Live network monitoring tracks network activity in real time to identify suspicious behavior, performance issues, security threats, and communication patterns. Unlike offline PCAP analysis, live monitoring lets pentesters observe attacks as they happen, detect anomalies quickly, and map out active hosts and services. It is essential during active engagements, MITM attacks, and incident response.

What Live Monitoring Reveals

Live monitoring exposes:

Active connections
Real-time DNS queries
HTTP requests
TLS handshakes
Login attempts
Port scanning behavior
Beaconing/C2 traffic
Internal host discovery
Bandwidth spikes

Pentesters use this visibility to detect vulnerabilities and understand how the network behaves under normal and abnormal conditions.

Live Monitoring with tcpdump

tcpdump is the fastest way to observe packets as they flow.

Monitoring All Traffic

sudo tcpdump -i eth0

Monitoring Only TCP Connections

sudo tcpdump -i eth0 tcp

Monitoring DNS Queries in Real Time

sudo tcpdump -i eth0 port 53

Monitoring HTTPS Handshakes

sudo tcpdump -i eth0 port 443

This provides immediate insight into how devices communicate.

Live Monitoring with Wireshark

Wireshark allows GUI-based real-time monitoring with full protocol decoding.

Starting Live Capture

Select interface → Start Capture.

Wireshark instantly interprets protocols like:

HTTP
DNS
TLS
FTP
SMB
SSH
RDP

Filters make live monitoring more focused.

Useful Live Filters

HTTP:

http

DNS:

dns

Suspicious ports:

tcp.port == 4444

http.request.method == "POST"

Monitoring live helps detect anomalies immediately.

Monitoring Connections with netstat / ss

These tools show active sessions and network states.

Monitoring Active Connections

ss -tuna

Reveals:

Established connections
Listening ports
External IPs
High-risk processes

Watching for New Connections

watch -n 1 ss -tuna

Useful for detecting:

Port scans
C2 beacons
Unexpected outbound traffic

Live Monitoring with Zeek

Zeek provides high-level behavioral monitoring rather than raw packets.

Starting Zeek

sudo zeek -i eth0

Zeek generates logs for:

dns.log
http.log
conn.log
ssl.log
weird.log (anomalies)

weird.log is especially important because it flags anomalies such as:

Bad checksums
Abnormal flows
Protocol violations

These often indicate attacks.

Live Monitoring with Suricata

Suricata performs IDS-style monitoring with signatures and behavioral detection.

Running Suricata

sudo suricata -i eth0 -l /var/log/suricata

Suricata detects:

Malware patterns
Known exploits
Suspicious DNS
TLS anomalies
Brute-force attempts

Events are logged in eve.json.

Process-Level Monitoring

Attackers often spawn suspicious network processes. Pentesters monitor running processes in real time.

Monitoring Network-Capable Processes

sudo lsof -i

Watching Process Network Activity Live

sudo watch lsof -i

Useful indicators include:

Unknown binaries connecting outside
High outbound traffic
Processes using odd ports

Detecting Scanning and Reconnaissance Behavior

During live monitoring, pentesters look for:

Symptoms of Port Scanning

Rapid SYN packets
Many ports touched in seconds
Repeated connection attempts

Useful tcpdump Filter

sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0'

This highlights scanning activity.

Monitoring Bandwidth and Throughput

Tools like nload and iftop track bandwidth in real time.

Using iftop

sudo iftop -i eth0

Using nload

sudo nload eth0

Abnormal spikes often indicate:

Malware
Data exfiltration
Scanning
Misconfigured services

Why Live Network Monitoring Matters

Live monitoring gives immediate visibility into network behavior. It reveals attacks as they occur, helps detect unusual communication, and assists pentesters in identifying weak points quickly. It also validates whether mitigation controls such as firewalls, ACLs, and IDS systems are working.

Intel Dump

Live monitoring shows real-time traffic, connections, and anomalies
Tools include tcpdump, Wireshark, Zeek, Suricata, ss, iftop, nload
Detects C2, scanning, DNS patterns, login attempts, and TLS handshakes
Helps identify misconfigurations, attacks, and suspicious processes