Dictionary · Ethical Hacking Tools
tcpdump
Packet analysis · Intermediate
A command-line packet capture tool, common on Unix-like systems, that prints or saves packets matching a filter on an interface you are allowed to monitor.
It is the terminal cousin of a graphical analyzer. You choose an interface and a filter, then read a live summary or save a file for later.
Example: An administrator watches only name-lookup traffic on one interface to see whether queries leave the server.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Capture packets from the command line with a libpcap-style filter.
Authorized use: Use it only on systems you own or have written permission to test. Git in the Zone explains the tool; it does not launch it.
Operating systems: Linux, macOS, and other Unix-like systems. Windows users often use a graphical analyzer or a port of the same capture library.
Language you will see
- interface
- BPF filter
- pcap file
How to read the options
- -n: Shows numeric addresses instead of pausing to look up names.
- -i: Chooses the interface to listen on, such as a specific Ethernet port.
- port filter: Limits the capture to one service, for example name lookups, so the screen stays readable.
A single summary line
IP 192.0.2.10.51514 > 192.0.2.53.53: UDP, length 42
A datagram left the host from a temporary source port toward port 53, the usual name-service port. The line does not show whether the answer was correct.
Common misconception
- Saving a capture is not the same as analyzing it. The file still has to be interpreted, and it may contain sensitive data.