Introduction to tcpdump | Coding Cookie

Tcpdump is a network debugging tool that is available on most Unix-like platforms. You can use it to intercept and display TCP/IP related data being transmitted or received on your network interfaces.

In the following example I queried my local webserver on the loopback interface via curl.

Figure 1 – A simple curl request from the command line.

In addition I used a second putty session on the same host to intercept my generated network traffic with tcpdump.

tcpdump-three-way-handshake — Figure 2 – Capture with *tcpdump* the transmitted and received network traffic on the loopback interface (port 80).

Overall tcpdump is a really powerful tool. Figure 2 only skims the the surface of what can be achieved with it. The more familiar you are with tcpdump and the underlying protocols the more information you can extract with it. I have for example highlighted the initial TCP handshake in figure 2 because I know about it ;).

You may be interested in this article for further reading – I found it quite useful: http://packetpushers.net/masterclass-tcpdump-interpreting-output/