Rotate pcap files every N minutes or N hours, based on the traffic you're expecting.The more information you can filter, the better - smaller file sizes, easier to exfiltrate, less postprocessing, more targeted.The Tcpdump page has more on how to best utilize tcpdump, but here are some tips: See tips below on filtering to keep this from being an overwhelming amount of data. If sniffing locally, sniff the network device that the browser will be using (or sniff all network devices, if you aren't sure which one).Once you have made a connection to the sheep, pass all traffic from/to the sheep through a network tap device, and use a standard sniffing tool to dump all the traffic (e.g., tcpdump). If sniffing remotely, carry out a MITM attack, such as ARP Poisoning, with a tool like Bettercap.In order to sniff HTTPS traffic, we can either sniff remotely or locally. OpenSSL and other online converters can convert private keys among the various formats available. Ultimately we're looking for private keys in either PEM or PKCS12 format. How might you obtain the private key they use for HTTPS, which would allow you to decrypt all of their HTTPS traffic? Suppose you wish to eavesdrop on a sheep's HTTPS traffic, and you have physical access to their machine. Unlike SSLStrip or SSLSniff, this attack requires more information from the sheep (and potentially requires more invasive methods), but is entirely transparent to the sheep if carried out correctly. This page will cover an attack on HTTPS that utilizes a stolen private key to decrypt and sniff HTTPS traffic from a sheep user. 2.1.4 Inspecting Decrypted Traffic in Wireshark with SSLKEYLOGFILE.2.1.3 Obtain SSL Session Info from Firefox.2.1.2 Start Capturing Traffic with Wireshark.2.1.1 Optional: Start Man in the Middle Attack.1.3 Decrypting SSL Traffic with SSL Info.

Wireshark intercept https