# Links & Tools

# tcpdump Cheat Sheet

tcpdump Cheat Sheet (<span class="wikiexternallink">[https://www.comparitech.com/net-admin/tcpdump-cheat-sheet/](https://www.comparitech.com/net-admin/tcpdump-cheat-sheet/)</span>)

[![tcpdump cheat sheet](https://cdn.comparitech.com/wp-content/uploads/2019/06/tcpdump-cheat-sheet.jpg)](https://www.comparitech.com/net-admin/tcpdump-cheat-sheet/)

# Wireshark Sample Captures

If you need to see how different protocols behave on the network here are some sample captures from Wireshark

- [https://wiki.wireshark.org/SampleCaptures](https://wiki.wireshark.org/SampleCaptures)
- [https://packetlife.net/captures/](https://packetlife.net/captures/)
- [https://www.netresec.com/?page=PcapFiles](https://www.netresec.com/?page=PcapFiles)
- [https://tshark.dev/search/pcaptable/](https://tshark.dev/search/pcaptable/)

# Useful Network Diagnostic CLI commands

#### Useful CLI commands to do network diagnostics with tcpdump / tshark etc.

### tcpdump

<table border="1" id="bkmrk-command-description-" style="border-collapse: collapse; width: 100%; height: 154.578px;"><colgroup><col style="width: 50.0618%;"></col><col style="width: 50.0618%;"></col></colgroup><thead><tr style="height: 29.7969px;"><td style="height: 29.7969px;">Command</td><td style="height: 29.7969px;">Description</td></tr></thead><tbody><tr style="height: 29.7969px;"><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; icmp</td><td style="height: 29.7969px;">show icmp packets</td></tr><tr style="height: 35.3906px;"><td style="height: 35.3906px;">tcpdump -nni &lt;network-interface&gt; "icmp\[0\] == 0"

</td><td style="height: 35.3906px;">ICMP type 0 echo reply</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; "icmp\[0\] == 3"

</td><td style="height: 29.7969px;">ICMP destination unreachable</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; "icmp\[0\] == 4"

</td><td style="height: 29.7969px;">ICMP source quench</td></tr><tr><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; "icmp\[0\] == 5"

</td><td style="height: 29.7969px;">ICMP redirect</td></tr><tr><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; "icmp\[0\] == 8"

</td><td style="height: 29.7969px;">ICMP echo request</td></tr><tr><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; "icmp\[0\] == 11"

</td><td style="height: 29.7969px;">ICMP time exceeded</td></tr><tr><td style="height: 29.7969px;">tcpdump -nni &lt;network-interface&gt; "tcp\[tcpflags\] &amp; (tcp-rst) !=0"

</td><td style="height: 29.7969px;">Detect tcp reset and ICMP packets</td></tr></tbody></table>