Tcpdump Cheat Sheet With Basic Advanced Examples

Ever wondered what digital whispers are constantly happening behind your screen? Your computer is a bustling hub of activity, sending and receiving countless pieces of data every second. But how do you make sense of that chaotic stream?

Meet tcpdump – your personal network detective.

This incredible command-line tool for Linux (and other Unix-like systems) allows you to capture and inspect raw network packets. Think of it as a powerful magnifying glass for your internet connection. It’s an indispensable utility for network professionals, developers, and anyone who wants to truly understand their network’s heartbeat.

Why Does tcpdump Matter to You?

Beyond just being a cool tech trick, tcpdump is your go-to for:

• Troubleshooting Network Problems: Is that website slow? Is your application struggling to connect? tcpdump can show you exactly where the breakdown is happening.
• Investigating Security Concerns: See suspicious traffic? tcpdump can help you identify unauthorized connections or unusual activity.
• Debugging Applications: Understand how your software communicates over the network, helping you pinpoint bugs.
• Learning Network Protocols: It’s hands-on education! See DNS queries, HTTP requests, and TCP handshakes in action.

And the best part? tcpdump plays incredibly well with other tools, especially Wireshark. You can capture raw data with tcpdump and then open it in Wireshark for a beautiful, graphical deep-dive analysis. It’s the dream team for network insights!

Ready to become a network whisperer? Let’s dive into the essential commands and advanced tricks of tcpdump.

---

Getting Started: Your First tcpdump Commands

To use tcpdump, you’ll typically need administrative privileges (that’s where sudo comes in).

Here’s the basic flow:

1. Open a Terminal: Get ready to type!
2. Basic Syntax: sudo tcpdump [options] [filters]
3. Specify Options & Filters: Tell tcpdump what you want to see.
4. Press Enter: Watch the magic happen.
5. Ctrl+C: Stop the capture when you’re done.

Let’s look at the absolute minimum to get started.

Example 1: The Simplest Capture (Your First Peek)

This command tells tcpdump to listen on your default network interface and show you all the packets it sees.

See also: Mastering the Linux Command Line — Your Complete Free Training Guide

sudo tcpdump -i eth0

• i eth0: This crucial option specifies which network interface to listen on. eth0 is common for wired connections; wlan0 for Wi-Fi. (You can find your interfaces with ifconfig or ip addr).
• What you’ll see: A continuous stream of raw packet information – source/destination IPs, protocols, etc. It can be a lot! This immediately highlights why filters are so important.

Example 2: Saving for Later Analysis (The pcap Power)

Often, you don’t want to just view packets in real-time. You want to save them for a detailed post-mortem, especially with Wireshark.

sudo tcpdump -i eth0 -w capture.pcap

• w capture.pcap: This tells tcpdump to write all the captured packets to a file named capture.pcap.
• Your Workflow:
  1. Run this command.
  2. Let it capture for a bit (or until the issue you’re troubleshooting occurs).
  3. Press Ctrl+C to stop.
  4. Open capture.pcap in Wireshark for rich graphical analysis!

Example 3: Reading a Saved Capture File

After saving, you can also view your .pcap file right in the terminal using tcpdump itself.

tcpdump -r capture.pcap

• r capture.pcap: Reads packets from the specified pcap file.

---

Essential tcpdump Options: Your Basic Toolkit

These are the fundamental switches that let you control how tcpdump behaves.

Option	Description	Example
-i <int>	Interface: Listen on the specified network interface (e.g., eth0, wlan0, any).	tcpdump -i wlan0
-c N	Count: Capture only N number of packets and then exit.	tcpdump -c 10
-n	No hostname resolution: Don’t convert IP addresses to hostnames. Faster and good for scripting.	tcpdump -n
-nn	No hostname or port name resolution: Even faster; shows raw IP addresses and port numbers.	tcpdump -nn
-A	ASCII: Print packet contents in ASCII. Useful for sniffing plain text data (like unencrypted web traffic).	tcpdump -A port 80
-X	Hex and ASCII: Show packet contents in both hexadecimal and ASCII. For deeper payload inspection.	tcpdump -X port 80
-v, -vv	Verbose: Increase output verbosity. -vv and -vvv give even more details.	tcpdump -v icmp
-s0	Snaplength: Capture the full packet size (0 means no limit). By default, tcpdump might truncate packets.	tcpdump -s0 -w full_capture.pcap
-S	Sequence numbers: Print absolute TCP sequence numbers.	tcpdump -S tcp
-q	Quiet: Show less protocol information (less verbose output).	tcpdump -q
-D	Display interfaces: Show a list of all available network interfaces on your system.	tcpdump -D
-w <file>	Write: Write raw captured packets to a file (e.g., capture.pcap) for later analysis.	tcpdump -w output.pcap
-r <file>	Read: Read packets from a previously saved pcap file.	tcpdump -r old_capture.pcap
-t	Timestamp: Print human-readable timestamps on each line. -tttt gives maximally human-readable timestamps.	tcpdump -tttt

---

Powerful tcpdump Filters: Hunting for Specific Traffic

This is where you become a network sharpshooter! Filters let you specify exactly what kind of traffic you want to see.

