tcpdump
Packet Capture (CLI) · Intermediate
Command-line packet capture, ideal for servers and scripted collection.
Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.
What to learn
- BPF filter syntax
- Writing pcap files
- Reading captures
- Verbose decoding
Legitimate use
Standard on Linux servers for diagnosing network issues and collecting evidence.
Official docs →Example commands (lab VMs only)
- sudo tcpdump -i lo port 8080Capture localhost traffic on port 8080
- tcpdump -r lab.pcap -nnRead a capture without name resolution