Digital Forensics and Incident Response - Second Edition

tcpdump

tcpdump is a command-line tool specifically designed for packet capture. tcpdump is often included with Linux distributions and is found on many network devices. For many of these devices, tcpdump has to be run as a root user or with root privileges as it will be monitoring network traffic. The documentation is available at http://www.tcpdump.org/. To perform a packet capture with tcpdump, the following process can be used:

1. To access the basic help menu, type the following into a Command Prompt:

dfir@ubuntu:~$ tcpdump -h

The output of the preceding command is as follows:

The default tcpdump setting is to capture traffic on all available ...