# Mastering Network Packet Capture Source: https://ai.techclick.in/blog_network_security Markdown: https://ai.techclick.in/blog_network_security.md Publisher: Techclick Infosec Pvt Ltd Complete guide to network packet capture using tcpdump on Linux, Palo Alto PAN-OS debug commands, FortiGate sniffer, and Cisco ASA capture. Practical examples Mastering Network Packet Capture student learning map A visual study map for Mastering Network Packet Capture showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP Mastering Network Packet Capture Networking ยท learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start Pick where you want to start 2. Understand Step 1: Setting Up Packet Capture 3. Prove Step 2: Starting a Basic Capture 4. Practice Step 3: Mastering Filters How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Infographic: concept-to-practice path Mastering Network Packet Capture Learn Pick where you want to start Map Step 1: Setting Up Packet Capture Operate Step 2: Starting a Basic Capture Verify Step 3: Mastering Filters Read in this order so the topic becomes a working runbook, not isolated notes. Start with the mental model, then move into the workflow, evidence, and practice questions. Infographic: evidence ladder Do not answer from memory only - prove the stage Scope who, what, where, when Policy rule, condition, action Telemetry logs, event, metric Retest original symptom fixed Interview signal: every claim should map to observable evidence. Use this ladder when the question asks for troubleshooting, rollout, or proof. Infographic: healthy vs broken thinking Healthy answer vs broken answer Healthy Names the object, follows the flow, checks logs, and validates the result. Broken Lists features randomly, changes production first, or skips verification. Your goal: connect the concept to a realistic production decision. This comparison turns the article into an interview and troubleshooting checklist. Infographic: mini runbook Mini runbook for this topic Before baseline and scope During change one thing After monitor and rollback Use this page to prepare one practical story: problem, evidence, fix, verification. Convert the learning into a practical story you can explain to a manager or interviewer. ## Pick where you want to start 1 ### Set up capture List interfaces and start a basic, count-limited tcpdump. 2 ### Master filters Filter by port, host and the -nn / -w flags. 3 ### Read TCP flags [S], [S.], [.], [F.], [R] โ€” what the handshake is telling you. 4 ### Firewall capture Palo Alto 4-stage, FortiGate sniffer, Cisco ASA. ๐Ÿš€ Key Takeaways In this guide, you'll learn how to use tcpdump , filter traffic effectively, and perform captures on enterprise firewalls like Palo Alto, FortiGate, and Cisco ASA. Legend endpoint / capture host (royal) the device sniffing the wire โ€” tcpdump / firewall (cyan) destination โ€” server / internet (magenta) packet captured / allowed packet dropped / missed PAN-OS dataplane โ€” the four capture stages Palo Alto dataplane four-stage capture flow A packet enters at the receive stage, passes the firewall policy stage, then either leaves at the transmit stage or is sent to the drop stage if the dataplane discards it. receive ingress interface - firewall post-policy, pre-egress transmit egress interface out the wire to 8.8.8.8 drop dataplane discarded it if policy denies / no route Capture all four stages โ€” receive , firewall , transmit , drop โ€” and compare them. A packet that shows in receive but not in transmit , and turns up in drop , tells you exactly where it died. ## Step 1: Setting Up Packet Capture Before you can analyze traffic, you need to set up your listening interface. Think of this as choosing which "phone line" to tap. You can list available interfaces using tcpdump . List Interfaces student@lab:~$ sudo tcpdump -D 1. eth0 [Up, Running] 2. wlan0 [Up, Running] 3. lo [Up, Running, Loopback] 4. any (Pseudo-device that captures on all