tcpdump basics — authorized network labs
tcpdump (tcpdump.org) is the classic CLI packet capture tool built on libpcap. Use it only on interfaces, hosts and files you are authorized to observe. For GUI review of the resulting PCAP, see Wireshark/PCAP.
Snapshot
| Field | Value |
|---|---|
| Tool | tcpdump (+ libpcap) |
| Job | Authorized packet capture to PCAP/PCAPng |
| Sibling | Wireshark / PCAP |
| RE peers | Binary triage on the same case stays separate (DiE/capa/Ghidra) |
Allowed framing
- Capturing loopback or a lab VLAN while a malware-lab VM talks to a sinkhole you control.
- Writing a classroom PCAP with a narrow BPF (
host,net,port) so Evidence stays small and reviewable. - Teaching students to record interface, filter string, duration and SHA-256 of the capture file.
- Handing the file to Wireshark for protocol literacy — not replacing binary RE tools.
Scope we will not cover
- No café/airport/neighbor Wi-Fi taps framed as "practice."
- No credential / cookie harvesting cookbooks from captures.
- No corporate MITM or "bypass banking TLS" recipes.
- No exploit delivery via malicious PCAPs framed as tutorials.
Beginner path (authorized only)
- Install tcpdump from the channel your lab approves; record the version (
tcpdump --version). - Start with loopback or an instructor-issued interface; use a tight BPF before any long capture.
- Write to a case directory (
-w case.pcap); hash the file when you stop. - Open the PCAP in Wireshark for display-filter literacy.
- If the case also has a binary, keep network Evidence separate from capa / Ghidra notes — bind them with the shared case ID.
- Use tcpdump for authorized, filter-first capture beside RE casework.
- Prefer Wireshark for deep protocol reading of the same PCAP.
- Refuse credential theft, third-party taps and MITM-for-piracy framing.
For legal, authorized and educational use only.
FAQ
How is this different from wireshark-pcap-authorized?
Wireshark/PCAP is the GUI analyzer orientation. This page is tcpdump CLI capture basics — BPF filters, writing files, then handing the PCAP to Wireshark when needed.
Capture filter vs Wireshark display filter?
tcpdump uses BPF capture filters that decide what hits disk. Wireshark display filters decide what you see afterward. Prefer tight BPF on shared networks so you do not retain unrelated personal traffic.
Can I tap café or airport Wi-Fi for practice?
No. Capture only on networks and hosts you are authorized to observe (lab VLAN, loopback, consenting classroom setup). Unauthorized taps are out of scope and often illegal.
Decrypting TLS with tcpdump?
tcpdump records bytes; TLS decryption still needs keys you are authorized to use (e.g., lab servers you control). BinBench will not publish corporate SSL interception or credential-theft recipes.
Does this teach credential harvesting or MITM attacks?
No. Authorized lab networks and consenting captures only — no phishing, cookie theft or third-party MITM cookbooks.