Intermediate LevelLinux Commands & SysAdmin
How do you capture and analyze network packets using tcpdump (tcpdump -i eth0 port 80 -w capture.pcap)?
❓ Interview Prompt: Explain tcpdump network packet analyzer, interface selection (-i), filtering syntax (host, port, proto), writing pcap files (-w), and ASCII output (-X).
'tcpdump' is a powerful command-line packet analyzer for capturing raw network traffic traversing network interfaces:
Key Options:
•
'-i eth0': Capture on specific interface ('-i any' for all).
•
'-n': Do not resolve IP addresses to hostnames (faster output).
•
'-w file.pcap': Write raw packets to file for Wireshark analysis.
•
Filter Expressions: 'host 10.0.0.1 and port 443', 'tcp src port 80'.
Code Implementation Example
bash
# Capture HTTPS traffic on eth0 writing to pcap file
sudo tcpdump -i eth0 -n port 443 -w https-traffic.pcap
# Inspect live ASCII HTTP payload data on port 80
sudo tcpdump -i any -n -X port 80💡Capturing network traffic pcap files using tcpdump filters.
🎯 Interview Key Takeaway
Use tcpdump -i any -n port <port> -w file.pcap to capture raw network traffic for packet-level troubleshooting.
#tcpdump#Packet Capture#Wireshark#Networking#Intermediate
Back to all Linux Commands & SysAdmin Questions→