Packet capture records traffic visible at a chosen observation point. It can reveal protocol exchanges and timing, but it can also collect credentials, personal data, and unrelated users' traffic. Obtain authorization, minimize scope, protect files, and follow retention policy.
Troubleshooting · Lesson 5
Packet Analysis
Learn how to capture a bounded, filtered packet trace and analyze it safely with tcpdump.
Choosing the Observation Point
Capture on the interface and network namespace through which the affected flow actually passes. Bridges, containers, VPNs, bonds, VLANs, and offload can change what one interface shows. Use ip route get and ip link to identify candidates before capturing.
Why does capture-interface choice matter?
Capturing a Bounded Flow
Capture up to 100 packets without name resolution, restricted to a host and TCP port:
$ sudo tcpdump -i enp1s0 -n -c 100 -w incident.pcap \
'host 192.0.2.25 and tcp port 443'
-i selects the interface, -n keeps numeric names, -c bounds packet count, -w writes pcap data, and the final expression is a capture filter. Also set a time bound externally when traffic may be absent.
What does -c 100 do?
Reading Captured Packets
Analyze the saved file without changing it:
$ tcpdump -n -tttt -r incident.pcap
Read timestamps, protocol, source, destination, flags, sequence or acknowledgement data, and length according to the protocol. A capture timestamp marks observation at this host, not necessarily the exact transmit time elsewhere. Clock synchronization matters when correlating captures from several systems.
Which option reads packets from a saved pcap file?
Interpreting Absence and Encryption
No captured packet can mean the wrong interface or namespace, capture loss, an overly narrow filter, offload effects, routing elsewhere, or no traffic. Check tcpdump's received and dropped counters and reproduce a known event.
TLS and other encryption normally hide application payloads while leaving useful metadata such as endpoints, timing, sizes, TCP behavior, and parts of handshakes. Do not attempt unauthorized decryption or collect private keys casually.
What does an empty filtered capture prove?
Protecting and Sharing Evidence
Store pcaps with restrictive permissions, record command, host, interface, timezone, filter, and incident window, and hash evidence when integrity matters. Before sharing, minimize or sanitize data with tools and procedures that preserve needed fields; packet payloads and even metadata can identify users and systems.
How should an incident pcap be handled?
Lesson complete
You finished Packet Analysis
You can now create a useful packet capture without making it unnecessarily broad or unsafe.
Choose the correct interface and network namespace.
Bound captures by filter, packet count, and time.
Save raw packets and analyze the file read-only.
Treat absence and encrypted payloads with proper limits.
Protect capture confidentiality, integrity, and provenance.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account