Introduction
Imagine trying to count all the red cars passing by on a busy highway in real-time. It is stressful and prone to error. Now imagine recording a video of that highway, taking the tape home, and pausing, rewinding, and fast-forwarding to count the cars perfectly.
In the world of cybersecurity and digital forensics, professionals rarely analyze network traffic live as it speeds by. Instead, they "record the video." They capture the raw traffic and save it into a standard format known as a Packet Capture (PCAP) file. This approach provides a permanent, unaltered record of network events, allowing for deep, stress-free analysis long after an incident has occurred.
That record-keeping mindset is essential because many security events are fleeting. A suspicious connection may last only a few seconds. A malware request may happen once and never repeat. If you did not preserve the traffic when it happened, you may lose the chance to reconstruct the event later. PCAP files therefore play the same role for network activity that disk images and log archives play in other forensic investigations.
In this lab, you will learn the essential art of managing PCAP files using tcpdump. You will practice silently writing live network traffic into a file, reading it back into your terminal for offline review, applying precise filters to investigate old traffic, and neatly extracting smaller slices of evidence to share with others.
Write Traffic to PCAP File
The first step in offline analysis is actually recording the data. Instead of having tcpdump clutter your screen with fast-scrolling text, you can instruct it to silently write everything directly to a storage file. This is achieved using the aptly named -w (write) flag.
Notice the difference in purpose between a screen capture and a PCAP capture. When printing to the terminal, tcpdump is already summarizing the packets for human reading. When writing to a PCAP file, it preserves the packet data in a form that other analysis tools can parse later. That is why writing to a file is usually the better choice when you think you may need to revisit the evidence.
When you use the -w flag followed by a filename, tcpdump stops talking to your screen entirely. It grabs the raw packet data right off the network interface and securely packages it into standard PCAP format.
First, let's ensure you are sitting in your main project directory where it is safe to save files:
cd ~/project
Now, it is time to capture. To prevent the program from recording endlessly and filling up your hard drive, we will use the -c (count) flag to tell it to stop exactly after 50 packets. We will also introduce the -i any flag, which tells the program to cast a wide net and capture traffic moving across all available network doors simultaneously.
Run the following command to grab 50 packets and pack them into a file named capture.pcap:
sudo tcpdump -i any -c 50 -w capture.pcap
Because your browser-based terminal constantly generates small amounts of background network traffic to stay connected, the capture will likely finish very quickly. You will see a brief summary output like this:
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
50 packets captured
52 packets received by filter
0 packets dropped by kernel
Notice the crucial difference here: absolutely no specific packet details were printed out. All the sensitive data was quietly tucked away into the file.
You can verify that your new recording exists and check its physical size using the standard Linux list command:
ls -lh capture.pcap
Seeing the capture.pcap file listed alongside its file size confirms that the raw network traffic was successfully saved and is ready for analysis.
Read Traffic from PCAP File
Now that you have securely saved your evidence, you need a way to look at it. This process is commonly known as offline analysis.
Offline analysis has an important practical advantage: it separates collection from interpretation. During a live incident, defenders often do not yet know which packets matter. Their first job is to preserve as much relevant evidence as possible. Only afterward, once the situation is stable, do they begin the slower process of asking targeted questions of the saved data.
To open and read a PCAP file, you flip the switch from write to read by using the -r flag, followed by your filename. The beauty of this command is that tcpdump will process the saved file exactly as if the packets were flying across the live network right now.
Run the following command to feed the packets from your newly created capture.pcap file back onto your screen:
tcpdump -r capture.pcap
Note: Capturing live traffic requires deep system access, which is why we use sudo. However, reading a normal file that you own does not. You can run the read command safely without special administrator privileges.
Suddenly, the 50 packets you silently captured earlier will spill out onto your terminal screen, looking identical to a live capture:
reading from file capture.pcap, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144
10:25:31.123456 IP 10.0.2.100.22 > 10.0.2.2.54321: Flags [P.], seq 1:100, ack 1, win 500, length 99
10:25:31.123500 IP 10.0.2.2.54321 > 10.0.2.100.22: Flags [.], ack 100, win 500, length 0
...
Reading from a static file is a massive relief for an analyst. Because the data is frozen in time, you can run the -r command over and over again, taking all the time you need, without ever altering the original evidence.
