Lion Cipher Lab
Capture network packets with tcpdump
- SOC Analyst / Blue Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
Almost every network skill in defence — spotting an intrusion, debugging why an app cannot connect, understanding what a device is really talking to — starts with one question: what is actually on the wire? tcpdump is the plainest possible way to answer it. It is a small command-line packet-capture tool that is preinstalled or one command away on nearly every Linux and macOS system, prints what it sees as readable text, and saves captures in the exact .pcap format Wireshark, Zeek and every other analysis tool reads. Learning tcpdump first means that when you open Wireshark later you are not…
What you'll learn
- what a packet, a capture, an interface and a port are
- opening a terminal on Linux, macOS or Windows (WSL)
- why packet capture needs sudo/admin and what that means
- installing tcpdump
- listing capture interfaces with tcpdump -D
- capturing live packets to the screen with tcpdump -i
- saving a capture to a .pcap file with -w and reading it back with -r
- writing basic capture filters (host, port, tcp, udp)
- reading tcpdump's summary output line by line
Steps in this lab
- What a packet, a capture, and an interface are
- Open a terminal — and only capture what you own
- Install tcpdump
- List your interfaces — and why capture needs sudo
- Capture live to the screen — and read a line
- Save a capture to a .pcap file, then read it back
- Narrow it down with capture filters
- What you just learned — and where it goes next