tcpdump is a powerful command-line packet analyzer that lets you capture and inspect network traffic in real time. When you need to troubleshoot services like DNS, DHCP, or NTP, filtering for UDP packets is often the quickest way to see what’s happening on the wire.
In this guide, we’ll look at how to filter UDP packets with tcpdump, step by step, with examples and sample output.
Table of Contents
Understanding UDP and tcpdump
UDP (User Datagram Protocol) is a connectionless transport protocol. Unlike TCP, it doesn’t establish a session or guarantee delivery, which makes it fast and lightweight—ideal for DNS lookups, DHCP leases, streaming, and VoIP. If you’d like a refresher on the differences, see TCP vs UDP.
Because UDP is “fire and forget,” capturing it live with tcpdump is one of the best ways to confirm whether packets are actually being sent and received. If you’re new to the tool, this quick guide to tcpdump covers the basics.
Filter UDP packets with tcpdump
The simplest way to filter UDP traffic is to use the udp keyword. Run the command as root or with sudo:
sudo tcpdump -i eth0 udp
Sample output:
09:15:22.114512 IP 192.168.1.10.51520 > 8.8.8.8.53: 12345+ A? example.com. (29)
09:15:22.140881 IP 8.8.8.8.53 > 192.168.1.10.51520: 12345 1/0/0 A 93.184.216.34 (45)
Let’s break down the command:
sudo—tcpdumpneeds root privileges to capture packets.tcpdump— the packet capture tool.-i eth0— capture on theeth0interface (use-i anyfor all interfaces).udp— the filter that limits the capture to UDP packets only.
A few flags make the output cleaner:
-n— don’t resolve hostnames.-nn— don’t resolve hostnames or port numbers.-c 10— stop after 10 packets.-v,-vv,-vvv— show more detail.
sudo tcpdump -nni eth0 udp -c 10
Filter UDP packets by port
Most of the time you want a specific service, which means filtering by port. Combine udp with port, src port, or dst port:
# UDP traffic on port 53 (DNS), in either direction
sudo tcpdump -nni eth0 udp port 53
# Only packets going to port 123 (NTP)
sudo tcpdump -nni eth0 udp dst port 123
# Only packets coming from port 161 (SNMP)
sudo tcpdump -nni eth0 udp src port 161
You can also match a range of ports with portrange:
See also: Mastering the Linux Command Line — Your Complete Free Training Guide
sudo tcpdump -nni eth0 udp portrange 0-1023
For more on port-based expressions, see filtering ports with tcpdump.
Here are some common UDP ports worth capturing:
| Service | Port(s) | Filter |
|---|---|---|
| DNS | 53 | udp port 53 |
| DHCP | 67, 68 | udp port 67 or udp port 68 |
| NTP | 123 | udp port 123 |
| SNMP | 161, 162 | udp port 161 or udp port 162 |
| Syslog | 514 | udp port 514 |
| TFTP | 69 | udp port 69 |
Filter UDP packets by host
To focus on traffic to or from a particular machine, add a host, src, or dst primitive:
# UDP traffic to or from a specific host
sudo tcpdump -nni eth0 udp and host 8.8.8.8
# UDP traffic from one source
sudo tcpdump -nni eth0 udp and src 192.168.1.10
# UDP traffic to a destination
sudo tcpdump -nni eth0 udp and dst 192.168.1.1
You can combine conditions with and, or, and not. Quote the expression when it contains spaces:
sudo tcpdump -nni eth0 'udp port 53 and host 8.8.8.8'
For the full list of primitives and operators, see the tcpdump filters guide.
Example: capture DNS packets
DNS is the classic UDP service, running on port 53:
sudo tcpdump -nni eth0 udp port 53
09:31:04.220145 IP 192.168.1.10.44011 > 1.1.1.1.53: 4821+ A? howtouselinux.com. (35)
09:31:04.238902 IP 1.1.1.1.53 > 192.168.1.10.44011: 4821 1/0/0 A 104.21.32.55 (51)
The + marks a recursion-desired query, A? is the question, and the reply shows the answer record. For a full walkthrough, see using tcpdump to filter DNS packets on Linux.
Example: capture DHCP packets
DHCP uses UDP ports 67 (server) and 68 (client). Capturing both shows the full lease exchange:
sudo tcpdump -nni eth0 udp port 67 or udp port 68
09:40:11.001233 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:00:27:aa:bb:cc, length 300
09:40:11.014788 IP 192.168.1.1.67 > 192.168.1.50.68: BOOTP/DHCP, Reply, length 311
For DHCP and DHCPv6 details, see capturing DHCP and DHCPv6 packets with tcpdump.
Inspect the packet contents
To see the actual payload, add hex/ASCII output:
# Hex and ASCII
sudo tcpdump -nnX -i eth0 udp port 53
# ASCII only (handy for text protocols like syslog)
sudo tcpdump -nnA -i eth0 udp port 514
-X— show the packet in hex and ASCII.-A— show the packet in ASCII.
Save UDP packets to a file
To analyze traffic later (for example, in Wireshark), write the packets to a .pcap file with -w, then read them back with -r:
# Write UDP DNS traffic to a file
sudo tcpdump -nni eth0 udp port 53 -w dns_udp.pcap
# Read it back
tcpdump -nnr dns_udp.pcap
Writing to a file also helps avoid dropped packets on busy links. See how to use tcpdump to write to a file for network analysis.
Summary
| Goal | Command |
|---|---|
| All UDP packets | tcpdump -nni eth0 udp |
| UDP on a port | tcpdump -nni eth0 udp port 53 |
| UDP to a port | tcpdump -nni eth0 udp dst port 123 |
| UDP for a host | tcpdump -nni eth0 udp and host 8.8.8.8 |
| Inspect payload | tcpdump -nnX -i eth0 udp port 53 |
| Save to a file | tcpdump -nni eth0 udp port 53 -w out.pcap |
Start with the udp keyword, narrow down with port and host, and use -w when you need to keep the capture for later. For more recipes, the tcpdump cheat sheet and 20 advanced tcpdump examples are great next steps.
