Logo

Tcpdump is similar to what Wireshark in which i have explained earlier in my posts.  It captures packets that travels through your network into your computer disregarding whether it is from the Internet or your inner network.  Tcpdump is a command line utility whereby you would have to set the options before you proceed in capturing packets.  This application is very useful especially for network administrators as well as security analyst to analyze threats that are in the system.  Personally, i run tcpdump on my Ubuntu laptop.  To get tcpdump on your Ubuntu, type "sudo apt-get install tcpdump".  The thing is that tcpdump runs in Linux based machines while it is called WinDump in the Windows operating system.  Basically it is up to you to run tcpdump in Linux, WinDump in Windows or Wireshark (Linux/Windows) but the most important thing is how good are you at using it.

Source: http://www.tcpdump.org/

Wireshark is one of the tools that help you identify incoming and outgoing packets be it UDP or TCP level, ICMP or IP level.  Wireshark is a tool that intercepts packets and analyze them.  One of the helpful tool that helped me analyze how website POST GET works for my projects, it is considered user friendly thanks to its Graphical User Interface.  The GUI of Wireshark is one of its strong points.  You are able to look at a list of tens and thousands of packets and filter them according to your need with conditional statements.  Wireshark is capable of running in both Linux and Windows.

Those of you that think of yourself as a hacker, do you know what does a network packet look like?  Have you ever read network packets in your life, do you know how they work?  Take a look in the TCP packet below and try to figure out what the packet is doing as well as getting the source ip address and port of the sender.

[code]
00 1c f0 39 8e 45 00 1c  f0 8a a1 71 08 00 45 00
00 34 06 6e 40 00 80 06  9a 0e c0 a8 01 02 45 a2
52 fb c0 a7 00 50 a1 f6  7c bb 00 00 00 00 80 02
20 00 15 25 00 00 02 04  05 b4 01 03 03 02 01 01
04 02
[/code]

Tips: Think of the packet as an Ethernet frame.