interfaces) ## Step 2: Starting a Basic Capture Once you know your interface (e.g., wlan0 for WiFi), you can start listening. It's best to limit the count ( -c ) initially so you don't get flooded with data. Basic Capture student@lab:~$ sudo tcpdump -i wlan0 -c 5 Each line of output represents a single packet, showing the timestamp, source network IP, destination IP, and protocol flags. Quick check ยท Limiting a capture Why is it best practice to add -c 5 (or another small count) when you start a basic tcpdump on a busy interface? a) It encrypts the captured packets. b) It limits the count so you aren't flooded with data โ€” the capture grabs a few packets and stops on its own. c) It speeds up the network interface. d) It resolves IP addresses to hostnames automatically. Correct: b. -c caps the number of packets so the capture stops itself instead of flooding you with output โ€” the same self-limiting idea as the count field on a FortiGate sniffer. ## Step 3: Mastering Filters Detailed analysis requires filtering out the noise. You can filter by port, host, or protocol. This is crucial in high-traffic production environments. ### Filter by Port (HTTP Traffic) To see only web traffic, filter for port 80: student@lab:~$ sudo tcpdump -i wlan0 port 80 -c 10 ### Filter by Host To investigate a specific server, use the host filter: student@lab:~$ sudo tcpdump -i wlan0 host google.com Anatomy of a production tcpdump command Breakdown of a filtered tcpdump write command The command sudo tcpdump dash nn dash i eth0 dash w slash tmp slash cap dot pcap host 10.1.1.5 and port 443, with each flag labelled. sudo tcpdump -nn -i eth0 -w /tmp/cap.pcap host 10.1.1.5 and port 443 tcpdump the capture tool -nn no name/port lookups -i eth0 interface to sniff -w /tmp/cap.pcap write raw frames for Wireshark host ... and port 443 BPF filter โ€” scope FIRST The two flags every L3 engineer types reflexively: -nn (skip both name and port resolution) and -w (write raw frames to a file). The host ... and port BPF filter scopes the capture before it runs โ€” the golden rule on any busy interface. Quick check ยท The -nn flag A colleague's capture is slow and keeps showing service names like https instead of 443 . Which flag fixes both at once? a) -w โ€” it writes the packets to a file. b) -c โ€” it limits the packet count. c) -nn โ€” it skips both IP-to-hostname and port-to-service-name resolution, so capture stays fast and shows raw numbers. d) -D โ€” it lists the interfaces. Correct: c. -nn turns off both name resolutions: -n skips DNS lookups, the second n skips port-to-service lookups. No DNS round-trips means a faster capture and raw numbers you can match against firewall rules. ## Step 4: Interpreting TCP Flags Understanding the TCP handshake is vital. Here are the common flags you'll encounter: [S] SYN : "Hello, I want to connect." (Initiation) - [S.] SYN-ACK : "Hello back, connection accepted." (Response) - [.] ACK : "Got it, connection established." (Confirmation) - [F.] FIN-ACK : "I'm done, closing connection." (Termination) - [R] RST : "Error! Reset connection." (Abort) The TCP handshake as it appears in a capture TCP three-way handshake flag exchange Client sends SYN, server replies SYN-ACK, client sends ACK to establish; a healthy close uses FIN-ACK, while a lone RST after a SYN means the port is closed or denied. CLIENT SERVER - [S] SYN โ†’ "I want to connect" [S.] SYN-ACK โ† "Accepted" [.] ACK โ†’ "Established" [R] RST โ† port closed / denied A lone RST after the SYN โ€” instead of a SYN-ACK โ€” is the tell-tale of a closed port or a firewall deny. A healthy session is [S] โ†’ [S.] โ†’ [.] , and closes with [F.] FIN-ACK. If the only reply to a [S] is a lone [R] , the port is closed or a firewall denied the session. Quick check ยท Reading the handshake In a capture you see a client [S] go out, but the only reply is a single [R] from the server. What does that most likely mean? a) The connection completed the three-way