Packet capturing is the foundation of network sniffing and traffic analysis. It involves recording raw network packets from an interface so they can be analyzed for protocols, behavior, performance, and security issues. Pentesters use packet captures to identify communication patterns, credentials, vulnerabilities, and internal service structures. This is the first step in understanding what happens on a network at the packet level.

What Packet Capturing Does

Packet capturing records:

• Source and destination IPs

• Ports

• Protocols

• Payload data

• Handshakes and session setups

• Errors and retransmissions

• DNS queries

• Login attempts

• Application-layer traffic

This provides visibility into both encrypted and unencrypted traffic, allowing deep analysis during a pentest.

Capturing Packets with tcpdump

tcpdump is a command-line packet sniffer used for fast and precise capture.

Capturing All Traffic

sudo tcpdump -i eth0

Saving Packets to a File

sudo tcpdump -i eth0 -w capture.pcap

This creates a .pcap file for later analysis in Wireshark.

Capturing Specific Protocols

HTTP:

sudo tcpdump -i eth0 port 80

DNS:

sudo tcpdump -i eth0 port 53

SSH:

sudo tcpdump -i eth0 port 22

Specific protocols help narrow down analysis to interesting traffic only.

Capturing Packets with Wireshark

Wireshark is a GUI-based packet analysis tool that provides live capture and protocol decoding.

Starting Packet Capture

Select the target interface and click Start Capture.

Wireshark automatically decodes:

• HTTP requests

• DNS responses

• TCP handshakes

• TLS sessions

• Credentials (if not encrypted)

• File transfers

• SMB traffic

It also highlights anomalies such as retransmissions, resets, and malformed packets.

Setting Useful Wireshark Filters

Filters reduce noise and isolate relevant traffic.

Common display filters include:

HTTP:

http

DNS:

dns

TCP Streams:

tcp.stream eq 1

Credentials:

http.request.method == "POST"

SMB:

smb2

Filters make analysis faster and more accurate.

Capturing Promiscuous Mode Traffic

Promiscuous mode captures all packets visible on the interface.

Enabling with tcpdump

sudo tcpdump -i eth0 -p

Most sniffers enable it automatically unless switched off.

Monitoring Live Traffic for Credentials

Plaintext protocols reveal credentials directly.

POP3:

sudo tcpdump -i eth0 port 110

FTP:

sudo tcpdump -i eth0 port 21

IMAP:

sudo tcpdump -i eth0 port 143

Captured logins appear in the packet content.

Extracting Files from Packet Captures

Captured data may include transferred files or payloads. Wireshark allows extracting:

• HTTP objects

• FTP transfers

• SMB files

Packet reassembly helps identify full file transfers.

Capturing Packets from Multiple Interfaces

Multi-interface captures help analyze traffic flows across different segments.

Listing Interfaces

sudo tcpdump -D

Capturing on a Specific Interface

sudo tcpdump -i wlan0

This is useful on dual NIC systems or wireless assessments.

Why Packet Capturing Matters

Packet capturing reveals low-level communication behavior. It helps pentesters:

• Discover internal hosts

• Identify weak protocols

• Extract sensitive data

• Analyze attacks

• Build network maps

• Detect anomalies

• Understand authentication flows

All advanced traffic analysis depends on high-quality packet captures.

Intel Dump

• Packet capturing records raw network traffic for analysis

• Tools include tcpdump and Wireshark

• Filters isolate important protocols

• PCAP files store captured packets

• Capturing enables credential extraction, network mapping, and vulnerability detection