Analyzing Network Traffic using PCAP and TCPDUMP

The packet capture library (lpcap), and tcpdump provide users with the tools necessary to capture and analyze network traffic.

Installation

On Debian/Ubuntu, these tools can be installed using APT. For example:

$ sudo apt-get insall tcpdump

Capture traffic and save it to a file for analysis

$ sudo tcpdump -i eth0 -w capture.pcap 

This command will cause all traffic on the 'eth0' interface to be written to a file named 'capture.pcap'.

Sometimes it might be better to focus/limit what is being captured if you are only interested in specific host/protocol/etc.

References

• Analyzing Network Traffic With Basic Linux Tools

• A tcpdump Tutorial and Primer