diff --git a/ansible/tasks/base.yml b/ansible/tasks/base.yml
index 1336709..a9783bd 100644
--- a/ansible/tasks/base.yml
+++ b/ansible/tasks/base.yml
@@ -8,6 +8,7 @@
     - iptables-persistent
     - conntrack
     - ntp
+    - tcpdump
 
 - name: latest bash (CVE-2014-6271)
   apt: name=bash state=latest install_recommends=no
diff --git a/ansible/tasks/extras.yml b/ansible/tasks/extras.yml
index 5b6af83..e6b87c4 100644
--- a/ansible/tasks/extras.yml
+++ b/ansible/tasks/extras.yml
@@ -4,5 +4,4 @@
   apt: name={{item}} state=installed install_recommends=no
   with_items:
     - mtr
-    - tcpdump
     - tshark