decrypting…# TCPDump 🛡️📡 #Tool #BLUE #TTNet TCPDump is a powerful command-line packet analyzer used to inspect and analyze captured network traffic files. This guide focuses on using TCPDump for offline analysis from PCAP files. 📦 **LINK TO TOOL DOCUMENTATION [HERE](https://www.kali.org/tools/tcpdump/)** **TCPDump** allows you to: - Read and analyze saved packet captures. - Filter and display specific network events. - Extract valuable information from captured data. ---  --- ### Installing `tcpdump` #### On Debian/Ubuntu: ```sh sudo apt update && sudo apt install -y tcpdump ``` --- ## 🧰 Essential Analysis Commands ### 📖 Read Packets from a File ```bash tcpdump -r capture.pcap ``` Display packets from a saved PCAP file. ### 🔍 Filter by Host ```bash tcpdump -r capture.pcap host 192.168.1.1 ``` Display traffic involving a specific host. ### 🌐 Filter by Protocol ```bash tcpdump -r capture.pcap tcp ``` Show only TCP packets. ### 🎯 Filter by Port ```bash tcpdump -r capture.pcap port 443 ``` Display packets using a specific port (e.g., HTTPS). ### 📜 Display ASCII Content ```bash tcpdump -r capture.pcap -A ``` Show packet contents in ASCII for payload inspection. ### 🧩 Combine Filters ```bash tcpdump -r capture.pcap host 192.168.1.1 and port 22 ``` Filter packets by multiple criteria. ### 📝 Use Delimiters for Improved Readability ```bash tcpdump -r capture.pcap -E "password@1:2:3" ``` Use delimiters for enhanced readability when dealing with encrypted or segmented data. Replace `password@1:2:3` with the appropriate delimiter format as per your capture context. --- ## ⚙️ Advanced Usage ### 🕵️ Inspect DNS Queries ```bash tcpdump -r capture.pcap udp port 53 ``` Analyze DNS query packets. ### 🕰️ View Timestamps ```bash tcpdump -r capture.pcap -tt ``` Display absolute timestamps for event timing. ### 🗂 Limit Output ```bash tcpdump -r capture.pcap -c 100 ``` Show only the first 100 packets. ### 🧬 Display Packet Details ```bash tcpdump -r capture.pcap -X ``` Show packet contents in HEX and ASCII. --- ## 📋 Handy Options | Option | Description | |------------------|-----------------------------------------------| | `-r` | Read packets from a file | | `-A` | Display packet contents in ASCII | | `-X` | Display packet contents in HEX and ASCII | | `-c` | Capture a specific number of packets | | `-n` | Don’t resolve hostnames | | `-tt` | Show absolute timestamps | | `-v`, `-vv` | Increase verbosity of packet output | --- ## 🌐 Example Analysis Scenarios ### Scenario 1: Investigate Web Traffic ```bash tcpdump -r capture.pcap port 80 or port 443 ``` Identify HTTP and HTTPS packets. ### Scenario 2: Extract SSH Connections ```bash tcpdump -r capture.pcap tcp port 22 ``` Analyze SSH communication. ### Scenario 3: Display Packet Payloads ```bash tcpdump -r capture.pcap -A port 80 ``` Inspect HTTP payloads in ASCII. --- ## 🚀 Pro Tips ### 1️⃣ Combine Filters for Precision ```bash tcpdump -r capture.pcap host 10.0.0.5 and port 443 ``` Filter by both host and port for targeted analysis. ### 2️⃣ Focus on Full Packets ```bash tcpdump -r capture.pcap -s 0 ``` Ensure packets are displayed with their full content. ### 3️⃣ Increase Verbosity ```bash tcpdump -r capture.pcap -vv ``` Gain more detailed information per packet. --- ## 📚 References - [TCPDump Official Documentation](https://www.tcpdump.org/manpages/tcpdump.1.html) - [Wireshark Project](https://www.wireshark.org)