Introduction
Welcome to the Network Interface and Basic Capture lab!
Imagine your computer is a house, and network traffic is the mail being delivered and sent out. To understand what is happening, you would need a security camera watching the mailbox. In the Linux world, tcpdump acts as that powerful security camera for your network. It is a command-line tool that allows you to inspect the data flowing in and out of your system, helping you troubleshoot connectivity issues and spot suspicious activities.
Before going further, it helps to define the basic object we are observing. Network communication is broken into small units called packets. A packet is a tiny bundle of information that carries both delivery instructions and actual content. The delivery instructions live in headers, which contain details such as source address, destination address, protocol, and port information. The actual content is called the payload. In this first lab, you are not expected to decode every field yet. The goal is to become comfortable with the idea that tcpdump lets you watch these packets as they move through your system.
In this lab, you will learn the very basics of using tcpdump. We will start by identifying the "doors" of your computer (network interfaces). Then, you will practice capturing live network traffic, controlling how much data you collect, and finally, saving those captures to review them later just like a recorded video.
Identify Network Interfaces
Before we can set up our "security camera" to watch the traffic, we need to know where the doors are. In networking, these doors are called "network interfaces." A network interface is the connection point between your computer and the outside network. For instance, a regular wired connection is often named eth0, while an internal loopback connection (where the computer talks to itself) is named lo.
This distinction matters because tcpdump does not capture "the internet" in a vague global sense. It listens at a specific observation point inside the operating system. If you attach your capture to the wrong interface, you may see nothing useful even when the machine is very busy. Learning to choose the right interface is one of the first practical habits of packet analysis.
To find out which interfaces are available on your machine, tcpdump provides a simple discovery command. The -D flag stands for "Discover" or "Display."
Since eavesdropping on network traffic is a privileged action, we must use the sudo command to run tcpdump with administrator (super user) powers.
Run the following command in your terminal to list the interfaces:
sudo tcpdump -D
You should see an output similar to this:
1.eth0 [Up, Running, Connected]
2.lo [Up, Running, Loopback]
3.any (Pseudo-device that captures on all interfaces) [Up, Running]
4.bluetooth-monitor (Bluetooth Linux Monitor) [none]
5.nflog (Linux netfilter log (NFLOG) interface) [none]
6.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]
Looking at this list, eth0 (or eth1, depending on your specific virtual machine environment) is the primary door connecting your virtual machine to the external network. The lo interface is used purely for internal communication. You will also notice a special pseudo-device named any, which is a handy shortcut if you want to capture traffic crossing all active doors at the same time.
Note: If your primary interface is
eth1instead ofeth0, please replaceeth0witheth1in all subsequent commands throughout this lab.
Capture Live Traffic
Now that you know where your network doors are located, you can start capturing the packets (the mail) passing through them. We will focus on the eth0 interface since it handles the main network connection.
When people first use tcpdump, the output can feel intimidating because each line is a compact summary of one packet. Think of each line as a quick incident log entry. It does not show every byte yet, but it usually shows enough to answer high-level questions such as who talked to whom, which protocol was used, and how much data moved. In security work, that summary view is often the fastest way to detect whether a system is behaving normally or oddly.
To tell tcpdump which specific interface to monitor, you use the -i flag, which simply stands for "interface."
Run the following command to start capturing traffic on eth0:
sudo tcpdump -i eth0
Once you execute this command, tcpdump will immediately begin printing information about each packet directly to your terminal. It will look like a fast-scrolling matrix of text:
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:23:45.123456 IP 192.168.1.10.22 > 192.168.1.20.54321: Flags [P.], seq 1:100, ack 1, win 500, length 99
10:23:45.124567 IP 192.168.1.20.54321 > 192.168.1.10.22: Flags [.], ack 100, win 499, length 0
...
The program will run continuously, trying to capture everything until you explicitly tell it to stop. This is a common behavior for monitoring tools in Linux.
To stop the capture and regain control of your terminal, hold down the Ctrl key and press C. This keyboard shortcut (Ctrl+C) is universally used in Linux to interrupt and cancel a running program.
After you stop it, tcpdump will gracefully exit and provide a brief summary of what it saw, including how many packets were successfully captured and how many were dropped.
