networkingdiagnostics

Packet Capture

packet-capturenetworkingtools
Plain English

A packet capture is a recording of network traffic. Like a security camera for the wire, it lets you replay exactly what was sent and received.

Technical Definition

Capture tools put an interface in a mode that copies frames to user space.

  • tcpdump -ni eth0 port 53 captures live; -w file.pcap saves; -r reads.
  • Wireshark and tshark decode the same files.
  • Filters use BPF syntax (host, port, net, tcp).
  • Capturing needs root or the wireshark group. Captures can hold passwords and cookies: treat them as sensitive.

Source: tcpdump(8); CompTIA Network+ N10-009 Exam Objectives v4.0

Packet Capture in practice

$ sudo tcpdump -ni any -c 5 icmp
$ sudo tcpdump -ni any -w ~/cap.pcap -Z $USER port 80
$ tcpdump -nr ~/cap.pcap
In the Wild

When two teams blame each other, the capture decides. Network+ N10-009 objective 5.5 lists protocol analyzers. BNLC lesson 5.7.

← Back to Dictionary