☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Overview:
  • 1️. Basic Capture Commands
  • 2️. Filtering Traffic
  • 3. Protocol-Specific Capture
  • 4️. Display Packet Details
  • 5️. Advanced Filters
  • 6️. Combine Multiple Filters
  • 7️. Capture and Analyze Specific Traffic
  • 8️. Save and Read Packets
  • 9️. Useful Wireshark Filters
  • Pro Tips
  1. Packet Analysis

TCPDUMP Cheatsheet

Overview:

In certain environments you may or may not have access to tshark or wireshark. Tcpdump is generally available on many different distributions. This assumes the administrator allows it. Here is a cheatsheet to get started.

1️. Basic Capture Commands

Command
Description

tcpdump

Start capturing packets on the default interface.

tcpdump -i eth0

Capture packets on a specific interface (e.g., eth0).

tcpdump -D

List all available network interfaces.

tcpdump -c 10

Capture only 10 packets and then stop.

tcpdump -w capture.pcap

Save packets to a file for later analysis.

tcpdump -r capture.pcap

Read packets from a previously saved file.

2️. Filtering Traffic

Command
Description

tcpdump host 192.168.1.1

Capture traffic to/from a specific host.

tcpdump src host 192.168.1.1

Capture packets only from a source IP.

tcpdump dst host 192.168.1.1

Capture packets only to a destination IP.

tcpdump net 192.168.1.0/24

Capture traffic from a specific subnet.

tcpdump port 80

Capture packets on a specific port (e.g., HTTP traffic).

tcpdump src port 443

Capture packets from a specific source port.

tcpdump dst port 53

Capture packets to a specific destination port.

3. Protocol-Specific Capture

Command
Description

tcpdump tcp

Capture only TCP traffic.

tcpdump udp

Capture only UDP traffic.

tcpdump icmp

Capture only ICMP (ping) traffic.

tcpdump arp

Capture only ARP packets.

tcpdump port not 22

Capture everything except SSH traffic.

4️. Display Packet Details

Command
Description

tcpdump -X

Show packet contents in hex and ASCII.

tcpdump -XX

Show full packet details including link-layer headers.

tcpdump -A

Show ASCII output (useful for inspecting HTTP traffic).

tcpdump -tttt

Show human-readable timestamps.

tcpdump -n

Do not resolve IP addresses to hostnames (faster output).

tcpdump -nn

Do not resolve hostnames or port numbers (pure numeric).

5️. Advanced Filters

Command
Description

tcpdump 'tcp[13] & 2 != 0'

Capture only SYN packets (TCP handshake).

tcpdump 'tcp[13] & 16 != 0'

Capture only ACK packets.

tcpdump 'tcp[tcpflags] & tcp-push != 0'

Capture only PUSH packets.

tcpdump 'icmp[icmptype] = icmp-echo'

Capture only ICMP echo requests (ping).

tcpdump 'greater 1000'

Capture packets larger than 1000 bytes.

6️. Combine Multiple Filters

Command
Description

tcpdump src host 192.168.1.1 and dst port 80

Capture packets from a source IP to port 80.

tcpdump '(src net 192.168.1.0/24) and (dst port 443)'

Capture HTTPS traffic from a specific subnet.

tcpdump 'tcp port 80 and (tcp[tcpflags] & tcp-syn != 0)'

Capture only HTTP SYN packets.

7️. Capture and Analyze Specific Traffic

Task
Command

Capture all HTTP traffic

tcpdump -i eth0 port 80 -A

Capture all DNS queries

tcpdump -i eth0 port 53 -nn

Capture SSH brute force attempts

tcpdump -i eth0 src port 22

Capture packets larger than 1KB

tcpdump greater 1024

Capture traffic related to a specific MAC address

tcpdump ether host 00:11:22:33:44:55

8️. Save and Read Packets

Command
Description

tcpdump -w output.pcap

Save packets to a file.

tcpdump -r output.pcap

Read packets from a saved file.

tcpdump -r output.pcap -nn -X

Read packets and display detailed contents.

9️. Useful Wireshark Filters

After capturing packets with tcpdump, open the .pcap file in Wireshark and apply these filters:

Wireshark Filter
Description

http

Show only HTTP traffic.

tcp.flags.syn == 1

Show only SYN packets.

ip.addr == 192.168.1.1

Show all traffic to/from a specific IP.

dns

Show only DNS queries.

ssl

Show only SSL/TLS traffic.


Pro Tips

1. Run tcpdump as root for full packet capture:

sudo tcpdump -i eth0

2. Stop capture after N packets:

tcpdump -c 100 -w sample.pcap

3. Analyze a specific protocol in a PCAP file:

tcpdump -r sample.pcap icmp

4. Find out which process is generating network traffic:

sudo netstat -anp | grep :80

Last updated 3 months ago