# WinDump / Tcpdump Notes

Source: https://www.winpcap.org/windump/docs/manual.htm

## AirNDB Summary

- WinDump follows tcpdump-style packet capture usage on Windows.
- `-D` lists available capture interfaces.
- `-i <interface>` selects the capture interface. On Windows this is often the interface number from `-D`.
- `-c <count>` stops after a bounded number of packets.
- `-w <file>` writes raw packets to a pcap file.
- `-r <file>` reads packets back from a pcap file.
- `-n` avoids host name resolution; `-nn` also avoids service name resolution.
- `-s <snaplen>` controls packet snapshot length. AirNDB uses `-s 0` for pcap captures so packets are not truncated.
- Filter expressions use BPF primitives such as `host`, `net`, `port`, `src`, `dst`, `tcp`, `udp`, `icmp`, `arp`, `and`, `or`, and `not`.

## Windows Notes

- Prefer `WinDump.exe` or `windump` when `tcpdump` is unavailable on Windows.
- WinDump normally requires a packet capture driver such as WinPcap/Npcap and may require an elevated terminal.
- Interface names can be long adapter paths; the numeric index from `windump -D` is usually easier to use.
- Store pcap artifacts in a project-local ignored directory such as `docs/network/airndb-captures/`.

## AirNDB Auto Setup

- On `/airndb enter`, AirNDB checks for `tcpdump`, `windump`, or `WinDump.exe`.
- If no capture tool is available on Windows, AirNDB downloads the official `WinDump.exe` linked from the WinDump install page:

```text
https://www.winpcap.org/windump/install/bin/windump_3_9_5/WinDump.exe
```

- AirNDB verifies SHA1 before using the file:

```text
d59bc54721951dec855cbb4bbc000f9a71ea4d95
```

- AirNDB stores the binary at `AirPlan/state/airndb/tools/WinDump.exe` and writes `AirPlan/state/airndb/tool.env`:

```text
AIRNDB_TCPDUMP=<absolute path to WinDump.exe>
```

- AirNDB does not silently install WinPcap/Npcap drivers. If `WinDump.exe -D` fails after download, tell the user to install Npcap or WinPcap and retry from an elevated terminal.

## Safe Defaults

- Start with interface discovery before capture:

```bash
windump -D
tcpdump -D
```

- Prefer short, bounded capture:

```bash
tcpdump -i <iface> -nn -s 0 -w <file>.pcap -c 200 '<bpf>'
```

- Read back a pcap summary:

```bash
tcpdump -nn -r <file>.pcap '<bpf>'
```

## BPF Examples

```text
host 192.0.2.10
tcp and port 443
udp and port 53
src host 192.0.2.10 and dst port 443
net 10.0.0.0/8 and not port 22
icmp or icmp6
```

## Evidence Rules

- Record exact command, interface, filter, packet count, capture window, pcap path, and summary path.
- Keep pcap files private unless reviewed; they can contain tokens, cookies, payload, internal hostnames, and addresses.
- If application payload is encrypted, use packet timing, DNS, TCP/TLS handshakes, retransmissions, resets, or connection failures as evidence instead of expecting plaintext.