handshake successfully. b) The server is gracefully closing an established session. c) A lone RST after a SYN usually means the port is closed or a firewall denied the session. d) The packet was DNS, not TCP. Correct: c. A healthy handshake would answer the SYN with a SYN-ACK [S.] . A lone [R] (RST) straight after the [S] usually means the destination port is closed, or a firewall denied the session. ๐Ÿ”‘ Lock in the key terms โ€” tap to flip ๐Ÿง -nn tap to flip Skips both name resolutions โ€” IP-to-hostname and port-to-service. Faster captures, no DNS round-trips polluting output, raw numbers you can match to firewall rules. ๐Ÿ’พ -w / pcap tap to flip -w /tmp/cap.pcap writes raw frames (not the printed summary) to a file. Capture where the traffic is, then open the .pcap in Wireshark where you have a screen. ๐Ÿ”ฅ packet-diag tap to flip PAN-OS dataplane capture. Set a filter first, then capture the four stages โ€” receive, transmit, drop, firewall โ€” to pinpoint exactly where a packet died. Files land in /opt/pancfg/mgmt/pcaps/ . ๐Ÿ›ก verbosity 6 tap to flip The FortiGate sniffer's level: 1 = headers only, 4 = headers + interface, 6 = full packet contents โ€” the equivalent of tcpdump -X . ## Enterprise Firewall Commands In a corporate environment, you'll likely be working with hardware firewalls. Here is a cheat sheet for the major vendors: ### ๐Ÿ”ฅ Palo Alto Networks โ€” full 4-stage capture workflow PAN-OS captures on the dataplane at four stages: receive (ingress), transmit (egress), drop (anything the dataplane discards), and firewall (post-policy, pre-egress). Always run all four โ€” comparing them tells you exactly where a packet died. PAN-OS ยท dataplane packet-diag debug dataplane packet-diag set filter match source 10.1.1.5 destination 8.8.8.8 debug dataplane packet-diag set filter on debug dataplane packet-diag set capture stage receive file rx.pcap debug dataplane packet-diag set capture stage transmit file tx.pcap debug dataplane packet-diag set capture stage drop file drop.pcap debug dataplane packet-diag set capture stage firewall file fw.pcap debug dataplane packet-diag set capture on # ... reproduce traffic ... debug dataplane packet-diag set capture off debug dataplane packet-diag set filter off debug dataplane packet-diag show setting # Files in /opt/pancfg/mgmt/pcaps/ view-pcap follow no filter equal yes filter-pcap rx.pcap ### ๐Ÿ›ก Fortinet (FortiGate) FortiGate uses a built-in sniffer tool that is very similar to tcpdump. The trailing integer is the verbosity level โ€” 1 = headers only, 3 = headers + payload summary, 4 = headers + interface, 6 = full packet contents (the L3-equivalent of tcpdump -X ) . FortiGate ยท diagnose sniffer packet # Basic syntax: diagnose sniffer packet [interface] [filter] [verbosity] [count] [timestamp] diagnose sniffer packet any 'host 192.168.1.100' 4 # Full packet contents (level 6), 100 frames, absolute timestamp diagnose sniffer packet any 'host 10.1.1.5' 6 100 a ### ๐Ÿ”ต Cisco ASA Cisco ASA ยท capture # Create Access List access-list CAP extended permit ip host 192.168.1.100 any # Apply Capture capture CAP interface inside access-list CAP ### ๐Ÿง tcpdump โ€” write to pcap, no name resolution The two flags every L3 engineer types reflexively: -nn (skip both name and port resolution โ€” capture stays fast and isn't fooled by DNS) and -w (write raw frames to a file for Wireshark). tcpdump ยท write pcap sudo tcpdump -nn -i eth0 -w /tmp/cap.pcap host 10.1.1.5 and port 443 โš  Production gotchas Unfiltered capture on a 10 Gbps interface will saturate the management CPU and may trigger HA failover. - Capturing on TAP/SPAN may miss asymmetric flows โ€” only one direction may be mirrored. - Vendor firewalls capture on different planes (PA: dataplane vs management โ€” different commands). Always filter by IP/port FIRST, capture SECOND. Why a SPAN/TAP can miss half the conversation Asymmetric routing past a one-directional SPAN port The request from client