Home > Network Pentesting

tcpdump

tcpdump is a command-line packet capture tool used for fast, scriptable, and low-level inspection of network traffic. Pentesters rely on tcpdump for capturing packets during reconnaissance, tunneling, credential extraction, C2 debugging, and forensic analysis. Unlike Wireshark, tcpdump runs directly in terminals, on servers, on pivots, and inside restricted shells, making it essential for internal network operations.

Understanding tcpdump’s Role

tcpdump helps pentesters:

  • Capture packets on compromised hosts

  • Monitor traffic in real time

  • Filter specific protocols or ports

  • Debug tunnels, reverse shells, and C2 channels

  • Detect MITM and ARP spoofing

  • Capture credentials in insecure protocols

  • Save PCAPs for later Wireshark analysis

It’s a lightweight, powerful tool usable on nearly any Linux or Unix-like system.

Basic Packet Capturing

Capture on a Network Interface

sudo tcpdump -i eth0

This displays packets in real time.

Capture Verbosely (More Detail)

sudo tcpdump -i eth0 -vv

Capture Entire Packets (No Truncation)

sudo tcpdump -i eth0 -s 0

Capture and Save to PCAP

sudo tcpdump -i eth0 -w capture.pcap

This file can later be analyzed in Wireshark.

Filtering Traffic

Filters reduce noise and capture only relevant traffic.

Filter by Host

sudo tcpdump host 10.10.10.5

Filter by Source or Destination

sudo tcpdump src 10.10.10.5
sudo tcpdump dst 10.10.10.5

Filter by Port

sudo tcpdump port 80
sudo tcpdump tcp port 445

Filter by Protocol

sudo tcpdump icmp
sudo tcpdump udp
sudo tcpdump arp

Filter by Subnet

sudo tcpdump net 10.10.10.0/24

Combine Filters

sudo tcpdump tcp and port 22 and host 10.10.10.5

Filters follow Berkeley Packet Filter (BPF) syntax, making them extremely flexible.

Analyzing Traffic in Real Time

View the First Few Packets Only

sudo tcpdump -c 10 -i eth0

Show Packet Bytes in HEX + ASCII

sudo tcpdump -A
sudo tcpdump -X
sudo tcpdump -XX

Useful for inspecting HTTP, credentials, or payloads.

Follow Only SYN Packets (Identify Scanning)

sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0'

Reveals Nmap and port scan patterns.

Capture DNS Queries

sudo tcpdump -i eth0 port 53

DNS monitoring helps detect tunneling or domain lookups.

Capture HTTP Traffic

sudo tcpdump -i eth0 port 80 -A

Cleartext credentials become visible.

Extracting Credentials and Sensitive Data

Some insecure protocols transmit credentials plainly.

FTP Logins

sudo tcpdump -i eth0 port 21 -A

Telnet Credentials

sudo tcpdump -i eth0 port 23 -A

HTTP Basic Authentication

sudo tcpdump -i eth0 port 80 -A | grep "Authorization"

tcpdump helps spot insecure authentication quickly.

Debugging Tunnels and Pivoting

Tcpdump is essential when testing complex tunnels such as SSH, Chisel, VPNs, or pivoting setups.

See If Packets Are Reaching Pivot

sudo tcpdump -i tun0

Inspect SOCKS or Proxychains Traffic

sudo tcpdump -i lo port 1080

Inspect Encrypted Traffic on 443

sudo tcpdump -i eth0 port 443

Confirm tunnels are active and working.

Detecting MITM Attacks

ARP Spoofing

sudo tcpdump arp

Look for repeated ARP replies claiming the same IP.

SSL Stripping

sudo tcpdump -A port 80

Look for forced HTTP redirects or modified headers.

Rogue DHCP Servers

sudo tcpdump 'port 67 or port 68'

Detect unauthorized DHCP traffic.

Saving Captures for Later Analysis

Save Traffic to PCAP

sudo tcpdump -w internal_traffic.pcap

Read PCAP File in Terminal

tcpdump -r internal_traffic.pcap

Reading PCAPs in command-line helps during restricted-access engagements.

Advanced Techniques

Capture Only the First N Bytes of Each Packet

sudo tcpdump -i eth0 -s 128

Useful for performance on busy networks.

Capture Packets Based on TCP Flags

SYN:

tcpdump 'tcp[13] & 2 != 0'

RST:

tcpdump 'tcp[13] & 4 != 0'

FIN:

tcpdump 'tcp[13] & 1 != 0'

Great for detecting scanning or session resets.

Rotate Capture Files Automatically

sudo tcpdump -w cap -W 10 -C 50

Creates rolling PCAP files of 50MB each.

Capture Only Inbound or Outbound

Inbound:

tcpdump inbound

Outbound:

tcpdump outbound

Using tcpdump on Compromised Hosts

tcpdump is one of the most powerful tools available after gaining shell access.

Common tasks:

  • Sniff internal credentials

  • Identify internal traffic paths

  • Detect VOIP or API calls

  • Confirm access to hidden subnets

  • Debug pivot routes

  • Log all local traffic silently

Because tcpdump is command-line only, it is ideal for stealth operations.

Why tcpdump Mastery Matters

Pentesters rely on tcpdump because it:

  • Works everywhere (Linux, BSD, macOS)

  • Captures packets in restricted shells

  • Provides raw data for deep analysis

  • Helps detect scanning, MITM, tunneling

  • Extracts credentials from insecure protocols

  • Supports PCAP creation for Wireshark

  • Debugs tunnels and pivot points

  • Reveals hidden internal traffic patterns

tcpdump provides low-level visibility that graphical tools cannot match in constrained environments.

Intel Dump

  • Capture with tcpdump -i <iface>

  • Use filters for protocols, ports, hosts, subnets

  • Inspect raw packet bytes with -A, -X

  • Save PCAPs with -w and read them with -r

  • Detect MITM, spoofing, and tunnels

  • Debug pivoting and encrypted connections

  • Essential tool for stealthy, command-line packet analysis

HOME LEARN COMMUNITY DASHBOARD