AirCoding/AirPlan/docs/spec/AirPlan-ParaV2/.agents/skills/airndb/references/windump-tcpdump-notes.md

WinDump / Tcpdump Notes

Source: https://www.winpcap.org/windump/docs/manual.htm

AirNDB Summary

• WinDump follows tcpdump-style packet capture usage on Windows.
• -D lists available capture interfaces.
• -i <interface> selects the capture interface. On Windows this is often the interface number from -D.
• -c <count> stops after a bounded number of packets.
• -w <file> writes raw packets to a pcap file.
• -r <file> reads packets back from a pcap file.
• -n avoids host name resolution; -nn also avoids service name resolution.
• -s <snaplen> controls packet snapshot length. AirNDB uses -s 0 for pcap captures so packets are not truncated.
• Filter expressions use BPF primitives such as host, net, port, src, dst, tcp, udp, icmp, arp, and, or, and not.

Windows Notes

• Prefer WinDump.exe or windump when tcpdump is unavailable on Windows.
• WinDump normally requires a packet capture driver such as WinPcap/Npcap and may require an elevated terminal.
• Interface names can be long adapter paths; the numeric index from windump -D is usually easier to use.
• Store pcap artifacts in a project-local ignored directory such as docs/network/airndb-captures/.

AirNDB Auto Setup

• On /airndb enter, AirNDB checks for tcpdump, windump, or WinDump.exe.
• If no capture tool is available on Windows, AirNDB downloads the official WinDump.exe linked from the WinDump install page:

https://www.winpcap.org/windump/install/bin/windump_3_9_5/WinDump.exe

• AirNDB verifies SHA1 before using the file:

d59bc54721951dec855cbb4bbc000f9a71ea4d95

• AirNDB stores the binary at AirPlan/state/airndb/tools/WinDump.exe and writes AirPlan/state/airndb/tool.env:

AIRNDB_TCPDUMP=<absolute path to WinDump.exe>

• AirNDB does not silently install WinPcap/Npcap drivers. If WinDump.exe -D fails after download, tell the user to install Npcap or WinPcap and retry from an elevated terminal.

Safe Defaults

• Start with interface discovery before capture:

windump -D
tcpdump -D

• Prefer short, bounded capture:

tcpdump -i <iface> -nn -s 0 -w <file>.pcap -c 200 '<bpf>'

• Read back a pcap summary:

tcpdump -nn -r <file>.pcap '<bpf>'

BPF Examples

host 192.0.2.10
tcp and port 443
udp and port 53
src host 192.0.2.10 and dst port 443
net 10.0.0.0/8 and not port 22
icmp or icmp6

Evidence Rules

• Record exact command, interface, filter, packet count, capture window, pcap path, and summary path.
• Keep pcap files private unless reviewed; they can contain tokens, cookies, payload, internal hostnames, and addresses.
• If application payload is encrypted, use packet timing, DNS, TCP/TLS handshakes, retransmissions, resets, or connection failures as evidence instead of expecting plaintext.