Tcpdump

Purpose

Use this skill for narrow packet capture when the assessment needs protocol evidence or quick network troubleshooting.

Phase Fit

• Primary: Detection and Response Assessment
• Secondary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration

Use When

• Need to capture a small protocol slice tied to the current hypothesis.
• Need fast packet evidence without a full GUI workflow.
• Need to support or cross-check defender telemetry.

Avoid When