tcpdump

v4.99.4The Tcpdump Group

The classic packet sniffer. Reads capture files or the authored live-traffic model, filters with BPF and prints packet summaries or hex. The range's tcpdump reads scenario captures; live capture is emulated from the flow model.

Category: Packet & network traffic analysis
Package: tcpdump
Runs on: Linux
Commands: tcpdump

Reads authored PCAP fixtures and the scenario's traffic model. No interface is placed in promiscuous mode.

Install it

The scripts below install the real The Tcpdump Group package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-tcpdump.sh

Windows installer (PowerShell)

Install-tcpdump.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install tcpdump
```
sudo apt install -y tcpdump
```

RHEL, Fedora (dnf)

Install tcpdump
```
sudo dnf install -y tcpdump
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install tcpdump
```
sudo pacman -S --noconfirm tcpdump
```

Alpine (apk)

Install tcpdump
```
sudo apk add tcpdump
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which tcpdump
```
Check the version
```
tcpdump --version
```
The range reports 4.99.4.

Remove it

Take it off again
```
sudo apt remove --purge tcpdump
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install tcpdump inside it
```
wsl sudo apt install -y tcpdump
```

Inside the range

Tick it on the launch screen
Under tcpdump's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y tcpdump
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use tcpdump

Reps: Follow the PacketsA finance workstation is beaconing and someone pushed an archive to the file server in the clear. Take the capture off the span port, filter it down, follow the streams, and write up what left the building.
Reps: What the Capture Won't SayA staff member typed their password into a lookalike login page, and the proxy logs show only an encrypted session. Take the capture off the span port and prove where the credentials went using the one part of TLS that is still readable: the handshake. You are graded on what you can show, not what you guess.
Reps: The Other StackInvoices left the finance VLAN, but every IPv4 watchlist stayed quiet. Take the capture off the span port and find the traffic the rules were never written for: the IPv6 stack running beside the one everyone watches. You are graded on reading neighbor discovery, the AAAA lookup and the v6-only upload.
Reps: The Chatty SensorA second reader appeared on the plant-floor segment and started receiving every sensor reading the broker publishes. Take the capture off the span port, read the MQTT conversations and name the intruder, the topic it subscribed to and the credential the sensors hand out in the clear. You are graded on what the protocol itself shows you.
What the Anvil DidThe overnight triage agent answered tickets on its own. One of those tickets told it to go somewhere. Capture the agent plane live, follow what it called, and say what happened.
Reps: Read the Output (Run the Tool, Justify the Flag)Install nmap, tcpdump and YARA from the catalog on a Linux box, run each one properly, then explain the output line by line — which flag produced it, what the range actually reported, and what you would have missed with the defaults.
Pentest: Wireless AssessmentSit in an authorized coffee-shop parking lot, sweep the 2.4/5 GHz bands, capture the guest-WPA2 handshake, crack it against a scoped wordlist, then file a rotation-and-802.1X finding on the corporate SSID.