i need tcpdump to analyze traffic but don’t want to download anything using my real ip in sys-net. any solution to this?
Install it in the template of your sys-net, then reboot your sys-net.
In Qubes Global Config use update proxy as sys-whonix or sys-vpn.
1 Like
Download the tool package with the extension .deb in a Qube that are connected to the VPN https://ftp.debian.org/debian/pool/main/t/tcpdump/tcpdump_4.99.5-2_amd64.deb, move the downloaded package to your sys-net and run sudo dpkg -i tcpdump_4.99.5-2_amd64.deb.
With this way, every time Sys-Net is rebooted, the package will be uninstalled. If the sys-net is a DispVm, then you will have to redownload it each time. Also, I don’t like to download an “isolated” package because of the problems that can be with dependencies (especially since this package is available in repositories).
The most logical and secure solution is to install it in the sys-net template and everything is settled once and for all.
2 Likes
You’re right, but I recommended this method because he mentioned wanting to install tcpdump in his sys-net qube. However, he didn’t clarify whether he intended for tcpdump to be persistent in sys-net. That’s why I assumed he only wanted to install it for a one-time use.
I completely agree with you. My response was simply intended to an alternative to do it.
1 Like