24. Traffic Sniffing and Analysis
24.2 tcpdump: Command-Line Capture
tcpdump captures packets from the terminal – perfect on a server with no GUI (like your EC2 instances).
sudo tcpdump -D # list interfaces
sudo tcpdump -i eth0 # capture on an interface
sudo tcpdump -i eth0 -n # do not resolve names (faster, clearer)
sudo tcpdump -i eth0 -c 100 # stop after 100 packets
sudo tcpdump -i eth0 port 80 # only HTTP traffic
sudo tcpdump -i eth0 host 192.168.56.20 # only traffic to/from one host
sudo tcpdump -i eth0 'tcp port 80 and host 192.168.56.20' # combine
sudo tcpdump -i eth0 -A port 80 # show packet contents as text (see HTTP)
sudo tcpdump -i eth0 -w capture.pcap # save to a file for Wireshark
sudo tcpdump -r capture.pcap # read a saved file
Filter keywords: host, net, port, src, dst, and and/or/not. -w writes a .pcap you open later in Wireshark.
Ravindra Bagale's Tip
Without -n, tcpdump tries to look up a name for every IP, which makes it slow and the output hard to read. Always use -n. And instead of capturing all traffic, filter with port or host – otherwise you won't find what you need among thousands of lines.
Ravindra Bagale's Tip – मराठी
-n न दिल्याने tcpdump प्रत्येक IP चे नाव शोधत बसतो आणि हळू होतो, output वाचायला कठीण जाते. नेहमी -n वापरा. आणि सगळे traffic capture करण्यापेक्षा port किंवा host ने filter करा – नाहीतर हजारो lines मध्ये हवे ते सापडत नाही.
Ravindra Bagale's Tip – हिंदी
-n न देने पर tcpdump हर IP का नाम ढूँढता रहता है और धीमा हो जाता है, output पढ़ना मुश्किल होता है. हमेशा -n इस्तेमाल करो. और सारा traffic capture करने के बजाय port या host से filter करो – वरना हज़ारों lines में जो चाहिए वह नहीं मिलता.
Lab
On Metasploitable 2 (or your own server), run sudo tcpdump -i eth0 -n -c 50 port 80 -w web.pcap while you browse its website from Kali. Then read it with tcpdump -r web.pcap and copy the file to open in Wireshark next.