Every tool in this series so far has worked with the application — a browser, a proxy, a scanner — all sitting at the HTTP layer where requests and responses are already neatly framed. This closing tool lesson drops one layer lower, to the raw wire. A packet sniffer records the actual bytes crossing a network interface, exactly as they leave one machine and arrive at another, and that viewpoint answers questions the application layer cannot: Is this login really sending the password in cleartext? Is a token leaking somewhere? What is this app talking to on a port nobody documented? Why is the TLS handshake failing? tcpdump (the command-line capturer) and Wireshark (the graphical analyser) are the staple Kali tools for that job.
Scope and safety — capture only your own traffic, on networks you own. Packet capture is passive (you record, you do not inject), but recording other people's traffic without authorisation is unlawful wiretapping in most jurisdictions — "I was only listening" is not a defence. Practise on loopback (lo) carrying your own traffic to a lab app you control, or on a network covered by a signed engagement scope. As always: capability is never permission.About the practical. This one runs cleanly against the embedded NovaCart application on loopback — capture your own browser-to-local-app traffic on the lo interface, no external lab needed. If you cannot run a live capture right now, read the commands and the example stream closely; you do not need a live capture to recognise the capture → filter → follow-stream workflow and finish the lesson.In this lesson you will:
- Learn the two mental models you switch between — packets (single frames on the wire) vs streams (the reassembled conversation).
- See the division of labour: capture with
tcpdump, analyse in Wireshark, sharing the.pcapfile. - Master the distinction that trips up every beginner — capture filters (decide what is recorded, irreversible) vs display filters (decide what is shown, reversible).
- Follow an HTTP stream to read a whole request and response — and watch a password and token appear in cleartext over plain HTTP.
- Understand when a sniffer beats an intercepting proxy and when it does not — and why HTTPS and HSTS exist.
Prerequisites: networking-fundamentals-part1 (TCP/IP, ports, and the TCP handshake) is the background assumed throughout this lesson. If packets, sockets, and TCP streams are new to you, complete that lesson first.
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.