Linux For Cybersecurity — Part 8: Capturing & Analyzing Traffic in Linux

Every cyber attack leaves a trail on the network. If you can capture and analyze that traffic, you can detect intrusions, investigate attacks, and even stop them in real time. Today, we’ll use Linux tools like tcpdump and tshark to capture and analyze network traffic.

Don’t wanna read? Fine. Watch the video and pretend you learned it by osmosis:

[embed]

1: Introduction to Packet Capture

Packet sniffing is the process of intercepting and recording network traffic. Security analysts use it to investigate incidents, while attackers use it for reconnaissance. Capturing packets is like reading the diary of network activity — everything leaves a footprint.

2: Capturing Traffic with tcpdump

By default, tcpdump shows packet summaries in real time. Using the -w option, you can save traffic to a .pcap file for later analysis in Wireshark or tshark.

Demo commands:

sudo tcpdump -i eth0                # Capture live traffic on interface eth0
sudo tcpdump -i eth0 -w capture.pcap  # Save capture to file

Tip: Always run packet capture in a lab or on networks you own. Capturing other people’s traffic without permission is illegal.

3: Filtering Traffic

Filters let you capture only the traffic you care about.

Demo commands:

sudo tcpdump -i eth0 port 80              # Only HTTP traffic
sudo tcpdump -i eth0 host 192.168.1.10   # Only traffic from a specific host
sudo tcpdump -i eth0 tcp                  # Only TCP packets
sudo tcpdump -i eth0 udp                  # Only UDP packets

Tip: Combine filters for precision, e.g., sudo tcpdump -i eth0 tcp port 22 and host 192.168.1.10.

4: Analyzing Packets with TShark

Tshark is the command-line version of Wireshark. It allows you to inspect packet contents directly in the terminal.

Demo command:

tshark -r capture.pcap

For advanced filtering:

tshark -r capture.pcap -Y "http.request"
tshark -r capture.pcap -T fields -e ip.src -e ip.dst

Tip: Use TShark when you need scripts or automated parsing of captures. Wireshark GUI is better for deep inspection.

5: Detecting Suspicious Activity

Using packet captures, you can detect signs of malicious activity:

ActivityWhat to look for:

• Brute-force attempt
• Multiple failed login packets over a short period
• Port scanning
• Many SYN packets from a single host
• Weak security
• Cleartext credentials in HTTP traffic

Example detection:

Many SYN packets from one host → possible port scan
Repeated failed login attempts → brute-force attack
HTTP credentials in cleartext → weak security

6: Cybersecurity Context

In real-world operations:

• SOC Analysts: Capture traffic to investigate alerts.
• Incident Responders: Analyze .pcap files for Indicators of Compromise (IoCs).
• Red Teamers: Use tcpdump & Wireshark/Tshark to validate how their attacks appear on the network.

Packet captures provide visibility into the unseen — a real-time story of network behavior.

Remember: Packets don’t lie — they tell the real story of what happened.

In Part 9, we’ll step back and look at the bigger picture: maintaining security and ethics in Linux environments — best practices for keeping systems safe while staying on the right side of cybersecurity law.

Access the complete series here:

[embed]Linux For CyberSecurity Edit descriptionmedium.com