tcpdump — Packet Capture & Filters
Ctrl+F:
tcpdump·icmp· incoming ping ·icmptype·tun0·-i·-n
tcpdump captures live network traffic on an interface. On OSCP you use it on Kali to confirm shells, spot ping/ICMP hitting your box, or debug tunnels (tun0, tap0).
Wireshark GUI alternative — same filters apply to tshark.
→ Networking · Netcat · Restricted Shell Escape (tcpdump privesc)
Install (Kali)
sudo apt install -y tcpdump
which tcpdump
tcpdump --versionUsually preinstalled.
📌 Basic syntax
sudo tcpdump [options] [filter expression]| Flag | Meaning |
|---|---|
-i IFACE | Interface — eth0, tun0, any |
-n | No DNS reverse lookup (faster, clearer IPs) |
-nn | No DNS or port name resolution |
-v / -vv / -vvv | More verbose |
-c N | Stop after N packets |
-w file.pcap | Write to file (open in Wireshark) |
-r file.pcap | Read from file |
-A | ASCII payload (careful — noisy) |
-X | Hex + ASCII dump |
sudo tcpdump -ni tun0
sudo tcpdump -ni eth0 port 4444
sudo tcpdump -ni any host 10.10.10.5
sudo tcpdump -ni tun0 -w capture.pcap📌 ICMP — incoming ping only (to your device)
Echo request (type 8) = someone pinging you. Echo reply (type 0) = your replies.
Ping arriving at your Kali IP (replace interface + IP)
# All ICMP on VPN interface
sudo tcpdump -ni tun0 icmp
# Only echo REQUESTS (incoming pings) — most common filter
sudo tcpdump -ni tun0 'icmp and icmp[icmptype] == 8'
# Only ICMP destined TO your attack box IP
sudo tcpdump -ni tun0 'icmp and dst host 10.10.14.5'
# Incoming pings TO you (combine both)
sudo tcpdump -ni tun0 'icmp and icmp[icmptype] == 8 and dst host 10.10.14.5'| Filter | Shows |
|---|---|
icmp | All ICMP |
icmp[icmptype] == 8 | Echo request (ping to someone) |
icmp[icmptype] == 0 | Echo reply |
dst host YOUR_IP | Packets to your machine |
src host TARGET | Packets from target |
# Quick — what's my IP on tun0?
ip -4 addr show tun0 | grep inet
# Watch pings while you ping target from another terminal
sudo tcpdump -ni tun0 'icmp and dst host $(ip -4 -o addr show tun0 | awk "{print \$4}" | cut -d/ -f1)'Verify target can reach you (reverse shell prep)
# Terminal 1 — listen for their ping
sudo tcpdump -ni tun0 'icmp and icmp[icmptype] == 8 and dst host 10.10.14.5'
# Terminal 2 — on target (if you have shell)
ping -c 3 10.10.14.5📌 OSCP common filters
# Reverse shell callback to your listener
sudo tcpdump -ni tun0 'tcp port 4444'
# HTTP exfil / wget to your server
sudo tcpdump -ni tun0 'tcp port 8080'
# SMB / LDAP during enum
sudo tcpdump -ni tun0 'port 445 or port 389'
# All traffic to/from target
sudo tcpdump -ni tun0 host 10.10.10.25
# DNS exfil / zone transfer debug
sudo tcpdump -ni tun0 port 53📌 Save & analyze
sudo tcpdump -ni tun0 -w box.pcap 'host 10.10.10.25'
wireshark box.pcap
tshark -r box.pcap -Y 'icmp.type==8'📌 Privesc note (target)
Some tcpdump versions allow -z post-rotate command (GTFOBins):
tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /bin/bash -Z root📌 Quick cheat sheet
sudo tcpdump -ni tun0 icmp
sudo tcpdump -ni tun0 'icmp and icmp[icmptype] == 8 and dst host 10.10.14.5'
sudo tcpdump -ni tun0 port 4444
sudo tcpdump -ni tun0 -w cap.pcap