Packet Capture with Wireshark/tcpdump

Packet capture is like taking a snapshot of all the network data flowing in and out of your device. It's a powerful technique for understanding network behavior and troubleshooting issues.

You can see the raw "packets" of information, including their source, destination, and the data they carry. This helps diagnose slow connections, find security problems, or debug network applications.

tcpdump is a command-line utility for capturing and analyzing network traffic. It's pre-installed on most Linux systems, making it a go-to tool for quick network inspections.

It works by "sniffing" packets directly from your network interface. You can view them in real-time or save them for later analysis.

Let's start with the most basic usage: capturing all traffic on a specific network interface. You often need sudo privileges to run tcpdump.

The -i flag specifies the interface (e.g., eth0 or wlan0). If you omit -i, tcpdump tries to pick one automatically.

Capturing all traffic can be overwhelming. You'll often want to filter for specific connections. The host keyword lets you capture traffic to or from a particular IP address or hostname.

Another common filter is by port. This is useful for seeing traffic related to specific services, like web (port 80/443), SSH (port 22), or DNS (port 53).

You can combine filters using logical operators like and, or, and not. This allows for very precise targeting of the traffic you want to see.

For example, to see HTTP traffic to a specific host, you'd combine host and port.

For deeper analysis, it's best to save the captured packets to a file. The -w flag writes the raw packet data to a file with a .pcap extension. This file can then be opened by other tools.

The -c flag limits the number of packets to capture.

While tcpdump is excellent for command-line capture, Wireshark is the industry-standard graphical tool for deep packet inspection. It provides a user-friendly interface to visualize and analyze captured network data.

Wireshark can capture live traffic or open .pcap files created by tcpdump or other tools.

A common workflow is to capture packets using tcpdump on a remote server (where a GUI might not be available) and then transfer the .pcap file to your local machine for analysis with Wireshark.

In Wireshark, you simply go to File > Open and select your .pcap file. Wireshark will then display all the captured packets in a structured way.

You need to capture traffic on the eth0 interface that is going to or coming from the IP address 10.0.0.5, but ONLY on port 22 (SSH). Which tcpdump command would achieve this?

In this lesson, we explored the powerful world of packet capture. We learned how to use tcpdump to capture and filter network traffic directly from the command line.

• Basic capture with -i
• Filtering by host and port
• Combining filters with and, or, not
• Saving captures to a .pcap file with -w

We also introduced Wireshark as a graphical tool for in-depth analysis of these captured files. Mastering these tools is crucial for any network troubleshooter!