to server passes the mirrored switch, but the reply returns over a different path that the SPAN never sees, so the capture shows SYNs with no SYN-ACKs. CLIENT sends SYN Switch w/ SPAN mirrors ONE direction Other path return route (unseen) SERVER replies SYN-ACK [S] โ†’ โ† [S.] (missed) The mirror sees the SYN but not the return SYN-ACK โ€” so you wrongly conclude the server is down. A SPAN/mirror port often mirrors only one direction; with asymmetric routing the reply takes a different path the tap never sees. Fix it by mirroring both directions (TX and RX), tapping a chokepoint both flows traverse, or capturing on the endpoint/firewall itself. โš  Enterprise Warning Always use specific filters on production firewalls. Capturing "all" traffic can crash the CPU and cause a network outage. Be specific and precise. โœ“ Quick Lab Quick Lab (10 min): (1) On a Linux box, run sudo tcpdump -nn -i any -w /tmp/cap.pcap host 8.8.8.8 and port 53 โ€” generate DNS lookups with dig . Open in Wireshark and confirm packets captured. (2) On a PA lab, run the 4-stage packet-diag flow (rx/tx/drop/fw), then view-pcap each file to inspect what hit which stage. (3) Compare: which capture method showed you info the other missed? ### โ–ถ Watch one capture workflow, start to finish You're chasing a connectivity issue to 10.1.1.5:443 . Press Play for the clean, filtered workflow โ€” then Break it to see the classic "capture everything" mistake on a production firewall, and the fix. โ‘  Pick the interface Run sudo tcpdump -D to list interfaces, then choose the one the traffic actually uses (or any if you're not sure). โ–ผ โ‘ก Filter FIRST Scope the capture before it runs: host 10.1.1.5 and port 443 . On a firewall, the equivalent filter (PA packet-diag set filter , FortiGate 'host 10.1.1.5' ) goes on first too. โ–ผ โ‘ข Capture to a file sudo tcpdump -nn -i eth0 -w /tmp/cap.pcap host 10.1.1.5 and port 443 โ€” -nn keeps it fast, -w writes raw frames for Wireshark. โ–ผ โ‘ฃ Reproduce + stop Trigger the traffic, then stop the capture (or let -c / the firewall count field stop it). Read the flags: [S] out, [S.] back = the handshake is healthy. โ–ผ โ‘ค Analyse in Wireshark Copy the .pcap off the box and open it in Wireshark โ€” protocol decode, follow-stream, expert info. Capture where the traffic is; analyse where you have a screen. Press Play to step through the clean workflow, then press Break it . โ–ถ Play Next โ–ถ โš  Break it โ†บ Reset Quick check ยท Capture on a production firewall An engineer runs an unfiltered capture on a 10 Gbps interface of a production firewall to "just have a quick look." What's the real risk? a) None โ€” firewalls are built to capture all traffic at line rate. b) Every frame is forced up to the capture CPU; it saturates, latency spikes, and on an HA pair it can miss heartbeats and trigger a failover โ€” a "quick look" becomes an outage. c) The capture file is automatically encrypted and unreadable. d) The firewall switches to a backup ISP. Correct: b. An unfiltered capture on a high-speed interface forces every frame up to the CPU running the capture. That CPU saturates, latency spikes, and on an HA pair it can miss heartbeats and fail over. The rule is always: filter by IP/port first, capture second โ€” and add a count limit so the capture stops on its own. ### ๐Ÿค– Ask the AI Tutor Tap any question โ€” instant, scoped to this lesson. The exact framing an interviewer wants to hear. What's the difference between tcpdump and Wireshark? Why does -nn matter? How do I capture on a Palo Alto firewall? How is FortiGate's sniffer different from tcpdump? Why can a capture crash a production firewall? My SPAN capture is missing half the traffic โ€” why? Pre-curated from this lesson's content + real troubleshooting Q&A. For a live issue, bring your .pcap to chat.techclick.in. ## ๐Ÿ“ Check your understanding 10 scenario questions โ€” the depth you'll see in interviews and on the job. Pick one answer per question. You