tcpdump

tcpdump is a command-line tool specifically designed for packet capture. tcpdump is often included with Linux distributions and is found on many network devices. For many of these devices, tcpdump has to be run as a root user or with root privileges as it will be monitoring the network traffic. The full page is available at http://www.tcpdump.org/.

To access the basic help menu, type the following into the Command Prompt:

 caine@caine:~$ tcpdump -h

The command will produce the basic options available for tcpdump:

The default setting of Tcpdump is to capture traffic on all available interfaces. Running the following command produces ...

Get Digital Forensics and Incident Response now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.