Introduction
When tracking a physical package, reading the shipping label is usually enough to know where it is going. But sometimes, you need to know what is actually inside the box.
In network analysis, looking at IP addresses and ports is like reading the shipping label (the packet header). However, the real valuable information—like the text of a webpage, a downloaded file, or even an unencrypted password—is tucked away inside the packet's payload.
This header-versus-payload distinction is fundamental in cybersecurity. Headers answer routing questions such as where the traffic came from, where it is going, and which protocol is in use. Payloads answer content questions such as what was requested, what was returned, and whether sensitive data was exposed. Mature analysts learn to move between these two views depending on the question they are trying to answer.
In this lab, you will learn how to use tcpdump to open the box and inspect the actual contents of network packets. You will explore how to ensure you are capturing the entire packet rather than just the label, and how to display the raw data in formats that both humans and computers can easily read. Finally, you will practice using Linux text tools to pluck cleartext secrets straight out of the flowing network traffic.
Increase Snaplen (Capture Full Packets)
To look inside the packet, you must first make sure tcpdump actually captures the whole thing. By default, older versions of tcpdump and some network tools try to save hard drive space by slicing off the end of every packet, capturing only the headers.
That tradeoff explains why packet capture is always a balance between completeness and cost. Capturing shorter packets uses less storage and can be faster, which matters on busy networks. Capturing full packets preserves more evidence, which matters during troubleshooting and forensics. There is no universal setting that is always correct. Analysts choose based on the question, the environment, and the performance budget.
The amount of data captured from a single packet is known as the "snapshot length" or snaplen for short. If you want the payload, you must tell the tool not to truncate the data. You control this using the -s flag. Setting the snaplen to 0 (-s 0) is a special trick that instructs tcpdump to use the maximum possible length, guaranteeing that no data is left behind.
In your background environment, we have already started a simple web server on port 8080. To capture the data cleanly, we will use a helpful Linux command called timeout to run tcpdump automatically for exactly 10 seconds.
Run the following command. It will start capturing on the loopback interface (lo), filter for port 8080, ensure full packets are grabbed (-s 0), and save the results to traffic.pcap in the background (using the & symbol):
sudo timeout 10 tcpdump -i lo port 8080 -s 0 -w ~/project/traffic.pcap &
While tcpdump is silently watching in the background, we need to generate some interesting web traffic for it to catch. Use the curl command to request a hidden file from the local web server:
curl http://localhost:8080/secret.txt
You will see the text SecretPayloadData123 printed out, which is the web server answering your request. Wait just a few seconds for the 10-second timeout timer to finish closing the background tcpdump process. You can press Enter a couple of times to see the background job completion message pop up.
To ensure everything worked, list the contents of your directory to check on the capture file:
ls -l ~/project/traffic.pcap
You should see the traffic.pcap file listed with a file size greater than zero, confirming that our full, un-sliced packets have been safely captured and stored.
Print ASCII Payloads
Now that we have successfully saved the full packets, it is time to open them up and read them. When network applications like basic websites, FTP servers, or old Telnet systems talk to each other, they often send their payload data as simple, unencrypted text.
This is also why unencrypted protocols are considered risky on untrusted networks. If a human can read the payload in a capture file, so can an attacker who intercepts the same traffic. In other words, packet inspection is not just an analysis technique. It is also a reminder of why modern systems prefer encrypted protocols such as HTTPS and SSH.
To reveal this plain text, tcpdump provides the -A flag. This handy option translates the raw binary data inside the packet into human-readable ASCII characters. It is an excellent way to quickly scan a capture file for readable words, error messages, or exposed credentials.
Use the -r flag to read your newly created capture file, and pair it with the -A flag to display the ASCII contents:
sudo tcpdump -r ~/project/traffic.pcap -A
As the text scrolls by, look closely at the output. You will first see the technical packet headers, but mixed in below them, you will see actual readable English.
You should easily spot the GET /secret.txt request that your curl command sent, followed by the web server responding with an HTTP/1.0 200 OK message. Near the very bottom of the server's response packet, you will clearly see the hidden payload exposed in plain text: SecretPayloadData123.
...
E..e..@.@.............Q...P.P...P...*......
GET /secret.txt HTTP/1.1
Host: localhost:8080
User-Agent: curl/7.81.0
Accept: */*
...
E.....@.@.............P...Q.P...P...*......
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.10.12
...
SecretPayloadData123
...
You will undoubtedly notice many random dots (.) scattered throughout the output. This is completely normal. The computer is trying to display underlying machine code (like TCP/IP headers) as text, and when it finds a binary value that does not match a standard keyboard character, it simply prints a dot instead.