need 70% (7 of 10) to mark this lesson complete on your profile. Q1 You're on a headless Linux server with no GUI. What's the standard packet-capture workflow? (a) Install Wireshark's GUI on the server and analyse there. (b) You can't capture without a GUI. (c) Use Wireshark to capture remotely over DNS. (d) Capture with tcpdump and -w to a .pcap , copy it off the box, then open it in Wireshark on your laptop. Correct: (d). tcpdump is the command-line capture tool; Wireshark is the GUI analyser. Capture where the traffic is (tcpdump -w ), copy the .pcap off, and analyse where you have a screen. Q2 You don't know which interface the traffic uses on a Linux box. What's the first command, and the safe interface choice? (a) tcpdump -X , then guess lo . (b) tcpdump -w , then pick wlan0 always. (c) tcpdump -D to list interfaces, then capture on any if you're unsure which one carries the flow. (d) There's no way to list interfaces from tcpdump. Correct: (c). tcpdump -D lists available interfaces. The any pseudo-device captures on all interfaces โ€” the safe choice when you don't yet know which one the traffic uses. Q3 What does -nn do in tcpdump, and why type it reflexively? (a) It skips both IP-to-hostname and port-to-service-name resolution โ€” faster captures, no DNS pollution, raw numbers to match against firewall rules. (b) It doubles the capture buffer size. (c) It enables name resolution for cleaner output. (d) It limits the capture to non-TCP packets. Correct: (a). -n skips IP-to-hostname lookups; the second n skips port-to-service lookups. No DNS round-trips means a faster capture, no self-generated DNS noise, and raw numbers you can match against firewall rules. Q4 Which command correctly filters for one host AND one port and writes the result to a file for Wireshark? (a) sudo tcpdump -i eth0 host 10.1.1.5 or port 443 (b) sudo tcpdump -r /tmp/cap.pcap (c) sudo tcpdump -nn -i eth0 -w /tmp/cap.pcap host 10.1.1.5 and port 443 (d) sudo tcpdump -D host 10.1.1.5 port 443 Correct: (c). Use the BPF and keyword to combine conditions, and -w to write raw frames to a .pcap . (a) uses or (too broad), (b) reads a file, and (d) -D just lists interfaces. Q5 In a capture, a client [S] goes out and the server replies with a lone [R] . What does that usually indicate? (a) The session is established and healthy. (b) The server is closing the session gracefully. (c) The port is closed, or a firewall denied the session โ€” a healthy handshake would answer with [S.] (SYN-ACK). (d) The packet was ICMP, not TCP. Correct: (c). A healthy handshake answers a SYN [S] with a SYN-ACK [S.] . A lone [R] (RST) right after the SYN usually means the destination port is closed or a firewall denied the session. Q6 On a PAN-OS firewall, a packet shows up in the receive capture but never in transmit , and appears in drop . What does the four-stage comparison tell you? (a) The packet egressed normally; nothing is wrong. (b) The dataplane received the packet but discarded it before egress โ€” it was dropped, not transmitted. Comparing the stages shows exactly where it died. (c) The capture filter was never set. (d) The management plane handled the packet instead. Correct: (b). PAN-OS captures on four dataplane stages โ€” receive (ingress), firewall (post-policy), transmit (egress), and drop. A packet in receive + drop but not transmit means the dataplane discarded it before it left. That's the whole point of running all four and comparing. Q7 On a FortiGate, you run diagnose sniffer packet any 'host 10.1.1.5' 6 100 a . What does the 6 control? (a) The number of packets to grab. (b) The verbosity level โ€” 6 = full packet contents, the equivalent of tcpdump -X (1 = headers only, 4 = headers + interface). (c) The interface index to capture on. (d) The timestamp format. Correct: (b). In diagnose sniffer packet [interface] [filter] [verbosity] [count] [timestamp] , the verbosity integer is the third field. 