TryHackMe — Tcpdump: The Basics | Cyber Security 101 (THM)

Introduction

The main challenge in studying networking protocols is not seeing the protocol “conversations” happening. Technical complexities are hidden behind user-friendly interfaces, making it easy to access resources without noticing the underlying processes, like ARP queries or three-way handshakes. Capturing network traffic is a helpful way to understand how networks operate.

This room introduces basic command-line arguments for using Tcpdump. Developed in the late 1980s for Unix-like systems, Tcpdump and its libpcap library are stable and fast, forming the foundation for various networking tools today. Libpcap was also ported to Windows as WinPcap.

Learning Objectives

This room aims to provide the basics necessary to use Tcpdump. You will learn how to:

1. Capture packets and save them to a file
2. Set filters on captured packets
3. Control how captured packets are displayed

Room Prerequisites

Familiarity with the TCP/IP model and related concepts is recommended. The following rooms provide necessary knowledge:

• Networking Concepts
• Networking Essentials
• Networking Core Protocols
• Networking Secure Protocols