Print Hex and ASCII (Hexdump)
While the ASCII view (-A) is fantastic for skimming plain text, it falls short when you are dealing with complex computer logic. Because binary protocols (like DNS requests or encrypted traffic) display as a messy sea of dots in ASCII mode, network engineers need a more precise tool.
Hexadecimal appears constantly in low-level security work because it is a compact way to represent raw bytes. Computers store data in binary, but binary is cumbersome for humans to read directly. Hex acts as a practical middle ground: every hex digit maps neatly to four binary bits, so analysts can inspect byte-level structure without drowning in long strings of zeros and ones.
To get the most accurate view of a packet's anatomy, you use the -X flag. This transforms the output into a structured format known as a Hexdump. It displays the exact hexadecimal (base-16) values of the data alongside the ASCII text, giving you the best of both worlds.
Run the following command to read your capture file and display the deeper hexdump view:
sudo tcpdump -r ~/project/traffic.pcap -X
Examine the structured blocks of data presented on your screen.
...
0x0000: 4500 0065 1419 4000 4006 28b4 7f00 0001 E..e..@.@.(.....
0x0010: 7f00 0001 8152 1f90 50b9 1017 5018 0200 .....R..P...P...
0x0020: fe59 0000 4745 5420 2f73 6563 7265 742e .Y..GET./secret.
0x0030: 7478 7420 4854 5450 2f31 2e31 0d0a 486f txt.HTTP/1.1..Ho
0x0040: 7374 3a20 6c6f 6361 6c68 6f73 743a 3830 st:.localhost:80
...
The output is carefully arranged into three distinct columns.
The far-left column (starting with 0x0000:) is basically a ruler, telling you the exact byte position within the packet.
The wide middle section displays the raw, unadulterated packet data in hexadecimal format, neatly grouped in two-byte pairs for easier reading by security analysts.
Finally, the far-right section attempts to translate that exact row of hex data back into familiar ASCII characters, acting as a quick reference guide.
By presenting the data side-by-side, you can pinpoint the exact binary value of any erratic character, which is an absolute necessity for reverse engineering complex network attacks.
Extract Cleartext HTTP Headers
Searching through raw ASCII or Hexdump output manually is acceptable for small tests, but it quickly becomes an impossible chore when analyzing real-world capture files containing thousands of packets.
This step introduces another core engineering idea: powerful workflows often come from combining small tools rather than relying on one giant tool to do everything. tcpdump is good at reading packets. grep is good at searching text. By connecting them with a pipe, you create a workflow that is both fast and easy to adapt. That composability is one of the defining strengths of the Linux command-line environment.
To solve this, Linux allows you to combine tools. By taking the ASCII output of tcpdump and piping (|) it directly into a text-searching tool called grep, you can instantly filter the massive stream of text to reveal only the specific needles you are looking for in the haystack.
For instance, if you are investigating web traffic, you might want to quickly map out what websites are being visited (the Host header) and what kind of web browsers the users are running (the User-Agent header).
Run the following command. It reads the file in ASCII mode, pipes the text into grep, and uses the -E flag to enable an extended search for lines that contain either "Host:", "User-Agent:", or "HTTP":
sudo tcpdump -r ~/project/traffic.pcap -A | grep -E "Host:|User-Agent:|HTTP"
Instantly, the messy output is replaced by a clean, highly organized summary of the web transaction:
GET /secret.txt HTTP/1.1
Host: localhost:8080
User-Agent: curl/7.81.0
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.10.12
This workflow is incredibly powerful for cybersecurity incident response. By swapping out the search words, you can use this exact same technique to effortlessly sweep an entire network capture for leaked passwords (e.g., grep -i "password"), confidential filenames, or known malicious command strings.
Summary
Congratulations! You have successfully completed the Inspecting Packet Contents lab.
You have elevated your skills from simply looking at the outside of network packets to diving deep into the actual data being transmitted. You practiced disabling packet truncation using the snaplen option (-s 0) to guarantee a complete capture. You then unlocked the contents using the -A flag for a readable ASCII view and the -X flag for a precise, professional Hexdump breakdown. Finally, you leveled up your workflow by combining tcpdump with standard Linux text tools to automatically hunt down and extract specific application data from the noise.
These core skills are the very foundation of deep packet inspection. Whether you are troubleshooting an obscure application bug or performing detailed network forensics on a security breach, you now have the tools to uncover exactly what is moving across the wires.