6 = full packet contents (like tcpdump -X ); here 100 is the count and a the absolute timestamp. Q8 On a Cisco ASA, what's the correct way to capture only traffic from 192.168.1.100 on the inside interface? (a) Bind a capture to an access-list that selects the traffic: access-list CAP extended permit ip host 192.168.1.100 any , then capture CAP interface inside access-list CAP . (b) Run tcpdump -i inside directly on the ASA. (c) Use debug dataplane packet-diag as on Palo Alto. (d) Use diagnose sniffer packet as on FortiGate. Correct: (a). On a Cisco ASA you bind a capture to an access-list that selects the interesting traffic, then attach the capture to an interface. View it live with show capture CAP and export the pcap over HTTPS. The PA and FortiGate commands belong to those vendors. Q9 Why must you always set a filter before capturing on a busy production firewall? (a) Filters make the capture file smaller, but there's no real risk to capturing everything. (b) Filters are required for Wireshark to open the file. (c) Without a filter the capture won't include timestamps. (d) An unfiltered capture on a high-speed interface forces every frame to the capture CPU, saturating it โ€” latency spikes and an HA pair can miss heartbeats and fail over. Filter by IP/port first, capture second. Correct: (d). Unfiltered capture on a 10 Gbps interface saturates the management/capture CPU; latency spikes and an HA pair can miss heartbeats and trigger a failover. Always filter by IP/port first and add a count limit so it stops on its own. Q10 Your SPAN/mirror capture shows SYNs leaving but no SYN-ACKs coming back, so you suspect the server is down. What's the more likely explanation? (a) The server really is down โ€” a SPAN port always sees both directions. (b) The SPAN often mirrors only one direction, and with asymmetric routing the reply takes a different path โ€” so a single tap sees only one side. Mirror both directions, tap a chokepoint, or capture on the endpoint/firewall. (c) tcpdump can't capture SYN-ACKs. (d) The capture needs the -nn flag to see replies. Correct: (b). A SPAN/mirror port often mirrors only one direction, and with asymmetric routing the request and reply take different paths โ€” so a single tap sees only half the flow. Fix it by mirroring both directions (TX and RX), tapping a chokepoint both flows traverse, or capturing on the endpoint/firewall itself. Submit answers Try again Lesson complete โ€” saved to your profile. Almost! Review the sections above and try again โ€” you need 70% (7 of 10) to mark this lesson complete. ## Frequently Asked Questions The packet-capture questions interviewers and seniors actually ask โ€” and the answers L1/L2 engineers reach for in a live troubleshooting call. What is the difference between tcpdump and Wireshark? tcpdump is a command-line capture tool. It sniffs frames on an interface, applies a filter, and either prints a summary or writes raw packets to a file. Wireshark is the GUI analysis tool โ€” protocol decoding, follow-stream, expert info, graphs. The standard workflow on a headless server is: capture with tcpdump ( tcpdump -nn -i eth0 -w /tmp/cap.pcap host 10.1.1.5 ), copy the .pcap off the box, then open it in Wireshark on your laptop. Capture where the traffic is; analyse where you have a screen. How do I capture packets on a FortiGate firewall? FortiGate uses a built-in sniffer that behaves like tcpdump: diagnose sniffer packet <interface> '<filter>' <verbosity> <count> <timestamp> - Use any for the interface when you don't know which one the traffic uses. - Verbosity : 1 = headers only, 4 = headers + interface name, 6 = full packet contents (the equivalent of tcpdump -X ). - Example: diagnose sniffer packet any 'host 10.1.1.5' 6 100 a grabs 100 full frames with an absolute timestamp. How do I run a packet capture on a Palo Alto firewall? PAN-OS captures on the dataplane at four stages, and comparing them tells you exactly where a packet died: - receive โ€” packet arrived