Capturing Packets

Packet capture records the raw network traffic flowing across an interface. It is the ground truth of what actually happened on the wire.

Analysts use captures to investigate incidents, debug protocols, and hunt for malicious activity.

The two essential tools are Wireshark, a graphical analyzer, and tcpdump, a command-line capture tool.

• tcpdump: lightweight, perfect for servers and remote capture.
• Wireshark: rich GUI for deep analysis.

Normally a network card ignores frames not addressed to it. Promiscuous mode tells it to capture everything it sees.

On switched networks you still only see your own traffic unless you use a SPAN port or tap.

tcpdump captures from an interface and prints or saves packets. The most common flags select the interface and output file.

Run it with sufficient privileges to access the interface.

You can replay a saved capture file later, with tcpdump or Wireshark.

The -r flag reads from a file instead of a live interface.

Capturing everything is wasteful. Capture filters use the Berkeley Packet Filter syntax to record only relevant traffic.

Apply them at capture time to keep files small.

Captures are stored as pcap or the newer pcapng files. These contain the raw bytes plus a timestamp for each packet.

The format is portable, so a capture taken with tcpdump opens perfectly in Wireshark.

Wireshark shows three panes: the packet list, the packet details (decoded protocol layers), and the packet bytes (raw hex).

Click any packet to drill from the summary down to individual bytes.

Wireshark display filters differ from capture filters: they hide packets after capture without discarding them.

The syntax is richer and field-aware.

Long captures fill disks. Use ring buffers to rotate files by size or time, keeping only recent data.

This is how sensors run continuously without exhausting storage.

Packet capture can expose sensitive data and is often regulated. Capture only on networks you are authorized to monitor.

Handle captures as confidential evidence and store them securely.

Test your understanding of packet capture.

You learned how to capture packets.

• tcpdump captures on the command line; Wireshark analyzes graphically.
• Promiscuous mode captures all visible frames.
• Capture filters (BPF) trim data at capture; display filters hide afterward.
• Captures are stored as pcap/pcapng files.
• Use ring buffers for long runs; respect legal and privacy limits.

Next you will read and interpret protocols.