tcpdump captura

sudo tcpdump -i <iface> -w capture.pcap 'port not 22'

Capture network traffic from an interface to a pcap file, excluding your own SSH, for later analysis of suspicious traffic.

Run it when you suspect anomalous network activity on a host — beaconing, exfiltration, communication with rare external IPs — and you need raw evidence: tcpdump saves the real traffic to pcap, which is later analyzed with tshark, Zeek, or Wireshark. Excluding port 22 prevents your own management session from flooding the capture. In an IR, capturing the compromised host (or the segment span) at the peak moment is the proof of C2 and what was exfiltrated. On hosts with low activity, captures of hours fit into manageable files.

Don't use it as a passive detection tool in production without limits: capturing a busy interface without filter or rotation fills the disk in minutes and adds CPU load. Always use filters (ports, hosts, protocols) and bounded windows. And watch out: encrypted traffic (HTTPS, SSH, TLS) is captured but not readable — for content you need the proxy or decryption; the capture gives metadata (IPs, ports, volumes, timing), which is often enough to detect C2. On hosts without permissions or in cloud environments without interface access, local capture is not possible — that's where flow logs come in.