Skip to content

Drill: Read and Analyze Saved pcap Files

Goal

Use tcpdump to read saved pcap files and apply display filters to analyze previously captured traffic.

Setup

  • Linux system with tcpdump installed
  • A pcap file to analyze (or create one with a test capture)

Commands

Create a test capture first:

tcpdump -i any -w /tmp/test.pcap -c 100 2>/dev/null &
curl -s https://example.com > /dev/null 2>&1
sleep 2 && kill %1 2>/dev/null

Read a pcap file:

tcpdump -r /tmp/test.pcap

Read with no DNS resolution:

tcpdump -nn -r /tmp/test.pcap

Filter while reading:

tcpdump -nn -r /tmp/test.pcap port 443
tcpdump -nn -r /tmp/test.pcap 'tcp[tcpflags] & tcp-syn != 0'

Show only SYN and SYN-ACK (connection attempts):

tcpdump -nn -r /tmp/test.pcap 'tcp[tcpflags] & (tcp-syn) != 0'

Show only RST packets (connection resets):

tcpdump -nn -r /tmp/test.pcap 'tcp[tcpflags] & (tcp-rst) != 0'

Show packet payload in ASCII:

tcpdump -nn -A -r /tmp/test.pcap port 80 | head -50

Count packets per source IP:

tcpdump -nn -r /tmp/test.pcap 2>/dev/null | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -10

Extract specific conversation:

tcpdump -nn -r /tmp/test.pcap 'host 93.184.216.34 and port 443'

Write filtered results to new pcap:

tcpdump -r /tmp/test.pcap -w /tmp/filtered.pcap port 443

What to Look For

  • TCP flag patterns: SYN without SYN-ACK means connection never established
  • RST packets after established connections suggest abrupt termination
  • Retransmissions (same seq number) indicate packet loss
  • Time gaps between packets reveal latency issues

Common Mistakes

  • Forgetting -nn and waiting for DNS resolution on every packet in the file
  • Applying capture filters syntax when reading (BPF filters work on read too)
  • Not creating filtered subsets of large pcap files for focused analysis
  • Confusing display output ordering with actual packet timing

Cleanup

rm -f /tmp/test.pcap /tmp/filtered.pcap