Manage Capture Length (Packet Count)
Manually stopping a packet capture with Ctrl+C is a good skill to have, but it is not always practical. On a busy network, your screen could be flooded with thousands of lines in just a few seconds. Sometimes, you only need a small sample of the traffic to see what is going on.
This introduces an important analyst mindset: collecting data is not automatically useful unless it stays manageable. In real environments, a badly planned capture can overwhelm your screen, fill storage, or bury the interesting event under thousands of unrelated packets. Limiting the packet count is a simple form of scope control. Good investigators constantly narrow their collection so they can think clearly about what they are seeing.
To solve this, tcpdump offers the -c flag, which stands for "count." This flag allows you to set a strict limit on the number of packets you want to capture. Once that number is reached, the tool stops automatically.
Run the following command to capture exactly 5 packets on the eth0 interface:
sudo tcpdump -i eth0 -c 5
You will see exactly 5 packets printed to your screen. Afterward, the command prompt will return to you automatically without requiring you to press Ctrl+C.
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:28:12.345678 IP 10.0.0.5.443 > 10.0.0.2.34567: Flags [P.], seq 1:50, ack 1, win 256, length 49
...
5 packets captured
5 packets received by filter
0 packets dropped by kernel
Using the -c flag is an excellent habit when exploring unfamiliar networks. It prevents your terminal from being overwhelmed and gives you a manageable chunk of data to analyze at your own pace.
Stop and Review Output
Watching text scroll by in real-time is challenging, especially when you are trying to spot a specific detail. A much better approach is to record the network traffic to a file so you can carefully review it later. This is exactly like recording security footage to a tape.
This shift from live viewing to saved evidence is a major turning point in cybersecurity work. Live capture is useful for immediate troubleshooting, but saved capture is what makes careful analysis, collaboration, and incident reconstruction possible. Once traffic is preserved in a file, you can replay it repeatedly, share it with teammates, and apply new filters later without needing the original event to happen again.
These recordings are typically saved with a .pcap extension, which stands for "packet capture."
A PCAP file is not just a text log. It stores the packet data in a structured binary format that analysis tools understand. That is why professionals prefer PCAP over copying terminal output into notes. The file preserves the original timing and raw bytes closely enough that other tools can later re-interpret the same evidence in different ways.
To save the output, you will use the -w flag, which stands for "write." We will combine this with our handy -c flag to grab a quick sample of 5 packets and write them into a file named capture.pcap.
Run the following command:
sudo tcpdump -i eth0 -c 5 -w capture.pcap
This time, the terminal will seem unusually quiet. tcpdump does not print the packet details to the screen when you use -w. Instead, it silently writes the raw binary data directly into the capture.pcap file in your current directory.
Now that the traffic is saved, you can play it back. You will use the -r flag, which stands for "read," to open the file. Because you are simply reading a file you own, you do not need sudo privileges for this step.
Run the following command to read your saved packets:
tcpdump -r capture.pcap
The 5 packets you captured earlier will be printed cleanly to your terminal, giving you all the time you need to examine them:
reading from file capture.pcap, link-type EN10MB (Ethernet), snapshot length 262144
10:35:22.111222 IP 10.0.0.2.22 > 10.0.0.5.55555: Flags [P.], seq 1:100, ack 1, win 300, length 99
...
Saving captures to a PCAP file is a cornerstone of professional network analysis. It allows you to keep reliable records, pause the action, and easily share the traffic logs with teammates when investigating complex issues.
Summary
Congratulations! You have successfully completed your first steps into network analysis.
In this lab, you learned how to deploy tcpdump as a powerful observation tool. You practiced identifying network interfaces using the -D flag and capturing live traffic on a specific interface using the -i flag. You also learned how to maintain control over the output volume by limiting the packet count with the -c flag. Finally, you discovered how to save raw network data into a permanent .pcap file using the -w flag and read it back for careful review using the -r flag.
These fundamental commands are the absolute bedrock of network troubleshooting and security investigations. By mastering these basics, you are well on your way to understanding the invisible conversations happening across your systems. Keep practicing, and the flowing data will soon start to make perfect sense!
