🖥️ Your hands-on practice terminal
Every lesson in this course comes with a real Linux terminal built right into the page — nothing to install, nothing to set up, ready the instant you open a lab. You will not just read about commands; you will type real commands and run real tools on a live machine and learn by doing. It is a safe sandbox: experiment freely, break whatever you like, and reset to a clean machine any time. This is the fastest way to turn reading into real, job-ready skill.
Everything on a network travels in packets
When two computers talk, they do not send one big stream. They chop the conversation into small chunks called packets. Each packet is like an envelope: it has a from address, a to address, and a little bit of content inside.
A capture file (often ending in .pcap) is simply a pile of those packets saved to disk, in the order they went past. As an analyst you open the file and read the envelopes to work out what happened — who talked to whom, and about what.
The classic tool for reading a capture is tcpdump. The -r flag means “read from this file”, and -n means “don't slow down turning numbers into names”:
tcpdump -nr /home/student/case/capture.pcapIn the terminal
student@vulntech:~$ tcpdump -nr /home/student/case/capture.pcap reading from file /home/student/case/capture.pcap, link-type EN10MB (Ethernet), snapshot length 65535 08:10:00.000000 IP 10.10.10.5.51000 > 93.184.216.34.443: Flags [S], seq 0, win 1024, length 0 08:10:01.000000 IP 93.184.216.34.443 > 10.10.10.5.51000: Flags [S.], seq 0, ack 0, win 1024, length 0 08:10:02.000000 IP 10.10.10.5.51000 > 93.184.216.34.443: Flags [.], ack 0, win 1024, length 0 08:10:03.000000 IP 10.10.10.5.51000 > 93.184.216.34.443: Flags [P.], seq 1:6, ack 0, win 1024, length 5 08:10:04.000000 IP 93.184.216.34.443 > 10.10.10.5.51000: Flags [P.], seq 0:5, ack 1, win 1024, length 5 08:10:05.000000 IP 10.10.10.5.51000 > 93.184.216.34.443: Flags [.], ack 0, win 1024, length 0
Each line is one packet. You can already see the two addresses and a > arrow showing the direction. That is the whole idea — read the envelopes, line by line.
Tip: A capture can hold millions of packets. Just like logs, you never read them all — you count them and filter them, which is what the next lessons are about.