Packet capture with tcpdump
Capturing and filtering from the command line.
Level 201 · 16 lessons · 15 practice labs
Lessons
Starting a capture
- Finding interfaces and starting a capture with tcpdump: You learn to list the network interfaces on your machine and start capturing traffic with tcpdump in your own lab.
- Bounding a tcpdump capture: packet count and length: You learn to limit a tcpdump capture by packet count and length so that it does not fill the disk or collect needless data.
- Reading tcpdump packet summaries: You learn to read tcpdump's one-line packet summaries and work out what the source, destination, port and flags mean.
- tcpdump timestamps and verbosity: -tttt, -v, -n
- Short task: take a bounded 100-packet capture on the right interface
Filters
- Berkeley Packet Filters (BPF) in tcpdump: You will understand what the Berkeley Packet Filters (BPF) used by tcpdump are and why they are used to capture only the traffic you care about.
- tcpdump host, port and protocol filters: You learn to filter traffic with tcpdump for one machine, port or protocol so you can isolate and inspect a single service's conversation.
- Combining tcpdump filters logically: You learn to combine tcpdump filters with logic such as and, or and not to describe a more precise capture.
- Filtering on TCP flags with tcpdump: SYN, RST, FIN
- Short task: capture only failed connection attempts
Payloads and files
- Showing payloads in ASCII and hex with tcpdump: You learn to use tcpdump to view the data inside a packet in ASCII and hexadecimal form and examine the content of an unencrypted conversation.
- Writing and re-reading PCAP files with tcpdump: You learn to write tcpdump captures to a PCAP file, read them again later, and keep them in an orderly way as evidence.
- What tcpdump shows leaking in cleartext: why encryption matters: In your own lab you use tcpdump to see how details such as usernames and passwords are visible on the network in unencrypted protocols, and why encryption is a must.
- Splitting capture files by size and time with tcpdump: -C and -G
- Short task: split only the HTTP traffic of a capture into a new file
- Capstone: find the suspicious host in a tcpdump capture: In a small task you go through a fictional company's tcpdump capture file, find the machine behaving suspiciously and write down your reasons.
Practice labs
- A hundred packets on the right interface: Find the interface carrying traffic on the lab machine and take a capture limited to 100 packets.
- Readable timestamps and no name resolution: Re-read the same capture with full-date timestamps and no name resolution and compare the two outputs.
- Hidden fields at higher verbosity: Raise verbosity to show TTL, ID and option fields and find the host with the unusual TTL.
- One host and one port: Write a filter that captures only traffic to port 22 of a given server.
- SYN packets only: Capture only connection-opening packets and find the host that opens the most connections.
- Traffic leaving a subnet but not going inside: Capture traffic that leaves one subnet for outside the internal network with a single filter and list the destinations.
- Show the payload as ASCII: Read a capture showing payloads as ASCII and find the leaked username.
- Split HTTP out of a capture into its own file: Write only HTTP traffic from a large capture to a new file and compare the packet counts.
- Find the suspicious host in the capture: Find the suspicious host in the fictional Orvik warehouse capture using tcpdump alone and report the evidence lines.
- Write to a file, then read it: Write a minute of traffic to a file and read it back with a filter to show only ICMP packets.
- Capture headers only: Set the length limit to capture headers without payloads and measure the difference in file size.
- Files rotated by size: Run a capture split into files of a set size and show at most five files are kept.
- Read the packet summary: Explain the source, destination, flags and length fields of five lines of tcpdump output.
- UDP other than DNS: Write a filter showing all UDP traffic except DNS, mDNS and NTP, group what remains by port and report the unexpected service.
- Failed connection attempts: Separate attempts answered with RST using flag filters, find the source probing closed ports, list the open and closed ports it touched and show how it differs from ordinary connection failures.
About this course
Capturing and filtering from the command line.
What you will learn
- Starting a capture
- Filters
- Payloads and files
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.