R-TCP
tcpdump
Command-line packet capture and analysis tool for inspecting live network traffic or saved pcap files.
OVERVIEW
tcpdump (the-tcpdump-group/tcpdump on GitHub, tcpdump.org) is the standard command-line packet sniffer: point it at an interface, optionally narrow the capture with a Berkeley Packet Filter (BPF) expression (host, port, protocol), and it prints or saves every matching packet. It ships on nearly every Unix-like system by default, which makes it the tool most likely to already be available on a jump box or a compromised host during an engagement.
Because it uses the same BPF syntax and libpcap under the hood as Wireshark, a capture started with tcpdump can be saved (-w) and handed straight to Wireshark for deeper protocol dissection, or replayed later against the same filter for regression checks.
USE CASES
Practical use cases
- 01
Confirming a service is actually reachable and responding as expected during enumeration.
- 02
Capturing a handshake or authentication exchange to a pcap for offline analysis in Wireshark.
- 03
Verifying whether traffic is encrypted, plaintext, or tunneled on a segment before deciding on an attack.
- 04
Watching for callback/beacon traffic from a payload during a controlled exploitation test.
QUICK START
When you need a fast, dependency-free look at what's actually crossing an interface — confirming a service is reachable, capturing a handshake, or building a pcap for deeper analysis.
- Confirm the interface and traffic you plan to capture are within the authorized scope.
- Identify the target interface with tcpdump -D or ip link.
- Run a capture with a BPF filter narrowed to the relevant host/port/protocol.
- Save the capture to a pcap file (-w) so it can be replayed or opened in Wireshark.
- Review the output for the specific exchange or behavior you're confirming.
sudo tcpdump -i eth0 -w capture.pcap host 10.10.10.5 and port 443BEFORE YOU RUN IT
What to check before running it
Capturing traffic that isn't yours — on a shared segment, a client network, or a host you don't control — needs explicit authorization; packet capture is itself considered interception in many jurisdictions.
Running without a filter on a busy interface generates large files fast and can fill disk on a small jump box; always scope the BPF expression.
tcpdump only sees what reaches the capturing interface — a switched network needs a SPAN/mirror port or ARP/MAC tricks to see traffic that isn't addressed to the capture host.