Mastering Network Packet Capture: A Guide for Security Pros

Packet capture is the ultimate source of truth in network troubleshooting. Whether you're debugging connectivity issues or investigating a security incident, knowing how to capture and analyze packets on different platforms is a superpower.

Step 1: Setting Up Packet Capture

Before you can analyze traffic, you need to set up your listening interface. Think of this as choosing which "phone line" to tap. You can list available interfaces using tcpdump.

student@lab:~$ sudo tcpdump -D
1. eth0 [Up, Running]
2. wlan0 [Up, Running]
3. lo [Up, Running, Loopback]
4. any (Pseudo-device that captures on all interfaces)

Step 2: Starting a Basic Capture

Once you know your interface (e.g., wlan0 for WiFi), you can start listening. It's best to limit the count (-c) initially so you don't get flooded with data.

student@lab:~$ sudo tcpdump -i wlan0 -c 5

Each line of output represents a single packet, showing the timestamp, source network IP, destination IP, and protocol flags.

Step 3: Mastering Filters

Detailed analysis requires filtering out the noise. You can filter by port, host, or protocol. This is crucial in high-traffic production environments.

Filter by Port (HTTP Traffic)

To see only web traffic, filter for port 80:

student@lab:~$ sudo tcpdump -i wlan0 port 80 -c 10

Filter by Host

To investigate a specific server, use the host filter:

student@lab:~$ sudo tcpdump -i wlan0 host google.com

Step 4: Interpreting TCP Flags

Understanding the TCP handshake is vital. Here are the common flags you'll encounter:

• [S] SYN: "Hello, I want to connect." (Initiation)
• [S.] SYN-ACK: "Hello back, connection accepted." (Response)
• [.] ACK: "Got it, connection established." (Confirmation)
• [F.] FIN-ACK: "I'm done, closing connection." (Termination)
• [R] RST: "Error! Reset connection." (Abort)

Enterprise Firewall Commands

In a corporate environment, you'll likely be working with hardware firewalls. Here is a cheat sheet for the major vendors:

🔥 Palo Alto Networks

# Set Filters
debug dataplane packet-diag set filter match source 192.168.1.100
debug dataplane packet-diag set filter on

# Start Capture
debug dataplane packet-diag set capture on

🛡 Fortinet (FortiGate)

FortiGate uses a built-in sniffer tool that is very similar to tcpdump.

# Basic syntax: diagnose sniffer packet [interface] [filter] [level]
diagnose sniffer packet any 'host 192.168.1.100' 4

🔵 Cisco ASA

# Create Access List
access-list CAP extended permit ip host 192.168.1.100 any

# Apply Capture
capture CAP interface inside access-list CAP