In addition to seeing which sockets are open on our computer, we can also capture the exact data being sent and received.
We have a few tooling options for this:
- tcpdump is a commonly used program for packet capture on Unix-based systems. It is not available on modern Windows systems, however.
- Wireshark is a very popular network protocol analyzer that includes a very nice GUI. Wireshark is free software, released under the GNU GPL license, and available on many platforms (including Windows, Linux, and macOS).
Included with Wireshark is Tshark, a command-line-based tool that allows us to dump and analyze network traffic. Programmers often prefer command-line tools for their simple interfaces and ease of scripting. They have the additional benefit on being usable on systems where GUIs may not be available. For these reasons, we focus on using Tshark in...
