Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

SOC and blue team

Tcpdump Command for Beginners: Capture and Filter Traffic

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

tcpdump captures network traffic from the command line. It runs on servers and firewalls where there is no screen, which is why defenders keep it close. This guide covers the commands you will use most. Capture only on networks you own or administer.

First Capture

  • sudo tcpdump -i eth0 -nn -c 20

-i eth0 picks the interface (list them with ip link), -nn stops name lookups so output is faster and clearer, and -c 20 stops after 20 packets.

Filters You Will Use

  • host 192.168.56.20 shows traffic to or from one machine.
  • port 80 shows one port; port 53 shows DNS.
  • tcp and dst port 22 shows connections going to SSH.
  • "tcp[tcpflags] & tcp-syn != 0" shows packets with the SYN flag, the start of a connection and the signature of a port scan.

Read a Line

A line shows the time, the protocol, source address and port, an arrow, the destination and the TCP flags. Flags [S] is SYN, [S.] is SYN-ACK and [.] is ACK. Add -A to print the payload as text, which shows plain HTTP requests. That is also why unencrypted protocols are a risk.

Save and Analyze

  • sudo tcpdump -i eth0 -w capture.pcap saves packets to a file.
  • tcpdump -nn -r capture.pcap reads it back.
  • Open the file in Wireshark for a closer look; see Wireshark for beginners.

Command Cheat Sheet

  • sudo tcpdump -i any -nn captures on all interfaces without name lookups.
  • -c 50 stops after 50 packets.
  • host 192.168.56.20, net 192.168.56.0/24, port 443, portrange 1-1024 filter traffic.
  • src host X and dst port N filter by direction.
  • -A prints payload as text; -X prints hex and text.
  • -e shows link-level headers.
  • -w file.pcap saves and -r file.pcap reads a capture.

Try It

Capture SYN packets on a lab VM, then run a scan from another VM with Nmap, as in Nmap for beginners. Watch how a scan looks from the defender's side. This is network traffic monitoring, a topic in the CND syllabus and in SOC work.

Sources and Further Reading

Want to practice detection in a supervised lab? Book free trial classes. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Beginner to intermediate · EC-Council certification

Certified Network Defender (CND)

Defend the network. Monitor, detect and respond to threats.

₹34,000 + GST

  • Network security
  • Threat detection
  • Monitoring tools
  • Incident response
View the certification →
Advanced · EC-Council certification

Certified SOC Analyst (CSA v2)

Run the SOC. Hunt threats and manage security incidents.

₹34,000 + GST

  • SOC operations
  • Threat hunting
  • SIEM management
  • Orchestration
View the certification →
Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →

More Guides

SOC and blue team · 3 min read

Firewalls, IDS and IPS Explained for Beginners

What a firewall, an IDS and an IPS each do, how they differ, where they sit on a network, how to try a firewall in a lab, and what defenders still miss.

Read the guide →
SOC and blue team · 2 min read

Suricata for Beginners: Install, Rules and Alerts

Install Suricata on Linux, update rules, run it on an interface, read fast.log and eve.json, and write a simple custom rule, with lab commands.

Read the guide →
Certification · 3 min read

CND Certification: Exam Format, Eligibility and 20 Modules

What the EC-Council CND exam looks like: 100 questions in 4 hours, the 20 modules, who can start, how much is hands-on and what it leads to.

Read the guide →
Certification · 2 min read

How to Prepare for the CND Exam: A 6-Week Study Plan

A 6-week CND study plan: modules grouped by week, lab practice with firewalls, logs and traffic, timed question drills and exam-day pacing.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp