24. Traffic Sniffing and Analysis
24.2 tcpdump: Command-Line Capture
tcpdump captures packets from the terminal – perfect on a server with no GUI (like your EC2 instances).
sudo tcpdump -D # list interfaces
sudo tcpdump -i eth0 # capture on an interface
sudo tcpdump -i eth0 -n # do not resolve names (faster, clearer)
sudo tcpdump -i eth0 -c 100 # stop after 100 packets
sudo tcpdump -i eth0 port 80 # only HTTP traffic
sudo tcpdump -i eth0 host 192.168.56.20 # only traffic to/from one host
sudo tcpdump -i eth0 'tcp port 80 and host 192.168.56.20' # combine
sudo tcpdump -i eth0 -A port 80 # show packet contents as text (see HTTP)
sudo tcpdump -i eth0 -w capture.pcap # save to a file for Wireshark
sudo tcpdump -r capture.pcap # read a saved file
Filter keywords: host, net, port, src, dst, and and/or/not. -w writes a .pcap you open later in Wireshark.
Ravindra Bagale's Tip
-n na dilyane tcpdump pratyek IP cha naav shodhat basto ani halu hoto, output vachanyas kathin. Nehmi -n vapra. Ani sagla traffic capture karnyapeksha port kiwa host ne filter kara – nahitar hajaro lines madhe je hava te sapadat nahi.
Lab
On Metasploitable 2 (or your own server), run sudo tcpdump -i eth0 -n -c 50 port 80 -w web.pcap while you browse its website from Kali. Then read it with tcpdump -r web.pcap and copy the file to open in Wireshark next.