: Drop privileges after starting the capture with -Z and verify which user the process runs as.
- Capture remotely over SSH: Stream traffic from a remote lab server to a local file over SSH and exclude your own SSH session with a filter.
- Simultaneous capture on three servers: Plan and run a capture starting at the same moment on three lab servers with synchronised clocks and the same filter.
- Seal a PCAP as evidence: Hash the capture file and write its time and capture interface into a record note.
- Protect privacy by truncating payloads: Keep only headers with snaplen and verify that no user content remains in the file.
- A retention and disk plan: From the measured average traffic rate calculate the disk needed for seven days of retention and write a short procedure adding an anonymisation step.
About this course
You run long, rotating and remote captures safely, write byte-offset BPF filters and collect evidence while protecting personal data.
What you will learn
- Long-running captures
- Advanced filters
- Remote and responsible capture
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.