To streamline your analysis, you can stack the -r flag with other display options. For instance, using the -n flag commands tcpdump to skip translating IP addresses into computer names. This prevents the tool from doing extra background lookups, resulting in a much faster display and a much cleaner, more technical output:
tcpdump -n -r capture.pcap
Apply Filters to Existing PCAPs
Recording a large block of traffic often results in massive files filled with irrelevant chatter. When you are performing an investigation, you almost never want to read every single packet line by line.
This is why good evidence collection is usually broad, while good evidence analysis is usually narrow. During collection, you often prefer to miss as little as possible. During analysis, you aggressively reduce scope so you can focus on the packets that answer your current question. Using filters on a saved PCAP lets you do both without repeating the original capture.
The true magic of tcpdump is that all the powerful Berkeley Packet Filters (BPF) you use on live networks work exactly the same way on saved files. tcpdump will swiftly read through the entire PCAP file behind the scenes, but it will only print out the specific packets that match your chosen filter.
Let's test this by filtering your capture.pcap file so it exclusively displays TCP traffic, ignoring everything else. Run the following command:
tcpdump -n -r capture.pcap tcp
The output will be noticeably shorter, displaying only the packets identified as the TCP protocol.
You can be as precise as you need to be. For example, if you suspect an issue with the secure shell service (which runs heavily in the background of your terminal environment on port 22), you can retroactively apply a port filter.
Run this command:
tcpdump -n -r capture.pcap port 22
The output on your screen will strictly feature packets where the source or destination matches port 22:
reading from file capture.pcap, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144
10:25:31.123456 IP 10.0.2.100.22 > 10.0.2.2.54321: Flags [P.], seq 1:100, ack 1, win 500, length 99
...
This ability to apply filters after the fact is arguably the most critical skill in digital forensics. In a real-world crisis, defenders will cast a wide net and use -w to indiscriminately record everything on the network. Once the dust settles, they use -r and intricate BPF filters to calmly sift through the mountain of evidence, locating the exact moment an attacker breached the system.
Extract Specific Traffic to a New PCAP
Sometimes, you will discover that a capture file is simply too massive to easily transfer to another computer, or you might need to isolate a few highly suspicious packets to send to a specialized security team.
This practice is common in real investigations because evidence often needs to move between teams. A frontline analyst may capture a huge file, then extract only the suspicious traffic for malware analysts, incident responders, or developers. Smaller focused PCAPs are easier to share, faster to inspect, and less likely to expose unrelated background data that other teams do not need.
By brilliantly combining the read (-r), filter, and write (-w) functions into a single command, you can slice out only the relevant packets and permanently save them as a brand new, highly focused PCAP file.
Let's act as forensic analysts and extract only the TCP packets from our original capture.pcap evidence file. We will funnel those specific packets into a new file named tcp_only.pcap.
Run the following command:
tcpdump -r capture.pcap tcp -w tcp_only.pcap
When you execute this, your terminal will once again remain perfectly silent. tcpdump reads the original file, silently applies the tcp filter, and safely writes the approved packets directly into the new tcp_only.pcap file without putting anything on the screen.
You can verify that your new, highly specific evidence file was successfully created by listing the files:
ls -lh capture.pcap tcp_only.pcap
You will see both files standing side by side. Depending on what background traffic was occurring during your initial capture, tcp_only.pcap will likely be a bit smaller than the master capture.pcap file, as it successfully stripped out any irrelevant non-TCP noise.
To guarantee your new file only contains the intended data, you can simply read it back:
tcpdump -n -r tcp_only.pcap
This simple extraction technique is immensely valuable for organizing chaotic data and securely sharing only the necessary pieces of an investigation.
Summary
Congratulations! You have successfully mastered the fundamentals of PCAP file management.
In this lab, you learned how to treat network traffic like recorded evidence. You practiced safely capturing live network events into a storage file using the -w flag. You transitioned into an offline analysis mindset, reading the saved packets back into your terminal using the -r flag. You demonstrated how to retroactively apply BPF filters to existing capture files to quickly cut through the noise, and finally, you learned how to extract highly specific data into a new PCAP file for concise, targeted investigation.
These file management techniques are the absolute standard operating procedure for digital forensics, incident response, and advanced network troubleshooting. You now possess the core skills to properly capture and analyze the invisible data streams that power the modern world.
