Packet Analysis with tcpdump and Wireshark

• You cannot defend what you cannot see; captures reveal the actual behavior of hosts for better than config files.
• Many attacks (scanning, beacons, exfiltration) have distinctive packet signatures even when the payload is encrypted.
• tcpdump and Wireshark ship with every Linux distribution and run in pure CLI or GUI — they are the universal first tool.

A camera doesn't read every letter, but it catches who walks in, how often, and what they carry.

• The capture card places the interface in promiscuous mode to read frames not addressed to it (on your own segment).
• tcpdump reads raw frames and applies a BPF filter before much of the decode, keeping CPU and disk cost low.
• Each captured frame is timestamped and stored in pcap format; Wireshark then decodes the stack (Ethernet -> IP -> TCP/UDP -> payload).
• Non-root group membership (pcap) allows capture without full root privileges.

• A network engineer captures loopback traffic to prove an app misbehaves before blaming the firewall.
• A SOC analyst greps a pcap for reverse-DNS beacons to devices it should never contact.
• An SRE snapshots a packet-burst window during an outage and replays it in Wireshark to find the retransmit storm.

• Capture to file with a rotate size (e.g. -C 100 -W 10) so you never fill the disk.
• Apply capture filters up front — host, port, tcp — then read with display filters.
• Use the 'no-promiscuous' flag on switches/VM bridges you don't own; promiscuous mode without permission is a policy issue.
• Correlate timestamps with server logs (same NTP source) so an incident timeline lines up.

• Capturing Gbps of everything 'just in case' and having no disk or patience to read it.
• Forgetting -i lo when troubleshooting a same-host app, then seeing nothing.
• Reading only the payload and ignoring the retransmission flags that expose the real fault.
• Sharing captures that contain credentials or PII on a public paste site.

• Run tcpdump with -n to skip DNS lookups — resolution noise hides your signal.
• If the packet count is 0, check the interface name (ip link) — eth0 vs ens33 confuses everyone.
• Filter HTTP verbs with 'tcp port 80 and tcp[((tcp[12] & 0xf0) >> 2):4] = 0x47455420' or just use -A on a small capture.

• Capturing on the wire is a surveillance power: only capture links you own or have written permission to monitor.
• Strip credentials before sharing pcaps; redact hashes/she knew them as metadata.
• Promiscuous mode can degrade performance on busy switches and violates segmentation assumptions if used on a shared segment.