NDC & PKI

[Day 1] 6. TCPdump

D
DITISS Admin
••5 min read

1. About TCPDump

  • TCPDump is a command-line packet capturing tool.
  • It is considered the father of Wireshark but lacks a GUI.

Basic Commands in TCPDump

  • sudo apt-get install tcpdump
    : install 
    tcpdump
    .
  • sudo tcpdump
    : Start capturing traffic on the default interface.
  • sudo tcpdump -D
    : List available interfaces.
  • sudo tcpdump -i <interface>
    : Capture packets on a specific interface (e.g., 
    ens33
    ).

2. Commands with Filters

TCPDump has only capture filters for limiting the type of packets being captured.

Common Filters:

  • Capture TCP packets:

    bash
    sudo tcpdump -i ens33 tcp

  • Capture UDP packets:

    bash
    sudo tcpdump -i ens33 udp

  • Capture a specific number of packets (e.g., 2):

    bash
    sudo tcpdump -c 2

  • Capture packets without resolving names of the protocol:

    bash
    sudo tcpdump -c 2 -n

  • Write captured packets to a file:

    bash
    sudo tcpdump -c 2 -w packets.txt

  • Read packets from a file:

    bash
    sudo tcpdump -r packets.txt

Advanced Filters:

  • Filter by host IP (both incoming and outgoing):

    bash
    sudo tcpdump host <host_ip>

  • Filter packets going to a specific destination IP:

    bash
    sudo tcpdump dst <destination_ip>
or
sudo tcpdump dst host <destination_ip>

  • Filter packets coming from a specific source IP:

    bash
    sudo tcpdump src <source_ip>
or
sudo tcpdump src host <source_ip>

  • Filter packets based on port:

    bash
    sudo tcpdump port 22

    • Source port only:

      bash
      sudo tcpdump src port 22

    • Destination port only:

      bash
      sudo tcpdump dst port 22

Complex Filters:

  • Capture TCP packets on port 

    80
    with destination IPs 
    192.168.1.254
    or 
    192.168.1.200
    :

    bash
    sudo tcpdump -i eth1 '((tcp) and (port 80) and ((dst host 192.168.1.254) or (dst host 192.168.1.200)))'

3. Snapshot Length (Snaplen)

  • Snapshot Length: is the amount of data for each frame that is actually captured by the network capturing tool and stored into the CaptureFile. This is sometimes called Packet Slicing.

  • Example Command:

    bash
    sudo tcpdump -c 2 -xxe -s 4

    • -xx
      : Displays packet headers and data in hexadecimal format.
    • -e
      : Prints link-level headers (e.g., MAC addresses).
    • -s <length>
      : Specifies the snapshot length.

4. Linux Commands

which
Command

  • Used to check if a package is installed on the system.

    • Example:

      bash
      which tcpdump

  • Important: Works on both Debian-based and RedHat-based distributions, unlike 

    rpm
    , which is RedHat-specific.

APT Configuration File: 
/etc/apt/sources.list

  • Purpose: Stores configuration for APT (Debian package manager).

  • To add a local server repository:

    text
    deb [trusted=1] http://sunbeam.shuharilabs.com/sw/repo/deb12/ bookworm main
    • Explanation: 
      • deb
        : Indicates a Debian binary package repository.
      • [trusted=1]
        : Trusts the source to avoid signature verification errors.
      • http://sunbeam.shuharilabs.com/sw/repo/deb12/
        : URL of the package repository.
      • bookworm
        : Codename for the Debian distribution.
      • main
        : Category of the software.

  • After modifying the file, update the APT catalog:

    bash
    sudo apt-get update

    This needs to be done every time you make changes in the configuration file.

Debian Version Codes

  • Debian releases are named with version codes (e.g., 
    bookworm
    for Debian 12, 
    bullseye
    for Debian 11).

5. Notes on Interfaces

  • The default interface name (
    eth0
    ) is now replaced with newer naming conventions like 
    ens33
    .
  • Use 
    sudo tcpdump -i <interface>
    to specify your interface.
  • Check the interfaces using this command first and then use the one you want:
shell
  sudo tcpdump -D

Read Next

8/26/2026

[Day 1] 7. Extra

1. **Ping Command Behavior** - Using the `-c` flag in the `ping` command to limit the number of packets sent to the target IP. - In **Linux*...

8/26/2026

[Day 2] 1. Overview of SNORT

### **Introduction to Intrusion Detection System (IDS)** - An **Intrusion Detection System (IDS)** monitors network traffic and allows only authori...