Michael Lorincz — Technical Notes

tcpdump - Commands

5 min read

tcpdump Commands

tcpdump networking packet-capture troubleshooting

Basic Syntax

tcpdump [options] [expression]

Common options:

-i <interface>   # Capture on specific interface
-i any           # Capture on all interfaces
-n               # Don't resolve hostnames
-nn              # Don't resolve hostnames or ports
-v/-vv/-vvv      # Verbose output levels
-c <count>       # Capture count packets then stop
-w <file>        # Write to pcap file
-r <file>        # Read from pcap file
-s <snaplen>     # Capture length (0 = full packet)
-A               # Print packet in ASCII
-X               # Print packet in hex and ASCII
-e               # Print link-layer header
-q               # Quiet output
-tttt            # Human-readable timestamp

Interface Selection

# List available interfaces
tcpdump -D
 
# Capture on specific interface
tcpdump -i eth0
 
# Capture on all interfaces
tcpdump -i any
 
# Capture on loopback
tcpdump -i lo

Filter Expressions

By Host

# Traffic to/from host
tcpdump host 192.168.1.100
 
# Traffic from source
tcpdump src host 192.168.1.100
 
# Traffic to destination
tcpdump dst host 192.168.1.100
 
# Multiple hosts
tcpdump host 192.168.1.100 or host 192.168.1.101
 
# Exclude host
tcpdump not host 192.168.1.100

By Network

# Traffic to/from network
tcpdump net 192.168.1.0/24
 
# Source network
tcpdump src net 10.0.0.0/8
 
# Destination network
tcpdump dst net 172.16.0.0/12

By Port

# Traffic on port
tcpdump port 80
 
# Source port
tcpdump src port 443
 
# Destination port
tcpdump dst port 22
 
# Port range
tcpdump portrange 8000-8080
 
# Multiple ports
tcpdump port 80 or port 443

By Protocol

# TCP only
tcpdump tcp
 
# UDP only
tcpdump udp
 
# ICMP only
tcpdump icmp
 
# ARP only
tcpdump arp
 
# IPv6
tcpdump ip6
 
# Not ICMP
tcpdump not icmp

Combined Filters

Boolean Operators

OperatorMeaning
and / &&Both conditions
or / `
not / !Negate
()Grouping

Examples

# SSH traffic to specific host
tcpdump tcp port 22 and host 192.168.1.100
 
# HTTP or HTTPS
tcpdump tcp port 80 or tcp port 443
 
# All traffic except SSH
tcpdump not port 22
 
# Complex filter
tcpdump '(tcp port 80 or tcp port 443) and host 10.0.0.5'
 
# Traffic between two hosts
tcpdump host 192.168.1.100 and host 192.168.1.200

TCP Flag Filters

# SYN packets (new connections)
tcpdump 'tcp[tcpflags] & tcp-syn != 0'
 
# SYN-ACK packets
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)'
 
# RST packets
tcpdump 'tcp[tcpflags] & tcp-rst != 0'
 
# FIN packets
tcpdump 'tcp[tcpflags] & tcp-fin != 0'
 
# SYN only (no ACK)
tcpdump 'tcp[tcpflags] == tcp-syn'
 
# Packets with PUSH flag
tcpdump 'tcp[tcpflags] & tcp-push != 0'

TCP Flags:

FlagMeaning
tcp-synSynchronize
tcp-ackAcknowledgment
tcp-finFinish
tcp-rstReset
tcp-pushPush
tcp-urgUrgent

Packet Content Filters

HTTP Examples

# HTTP GET requests
tcpdump -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep GET
 
# HTTP POST requests
tcpdump -A 'tcp port 80' | grep POST
 
# Specific HTTP host header
tcpdump -A 'tcp port 80' | grep -i "Host:"

DNS Examples

# All DNS traffic
tcpdump udp port 53
 
# DNS queries only
tcpdump -vvv udp port 53
 
# Specific DNS server
tcpdump udp port 53 and host 8.8.8.8

ICMP Examples

# All ICMP
tcpdump icmp
 
# Echo request (ping)
tcpdump 'icmp[icmptype] == 8'
 
# Echo reply
tcpdump 'icmp[icmptype] == 0'
 
# Destination unreachable
tcpdump 'icmp[icmptype] == 3'

Output to File

Write Capture

# Write to pcap file
tcpdump -w capture.pcap
 
# Write with rotation (new file every 100MB)
tcpdump -w capture.pcap -C 100
 
# Write with time rotation (new file every hour)
tcpdump -w capture_%H%M.pcap -G 3600
 
# Write with count limit
tcpdump -c 1000 -w capture.pcap

Read Capture

# Read pcap file
tcpdump -r capture.pcap
 
# Read with filter
tcpdump -r capture.pcap tcp port 443
 
# Read with timestamp
tcpdump -tttt -r capture.pcap

Output Formatting

Timestamps

# Default (since midnight)
tcpdump
 
# Since epoch
tcpdump -tt
 
# Microseconds since epoch
tcpdump -ttt
 
# Human readable
tcpdump -tttt
 
# Delta from previous packet
tcpdump -ttttt

Verbosity

# Quiet (minimal)
tcpdump -q
 
# Normal
tcpdump
 
# Verbose (TTL, ID, length, options)
tcpdump -v
 
# More verbose (IP options, checksums)
tcpdump -vv
 
# Most verbose
tcpdump -vvv

Content Display

# ASCII content
tcpdump -A
 
# Hex and ASCII
tcpdump -X
 
# Hex only
tcpdump -x
 
# Include link-layer header
tcpdump -e

Practical Examples

Troubleshoot Connection Issues

# See all traffic to problematic server
tcpdump -nn host 10.0.0.50
 
# Check for SYN but no SYN-ACK (blocked/no route)
tcpdump -nn 'tcp[tcpflags] == tcp-syn and host 10.0.0.50'
 
# Check for RST packets
tcpdump -nn 'tcp[tcpflags] & tcp-rst != 0 and host 10.0.0.50'

Monitor Web Traffic

# HTTP/HTTPS traffic
tcpdump -nn 'tcp port 80 or tcp port 443'
 
# HTTP traffic with content
tcpdump -A -s0 'tcp port 80'

Capture for Wireshark

# Full packets, no name resolution
tcpdump -nn -s0 -w capture.pcap
 
# Specific traffic for analysis
tcpdump -nn -s0 -w ssl_traffic.pcap 'tcp port 443 and host 10.0.0.100'

Find Broadcast/Multicast

# Broadcast
tcpdump broadcast
 
# Multicast
tcpdump multicast
 
# ARP requests
tcpdump arp

Monitor Specific Application

# MySQL
tcpdump -nn tcp port 3306
 
# PostgreSQL
tcpdump -nn tcp port 5432
 
# Redis
tcpdump -nn tcp port 6379
 
# SSH
tcpdump -nn tcp port 22

Performance Tips

# Don't resolve names (faster)
tcpdump -nn
 
# Limit capture length if content not needed
tcpdump -s 96  # Headers only
 
# Exit after N packets
tcpdump -c 100
 
# Buffer size (if dropping packets)
tcpdump -B 4096

Permissions

# Root required (or CAP_NET_RAW)
sudo tcpdump
 
# Grant capability (avoid sudo)
sudo setcap cap_net_raw+ep /usr/sbin/tcpdump

Graph View

Backlinks