Attackers abuse tcpdump and libpcap to capture credentials, session cookies, API tokens and other cleartext or weakly protected traffic from compromised hosts or network segments. If these tools run where they should not, defenders should inspect command history, running processes and packet capture files, and restrict packet-capture privileges to approved administrators only.
What attackers gain by sniffing traffic with tcpdump and libpcap
tcpdump and libpcap are not offensive by themselves, but they become powerful when an attacker already has execution on a host or can observe a network path. The value is in visibility: packet capture can reveal cleartext secrets, reusable session material, and protocol metadata that helps map systems, users and services.
When defenders think only in terms of malware binaries, they can miss this quieter stage of compromise. Captures can also expose how services talk to each other, which ports and hosts matter most, and whether a supposedly internal workflow still carries credentials or tokens in ways an attacker can reuse.
Where packet capture becomes a credential theft problem
The highest-value abuse is traffic collection from paths that still carry readable authentication material. That includes legacy protocols, misconfigured internal services, weakly protected API calls, and session handshakes that can be replayed or swapped into a live browser or application session. The same capture can also show bearer tokens, cookies, and other secret material in transit.
That makes packet capture a bridge between reconnaissance and persistence. A single successful sniff can give an attacker both immediate access and enough context to move laterally, impersonate a user, or return later with the same captured material if it has not been rotated or invalidated.
What defenders should check when tcpdump shows up unexpectedly
If tcpdump or another packet capture tool appears on an unexpected host, treat it as an access investigation, not just a process anomaly. Review shell history, parent processes, privilege escalation events, live network connections, and any newly created pcap files or archive locations where captures may have been written.
Also verify whether the host has access to a segment where secrets are likely to appear in transit. A capture tool on an endpoint, jump host, build system, or network sensor can be legitimate in one environment and highly suspicious in another, so context matters more than the tool name alone.
Risk and Threat Considerations
Packet capture turns network visibility into a direct exposure risk when traffic still contains credentials, tokens, or session material. The main hazard is not only passive interception, but the downstream reuse of what was observed, especially if the attacker can capture from a trusted internal segment or a compromised admin workstation.
Failure mechanism: An attacker with local or privileged access runs tcpdump or libpcap-based capture on a host or mirror path, then extracts cleartext secrets, cookies, or token-bearing flows from live traffic or saved pcap files.
Impact: The captured material can enable account takeover, session replay, lateral movement, and repeated unauthorized access until the exposed secret or session is revoked or expires.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1040 — Network Sniffing | Directly matches passive capture of traffic for secrets and session material. |
| Recommendation — Hunt for T1040 usage and review exposed credentials, cookies, and tokens. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Unexpected packet capture should be validated through process, shell, and host audit evidence. |
| Recommendation — Centralize audit evidence for suspicious capture activity and review it quickly. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Packet-capture investigations rely on preserving host and process evidence for later review. |
| AC-6 — Least Privilege | Restricting packet-capture privileges to approved admins is a least-privilege control. | |
| IA-5 — Authenticator Management | Captured credentials and tokens often require rotation or invalidation after exposure. | |
| Recommendation — Ensure hosts generate evidence that can reconstruct who started capture and when. Limit packet-capture capability to approved administrators and controlled sensors. Rotate exposed authenticators and invalidate any captured session material. | ||
Practitioner Guidance
What to verify: Confirm whether packet capture capability is restricted to approved administrators, dedicated sensors, or controlled troubleshooting windows. If the same host can both observe traffic and use the captured material, treat that as a privilege and containment issue, not a routine diagnostics workflow.
Decision rule: If the traffic path can expose reusable authentication material, prioritize credential, session, and token rotation over assuming the capture was only informational. If the capture involved a service account, API key, or long-lived session, assume the blast radius is larger than the single host where tcpdump was found.
Common mistake: Teams often hunt only for the capture command and ignore the files it produced, the processes that launched it, and the secrets that may already have been copied out of band. The useful question is not simply “was packet capture used?” but “what trust boundary did it cross, and what material could it have exposed?”
Practitioner takeaway: Treat unauthorized packet capture as potential secret exposure with replay risk, not just an investigation artifact, and validate privilege boundaries before you validate innocence.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org