on the ingress interface - transmit โ€” packet left on egress - drop โ€” dataplane discarded it - firewall โ€” post-policy, pre-egress Set a filter first ( debug dataplane packet-diag set filter match source 10.1.1.5 destination 8.8.8.8 ), enable all four capture stages, reproduce the traffic, then read each file with view-pcap . Files land in /opt/pancfg/mgmt/pcaps/ . Why does a packet capture slow down โ€” or crash โ€” a production firewall? An unfiltered capture on a high-speed interface (say 10 Gbps) forces every frame up to the CPU that runs the capture. That CPU saturates, latency spikes, and on an HA pair it can miss heartbeats and trigger a failover โ€” turning a "quick look" into an outage. The rule is always the same: filter by IP/port first, capture second. Add a count limit ( -c on tcpdump, the count field on FortiGate) so the capture stops on its own. What do the TCP flags [S], [S.], [.], [F.] and [R] mean in tcpdump? - [S] SYN โ€” "I want to connect" (start of the handshake). - [S.] SYN-ACK โ€” "Connection accepted" (the dot is the ACK bit). - [.] ACK โ€” "Got it, established." - [F.] FIN-ACK โ€” "I'm done, closing gracefully." - [R] RST โ€” "Reset / abort." A lone RST after a SYN usually means the port is closed or a firewall denied the session. How do I filter tcpdump by host and port at the same time? Use the BPF and keyword to combine conditions: sudo tcpdump -nn -i eth0 host 10.1.1.5 and port 443 You can chain more: host 10.1.1.5 and (port 443 or port 80) . Parentheses need quoting or escaping so the shell doesn't eat them. What does the -nn flag do in tcpdump, and why use it? -nn turns off both name resolutions: -n skips IP-to-hostname DNS lookups, and the second n skips port-to-service-name lookups. The result is faster captures (no DNS round-trips while sniffing), no risk of the capture itself generating DNS traffic that pollutes your output, and raw numbers you can match against firewall rules. How do I save a capture to a file for Wireshark? Use -w to write raw frames (not the printed summary) to a .pcap file: sudo tcpdump -nn -i eth0 -w /tmp/cap.pcap host 10.1.1.5 and port 443 Read it back on the CLI with tcpdump -r /tmp/cap.pcap , or open the file directly in Wireshark for full decoding. My SPAN/TAP capture is missing half the conversation โ€” why? A SPAN/mirror port often mirrors only one direction , and in networks with asymmetric routing the request and reply take different paths โ€” so a single tap sees only one side of the flow. You'll watch SYNs go out with no SYN-ACKs coming back and wrongly conclude the server is down. Fix it by mirroring both directions (TX and RX), tapping a single chokepoint both flows traverse, or capturing on the endpoint/firewall itself rather than a mid-path mirror. What is the Cisco ASA equivalent of a tcpdump capture? On a Cisco ASA you bind a capture to an access-list that selects the interesting traffic: access-list CAP extended permit ip host 192.168.1.100 any capture CAP interface inside access-list CAP View it live with show capture CAP , and export a pcap for Wireshark over HTTPS from https://<asa-ip>/admin/capture/CAP/pcap . Keep going → ### What's next? Go deeper on the wire โ€” CISSP Domain 4 covers secure protocols, segmentation, and the network controls that show up in every audit. Next ยท CISSP Domain 4: Communication and Network Security Guide Secure the Wire → Practice on exam.techclick.in → ## Build a complete network-security skillset Techclick's Cybersecurity Complete programme covers everything above โ€” from firewalls and Zero Trust to SIEM and SOC operations. Vendor-specific deep-dives are also available: Palo Alto , Zscaler ZIA/ZPA , F5 , FortiGate , Microsoft Sentinel . Enroll → All courses ๐Ÿ“ฉ Quiz me on this in 7 days. Opt in and we'll email you 3 micro-questions from this lesson at Day 1, Day 7 and Day 30 โ€” spaced repetition is how it sticks. Un-tick any time. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt