How to read and analyze a saved PCAP file using tcpdump

After saving traffic to a PCAP file, it's crucial to analyze the captured packets to understand network behavior or troubleshoot issues. Tcpdump provides the ability to read and inspect the saved PCAP files in a detailed, structured format. By examining the packet contents, administrators can diagnose network problems, detect anomalies, or perform deeper protocol analysis.

When reading a PCAP file, tcpdump interprets the raw data and displays it in a human-readable format. You can apply filters to narrow down the data you're inspecting, which helps focus on specific traffic types, hosts, or protocols. This makes the analysis more efficient by isolating relevant information.

Analyzing a saved PCAP file with tcpdump is useful in situations where real-time packet analysis is impractical or when data needs to be reviewed offline. The ability to extract meaningful insights from a saved capture makes this tool essential for network troubleshooting, security auditing, and incident response.

1. Open a terminal.
2. Read the saved PCAP file.

   $ tcpdump -r capture_output.pcap
   reading from file capture_output.pcap, link-type EN10MB (Ethernet)
   10:15:25.543211 IP 192.168.1.10 > 192.168.1.1: ICMP echo request, id 7890, seq 1, length 64
   10:15:25.543211 IP 192.168.1.1 > 192.168.1.10: ICMP echo reply, id 7890, seq 1, length 64

   This command reads the saved PCAP file and displays each packet in a readable format.

3. Apply filters for specific traffic.

   $ tcpdump -r capture_output.pcap tcp

   This command reads the PCAP file but only shows packets using the TCP protocol.

4. Read a specific number of packets.

   $ tcpdump -r capture_output.pcap -c 5
   reading from file capture_output.pcap, link-type EN10MB (Ethernet)
   10:15:25.543211 IP 192.168.1.10 > 192.168.1.1: ICMP echo request, id 7890, seq 1, length 64
   10:15:25.543211 IP 192.168.1.1 > 192.168.1.10: ICMP echo reply, id 7890, seq 1, length 64
   10:15:25.543212 IP 192.168.1.10.49582 > 192.168.1.1.80: Flags [S], seq 123456789, win 65535, length 0

   Use this option to limit the number of packets displayed (e.g., 5 packets in this case).

5. Display more verbose output.

   $ tcpdump -r capture_output.pcap -vv
   reading from file capture_output.pcap, link-type EN10MB (Ethernet)
   10:15:25.543211 IP (tos 0x0, ttl 64, id 34567, flags [DF], proto ICMP (1), length 84) 
       192.168.1.10 > 192.168.1.1: ICMP echo request, id 7890, seq 1, length 64

   This command provides more detailed information about each packet (e.g., TTL, ID, etc.).

6. Display timestamps with packets.

   $ tcpdump -r capture_output.pcap -tttt
   reading from file capture_output.pcap, link-type EN10MB (Ethernet)
   2023-10-03 10:15:25.543211 IP 192.168.1.10 > 192.168.1.1: ICMP echo request, id 7890, seq 1, length 64

   This command shows the exact timestamp of each packet for precise analysis.