tcpdump

Description

tcpdump is a powerful command-line packet analyzer that captures and displays TCP/IP and other packets transmitted or received over a network interface. It uses libpcap for packet capture and supports BPF (Berkeley Packet Filter) syntax for precise traffic filtering.

Use Cases

• Capture packets on remote servers via SSH for forensic analysis
• Create pcap files for offline analysis in Wireshark
• Monitor specific traffic flows using BPF filter expressions

Attack Phases

MITRE ATT&CK Techniques (2)