you are viewing a single comment's thread
view the rest of the comments
[–] 12 points 1 month ago (13 children)

tcpdump looks scary but is super neat and helpful, learn it if you haven't ;)

  • source
  • hideshow 13 child comments
  • [–] 11 points 1 month ago (2 children)

    Still doesn't help with things like understanding routing and subnet masks and frame sizes and jfc how does any of this work

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago* (last edited 1 month ago)

    Of course not, but I've found that seeing the protocols in action and looking at real headers can be very helpful in making them click. Understanding DHCP or ARP or mDNS or BGP or whatever is much easier by inspecting a pcap than it is by reading RFCs

  • source
  • parent
  • [–] 3 points 1 month ago* (6 children)

    As someone who understands the concept of network but has never professionally entered the field, i assume this just dumps a TCP packet to be inspected, correct?

  • source
  • parent
  • hideshow 6 child comments
  • [–] 3 points 1 month ago

    Yes, but before I used it I assumed that its scope was pretty much limited to what you just mentioned. Instead it can operate on most protocols both above and below layer 4, and it is incredibly useful as a traffic capture tool to produce a .pcap on a remote headless machine which you can then load into Wireshark. The "dump" part is the interesting one, not the "tcp" ;)

  • source
  • parent
  • [–] 2 points 1 month ago (2 children)

    Yes. Also learn about certs if you need to deal with encryption https etc.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 month ago (1 child)

    Thank you for the affirmation, I got reverse proxies and certificates relatively down, however I am struggling to understand headers and their purposes, I know Mozilla has great documentation regarding headers but lately I’ve gotten lazy, haha.

  • source
  • parent
  • hideshow 1 child comment