# Tcpdump

> Use for packet capture and protocol troubleshooting during authorized pentests. Trigger on validating network observations, capturing a narrow traffic slice, and supporting detection or protocol analysis with minimal tooling overhead.

- Skill: `timsonner/tcpdump` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/tcpdump`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/tcpdump/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/tcpdump

---


# Tcpdump

## Purpose

Use this skill for narrow packet capture when the assessment needs protocol evidence or quick network troubleshooting.

## Phase Fit

- Primary: Detection and Response Assessment
- Secondary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration

## Use When

- Need to capture a small protocol slice tied to the current hypothesis.
- Need fast packet evidence without a full GUI workflow.
- Need to support or cross-check defender telemetry.

## Avoid When

- Capture scope would include unnecessary sensitive traffic.
- Packet capture is not approved.

## Inputs

- Approved interface and time window
- Narrow filter aligned to the hypothesis
- Evidence handling rules for packet data

## Procedure

1. Use the narrowest filter that answers the question.
2. Keep capture duration short and targeted.
3. Record exact filter, interface, and time window.
4. Compare packet-level evidence to logs and expected behavior.
5. Protect all captures as sensitive evidence.

## Command Syntax

Replace sample interfaces and targets with approved in-scope values.

```bash
# Capture all traffic on an interface to file
tcpdump -i eth0 -w contoso-capture.pcap

# Filter to a specific host
tcpdump -i eth0 host 10.10.10.100 -w contoso-host.pcap

# Capture SMB traffic
tcpdump -i eth0 tcp port 445 -w contoso-smb.pcap

# Capture HTTP and DNS
tcpdump -i eth0 'tcp port 80 or udp port 53' -w contoso-http.pcap

# Capture LLMNR/NBT-NS for poisoning evidence
tcpdump -i eth0 'udp port 5355 or udp port 137' -w contoso-llmnr.pcap

# Print ASCII payload
tcpdump -i eth0 -A host 10.10.10.100 and port 80

# Read a saved capture file
tcpdump -r contoso-capture.pcap -n
```

## Evidence to Capture

- Protocol behavior tied to the tested activity
- Exact filter, interface, and capture window used
- Differences between packet evidence and defender visibility

## Safety Boundaries

- Minimize capture scope and duration.
- Protect packet captures as sensitive evidence.