Open-Source Security Tools
tcpdump: The Packet Tool That Never Leaves the Server
tcpdump is the capture half of network analysis, and it lives on every server we touch. When an incident or an engagement needs evidence and the box is hundreds of kilometers away, tcpdump over SSH writes the file that Wireshark will analyze later. It is minimal, dependable, and slightly ridiculous in the best way: a one-time install, no GUI, and BPF filters you can type from memory after two weeks.
Key points
- The core reflex: tcpdump -i any -n -w evidence.pcap -c 100000 host 10.0.0.5 and port 443 — interface, no name resolution, write to file, cap the count, filter to what matters.
- -n (never resolve names) is non-negotiable on engagements: DNS lookups during a capture add noise and leak the capture itself.
- Quick text reads use -A or -X for payload dumps, but once you need actual analysis, stop and take a -w file to Wireshark.
- BPF is the muscle memory: host, net, port, tcp or udp, and combined filters with and, or, not; you learn it once and use it for thirty years.
- Ring buffers for long captures: tcpdump -w capture -C 100 -W 20 rotates 100 MB files so a disk does not fill while you wait.
- Snaplen and rotation discipline: -s0 for full packets when it matters, rotation sizes set before infrastructure asks you to clean up a filled disk.
- Filtering expressions compose: tcp[13] & 2 mean SYN flags, and reading a flags filter is the moment tcpdump stops being scary.
- Authorization framing stays the same on any box you capture on: it must be your system or in the signed scope, and the capture includes other users' traffic, so treat the file as sensitive data.
Field note
My longest capture was a rotating 2 GB dance on a misbehaving gateway — and I only stayed calm because -C 100 -W 20 had already been set. Searching evidence you got to name yourself beats explaining a filled disk any day.
Frequently asked questions
Why not just run Wireshark on the server?
Weight and cost: a GUI and its dissectors on a production host is waste, and headless servers have no display; tcpdump is the command line half of the same job.
Is BPF worth learning when display filters exist?
Yes, for capture: you cannot filter what you did not store, and a tight BPF keeps capture files small and analysis fast.
How big can captures get?
Unbounded without care — that is what -C and -W exist for, and busy networks fill disks faster than anyone books cleanup.
Does tcpdump work on Windows?
Not natively; the Windows side is pktmon (modern) or windump builds (legacy), and honestly most Windows packet work happens with Wireshark directly.
How Kinetikatech helps with open-source security tools
You shouldn't have to become an expert in open-source security tools: The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology. That's exactly what Penetration Testing and Linux Server Security is for, setup, hardening, monitoring, and a human on call day and night.