Network Sniffing Packet Capture

Network Sniffing and Packet Capture

Sniffing networks and analyzing packet captures — from tcpdump and Wireshark through ARP spoofing, protocol analysis, and traffic decryption.

When to Use

• Capturing and analyzing network traffic during pentests
• Debugging network protocols and applications
• Analyzing malware network behavior
• Performing man-in-the-middle testing
• Extracting data from pcap files

Sniffing Techniques

# tcpdump basics
TCPDUMP_CAPTURES = {
    'capture_interface': "tcpdump -i eth0 -w capture.pcap",
    'capture_specific_host': "tcpdump host 10.0.0.5 -w host_traffic.pcap",
    'capture_http': "tcpdump port 80 or port 443 -w web_traffic.pcap",
    'filter_by_proto': "tcpdump 'tcp[tcpflags] & tcp-syn != 0' -w syns.pcap",
}

# Wireshark display filters
WIRESHARK_FILTERS = {
    'http_requests': "http.request",
    'tls_handshakes': "tls.handshake.type == 1",
    'dns_queries': "dns.flags.response == 0",
    'specific_ip': "ip.addr == 10.0.0.1",
    'credentials': "http.request.method == POST || ftp.request.command == USER",
    'follow_stream': "Right-click → Follow → TCP/UDP/HTTP Stream",
}

# Simple ARP spoofing for MITM (educational purposes)
def arp_spoof_demo(target_ip: str, gateway_ip: str, interface: str = 'eth0'):
    """
    Demonstration: ARP cache poisoning for network testing.
    Actual implementation requires scapy and proper authorization.
    """
    pass

Verification Checklist

• Proper authorization obtained before sniffing
• Interface in promiscuous mode (if needed)
• Capture filters applied to reduce file size
• Wireshark display filters used for analysis
• TLS traffic decrypted (if keys available)
• Extracted artifacts (files, credentials, sessions)
• Network captures stored securely and destroyed post-engagement
• Legal/compliance reviewed (wiretap laws, ToS)