Filtering by Hosts & Networks

• Traffic involving a specific host (IP or hostname):
  

  sudo tcpdump host 192.168.1.100
  sudo tcpdump host mywebsite.com
  
  

  
  
• Traffic from a specific source IP:
  

  sudo tcpdump src 10.1.1.100
  
  

  
  
• Traffic to a specific destination IP:
  

  sudo tcpdump dst 10.1.1.100
  
  

  
  
• Traffic to/from a network subnet:
  

  sudo tcpdump net 10.1.1.0/24
  
  

  
  

Filtering by Ports & Port Ranges

• Traffic on a specific port:
  

  sudo tcpdump port 80
  
  

  
  
• Traffic within a port range:
  

  sudo tcpdump portrange 21-23
  
  

  
  

Filtering by Protocols

• Only TCP packets:
  

  sudo tcpdump tcp
  
  

  
  
• Only UDP packets:
  

  sudo tcpdump udp
  
  

  
  
• Only ICMP (e.g., ping) packets:
  

  sudo tcpdump icmp
  
  

  
  
• Only IPv6 packets:
  

  sudo tcpdump ip6
  
  

  
  

Filtering by Packet Size

• Packets smaller than 32 bytes:
  

  sudo tcpdump less 32
  
  

  
  
• Packets greater than 64 bytes:
  

  sudo tcpdump greater 64
  
  

  
  
• Packets less than or equal to 128 bytes:
  

  sudo tcpdump <= 128
  
  

  
  

---

Advanced Logic: Combining & Negating Filters

The real magic happens when you combine filters using logical operators: and, or, and not (or !). Remember to enclose complex filter expressions in single quotes ('...') to prevent shell misinterpretation.

• Combine filtering options (e.g., source IP and destination port):
  

  sudo tcpdump 'src 192.168.1.1 and dst port 21'
  
  

  
  

  This shows traffic from 192.168.1.1 going to port 21.

• Either of the conditions can match (or):
  

  sudo tcpdump 'dst 10.1.1.1 or !icmp'
  
  

  
  

  This captures traffic destined for 10.1.1.1 OR any traffic that is not ICMP. Be careful with broad or conditions, as they can still produce a lot of output!

• Negation of a condition (not or !):
  

  sudo tcpdump 'dst 10.1.1.1 and not icmp'
  
  

  
  

  This captures traffic destined for 10.1.1.1 but specifically excludes any ICMP packets.

• Traffic from a specific host that isn’t on a specific port:
  

  sudo tcpdump -i eth0 -vv 'src host mars and not dst port 22'
  
  

  
  

  This is handy for seeing all activity from a server named mars except its SSH connections.

---

Time-Based Captures: Managing Long-Term Monitoring

For prolonged debugging sessions, you need to manage your capture files to avoid creating colossal, unwieldy .pcap files.

• Rotate dump files every X seconds:

  sudo tcpdump -G 15 -W 1 -w /var/log/tcpdump/myfile.pcap -i eth0 'port 8080'
  
  

  • G 15: Creates a new capture file every 15 seconds.
  • W 1: Keeps only 1 file (the most recent). Increase this number to keep more historical files (e.g., W 5 for 5 files).
  • w /var/log/tcpdump/myfile.pcap: This is the base filename. tcpdump will append timestamps to create unique files (e.g., myfile_20230101000000.pcap).
• Capture for a fixed total duration (using timeout):

  timeout 5400 sudo tcpdump -i eth0 'port 8080' -w /var/log/tcpdump/session.pcap
  
  

  • timeout 5400: The tcpdump command will run for exactly 5400 seconds (90 minutes) and then automatically stop. This is great for scheduled captures.

---

Unveiling TCP Flags: The Language of Connection Management

TCP (Transmission Control Protocol) uses specific flags in its header to manage the lifecycle of a connection – from setting it up, transferring data, to gracefully closing it. Analyzing these flags is crucial for diagnosing stubborn connection issues.

The TCP flags are located at byte offset 13 within the TCP header. We can use tcp[13] to refer to this byte for filtering. You’ll often see two ways to filter them: using bitwise operations (&) or the more readable tcp[tcpflags] shorthand.

Flag Shorthand	Bit Value	Description	Bitwise Filter Example	Readable Filter Example
tcp-fin	1	Finish: Gracefully close connection.	tcp[13] & 1!=0	'tcp[tcpflags] == tcp-fin'
tcp-syn	2	Synchronize: Initiate a connection.	tcp[13] & 2!=0	'tcp[tcpflags] == tcp-syn'
tcp-rst	4	Reset: Abruptly terminate connection.	tcp[13] & 4!=0	'tcp[tcpflags] == tcp-rst'
tcp-psh	8	Push: Deliver buffered data immediately.	tcp[13] & 8!=0	'tcp[tcpflags] == tcp-push'
tcp-ack	16	Acknowledge: Acknowledge received data.	tcp[13] & 16!=0	'tcp[tcpflags] == tcp-ack'
tcp-urg	32	Urgent: Urgent data present.	tcp[13] & 32!=0	'tcp[tcpflags] == tcp-urg'
tcp-ece	64	ECE: ECN-Echo (Explicit Congestion)	tcp[13] & 64!=0	'tcp[tcpflags] == tcp-ece'
tcp-cwr	128	Congestion Window Reduced	tcp[13] & 128!=0	'tcp[tcpflags] == tcp-cwr'

Combined SYN and ACK (The 3-Way Handshake):

To see the crucial SYN-ACK packet (the server’s response during connection setup), you’re looking for packets where both SYN (bit 2) and ACK (bit 16) are set. Their combined value is 18.

sudo tcpdump 'tcp[13]=18'

• Why this is huge: If you send a SYN (client) but never receive a SYN-ACK (server), your connection isn’t even starting! This is a common indicator of a firewall blocking the server’s response.

---

Your Network, Demystified and Under Your Control

Congratulations! You’ve navigated the depths of tcpdump with this comprehensive cheat sheet. From basic captures to intricate flag analysis, you now possess the knowledge to truly understand the conversations happening on your network.

tcpdump is an incredibly powerful diagnostic and learning tool. By mastering its filters and options, you’re not just running commands; you’re gaining profound insights into the digital world around you.

 

Related Post:

Filtering DNS with Tcpdump

Filtering ICMP ICMPv6 Packets with Tcpdump