timsonner Tcpdump
Purpose
Use this skill for narrow packet capture when the assessment needs protocol evidence or quick network troubleshooting.
Phase Fit
- Primary: Detection and Response Assessment
- Secondary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration
Use When
- Need to capture a small protocol slice tied to the current hypothesis.
- Need fast packet evidence without a full GUI workflow.
- Need to support or cross-check defender telemetry.
Avoid When
- Capture scope would include unnecessary sensitive traffic.
- Packet capture is not approved.
Inputs
- Approved interface and time window
- Narrow filter aligned to the hypothesis
- Evidence handling rules for packet data
Procedure
- Use the narrowest filter that answers the question.
- Keep capture duration short and targeted.
- Record exact filter, interface, and time window.
- Compare packet-level evidence to logs and expected behavior.
- Protect all captures as sensitive evidence.
Command Syntax
Replace sample interfaces and targets with approved in-scope values.
# Capture all traffic on an interface to file
tcpdump -i eth0 -w contoso-capture.pcap
# Filter to a specific host
tcpdump -i eth0 host 10.10.10.100 -w contoso-host.pcap
# Capture SMB traffic
tcpdump -i eth0 tcp port 445 -w contoso-smb.pcap
# Capture HTTP and DNS
tcpdump -i eth0 'tcp port 80 or udp port 53' -w contoso-http.pcap
# Capture LLMNR/NBT-NS for poisoning evidence
tcpdump -i eth0 'udp port 5355 or udp port 137' -w contoso-llmnr.pcap
# Print ASCII payload
tcpdump -i eth0 -A host 10.10.10.100 and port 80
# Read a saved capture file
tcpdump -r contoso-capture.pcap -n
Evidence to Capture
- Protocol behavior tied to the tested activity
- Exact filter, interface, and capture window used
- Differences between packet evidence and defender visibility
Safety Boundaries
- Minimize capture scope and duration.
- Protect packet captures as sensitive evidence.