10 Useful tcpdump examples on Linux

Updated: Jul 30

In this tutorial, we will learn 10 useful Linux tcpdump examples and tcpdump options to analyze the traffic flow on a Linux machine.

This tutorial covers the basic tcpdump filters like source ip, host, interface, specific port, udp port, write to file, all interfaces etc.

Capture traffic on specific interface

-i any means all the interfaces.

$  tcpdump -i ens160 
$  tcpdump -i any

Capture ip host-specific packets

$  tcpdump -i ens160 -c 5  host

Capture packets on a specific port

$  tcpdump -i any port 8000

Write packets to a file ( -w )

$  tcpdump -c 5 -w network_file_linux.pcap -i any

Capture packets from a specific protocol

$  tcpdump -i ens160 -c 5 -nn tcp

Filter tcpdump packets from specific source & dest host

$  tcpdump src
$  tcpdump dst

Rotate tcpdump packets

$ tcpdump -i ens160 -w /tmp/network-%H-%M.pcap -W 48 -G 300 -C 100

-C file_size (M) -G rotate_seconds -W filecount

tcpdump -G 100 -W 3 -w network-%H-%M.pcap port 19096
  1 root  wheel   384881 Feb 13 17:09 network-17-08.pcap
  1 root  wheel  2096619 Feb 13 17:11 network-17-09.pcap
  1 root  wheel   320744 Feb 13 17:13 network-17-11.pcap

Capture Multiple hosts with tcpdump

$ tcpdump src or src 

Filter Multiple ports with tcpdump

$ tcpdump -i eth0 port 22 or port 9402 

Filter All interfaces

$ tcpdump -i any
$ tcpdump -i eth0 arp or icmp and host 

Tcpdump command options summary

Tcpdump provides several options that enhance or modify its output. The following are the commonly used options for tcpdump command.

  • -i <interface>: Listen on the specified interface.

  • -n: Don’t resolve hostnames. We can use -nn to don’t resolve hostnames or port names.

  • -t: Print human-readable timestamp on each dump line, -tttt: Give maximally human-readable timestamp output.

  • -X: Show the packet’s contents in both hex and ascii.

  • -v, -vv, -vvv: Increase the amount of packet information you get back.

  • -c N: Only get N number of packets and then stop.

  • -s: Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.

  • -S: Print absolute TCP sequence numbers.

  • -q: Show less protocol information.

  • -w <file name>: Write the raw packets to file rather

  • -C file_size(M)

  • -G rotate_seconds

Related Post:

Learn tcpdump Quick Guide

20 Advanced Tcpdump Examples On Linux

Linux Tcpdump: Filter ipv6 ntp ping packets