Lion Cipher Lab
Capture and read packets from the command line with tcpdump
- SOC Analyst / Blue Team
- Beginner
- ~35 min
- Free · no account required
Why it matters
The machines a defender most needs to watch usually have no screen: a web server in a rack, a cloud instance reached over SSH, a firewall, a remote sensor. On those, there is no window to open — you read the wire from the command line, and tcpdump is the tool that is already installed to do it. It is a small, fast packet capturer that prints traffic matching a filter you write, and it ships on nearly every Linux and macOS system by default, which makes it the one packet tool you can count on being there in an incident. Learning to point it at the right interface, narrow it with a filter, read…
What you'll learn
- running tcpdump with sudo
- choosing a capture interface (-i)
- BPF filters (host, port, tcp)
- reading tcpdump output fields
- limiting a capture (-c)
- writing and reading a pcap (-w / -r)
Steps in this lab
- First: capture only your own traffic, on your own network
- What tcpdump is, and making sure you have it
- See your interfaces and pick the one to capture on
- Your first controlled capture: a filter and a count limit
- Read the output: what each line is telling you
- Write real filters: host, port, protocol, and combining them
- Save a capture to a file, then read it back
- Why the headless version of this skill matters most