tools

Overview

TCPDump is a command-line packet capture and analysis tool. Captures live network traffic from an interface or reads from saved PCAP files. Filters allow precise capture of specific protocols, hosts, ports, and TCP flags. Core tool for network analysis, traffic inspection, and incident response.

Target / Context

Any network interface on a Linux system. Run with sudo for full interface access. Output can be saved to PCAP for analysis in Wireshark.

Installation

ℹ︎Installation Commands: 
sudo apt install tcpdump

Man pages: man tcpdump and man pcap-filter

Basic Usage

ℹ︎Basic Usage: 
sudo tcpdump [options] [filter expression]
sudo tcpdump -i any
sudo tcpdump -i eth0 -w capture.pcap

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-iSpecify network interface-i eth0 / -i any
-DList all available capture interfaces and exit-D
-wSave captured packets to file-w capture.pcap
-rRead packets from a saved file-r capture.pcap
-cStop after capturing N packets-c 100
-nDo not resolve IP addresses-n
-nnDo not resolve IPs or ports-nn
-v / -vv / -vvvIncrease verbosity-vv
-qQuiet mode — brief packet output-q
-eInclude link-level header (MAC addresses)-e
-APrint packet data in ASCII only (no hex)-A
-XPrint packet headers and data in hex and ASCII-X
-XXSame as -X but also includes the ethernet frame header-XX
-SDisplay absolute sequence numbers instead of relative-S
-lLine-buffered output — enables piping to grep and other tools-l
-sSnap length — how many bytes of each packet to capture-s 0 (full packet)

Common Use Cases

List Interfaces

ℹ︎Commands: 
sudo tcpdump -D

Capture All Traffic on Any Interface

ℹ︎Commands: 
sudo tcpdump -i any
sudo tcpdump -i eth0 -nn

sudo tcpdump -i eth0 -nnvXX # Best practice: no name resolution, verbose, full frame in hex+ASCII

Save and Read PCAP Files

ℹ︎Commands: 
sudo tcpdump -i eth0 -w capture.pcap
tcpdump -r capture.pcap
tcpdump -r capture.pcap -nn

Filter by Host and Port

ℹ︎Commands: 
sudo tcpdump host 10.10.10.1
sudo tcpdump src host 10.10.10.1
sudo tcpdump dst host 10.10.10.1
sudo tcpdump port 80
sudo tcpdump src port 443
sudo tcpdump host 10.10.10.1 and port 22
sudo tcpdump host 10.10.10.1 or host 10.10.10.2
sudo tcpdump not port 443

Filter by Protocol

ℹ︎Commands: 
sudo tcpdump tcp
sudo tcpdump udp
sudo tcpdump icmp
sudo tcpdump arp

Filter by TCP Flags

ℹ︎Commands: 
sudo tcpdump "tcp[tcpflags] == tcp-syn"
sudo tcpdump "tcp[tcpflags] & tcp-syn != 0"
sudo tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

Filter by Packet Length

ℹ︎Commands: 
sudo tcpdump greater 1000
sudo tcpdump less 64

Pipe Output to Other Tools

ℹ︎Commands:

-l enables line-buffered mode so output can be piped in real time:

sudo tcpdump -i eth0 -l | grep "password"
sudo tcpdump -i eth0 -l -nn | grep "192.168.1."

Inspect TCP Flags at Byte Level

ℹ︎Commands:

BPF allows direct byte inspection of packet headers using proto[offset:size] syntax. The 13th byte (offset 13) of a TCP header contains the flags field: sudo tcpdump -i eth0 ‘tcp[13] & 2 != 0’ # SYN flag set (bit 1) sudo tcpdump -i eth0 ‘tcp[13] & 16 != 0’ # ACK flag set (bit 4) sudo tcpdump -i eth0 ‘tcp[13] & 1 != 0’ # FIN flag set (bit 0) This is equivalent to using the named flag filters but gives direct byte-level control.

Output Format Reference

When verbose output is enabled, each packet line contains these fields:

TCPDump Output Breakdown

FieldDescription
TimestampTime the packet arrived; configurable format
ProtocolUpper-layer protocol identified (e.g., IP, TCP)
Source & Destination IP.PortFormat: IP.port — e.g., 172.16.146.2.21
FlagsTCP flags present in the packet
Sequence and Acknowledgement NumbersRelative by default; use -S for absolute numbers
Protocol OptionsNegotiated TCP values: window size, SACK, scale factors
Notes / Next HeaderMiscellaneous dissector notes; encapsulated protocol details

Verbosity level controls how much of this is shown — higher verbosity reveals more header fields.

Filter Syntax Reference

ℹ︎Filter Syntax:
SyntaxDescriptionExample
host HOSTNAMEMatch source or destination hosthost 10.10.10.1
src host HOSTNAMEMatch source host onlysrc host 10.10.10.1
dst host HOSTNAMEMatch destination host onlydst host 10.10.10.1
port PORTMatch source or destination portport 443
src/dst port PORTMatch source or destination portsrc port 22
proto[expr:size]Inspect specific byte(s) in headerip[9:1] == 6 (TCP)
greater / less LENGTHFilter by packet lengthgreater 1000
and, or, notLogical operators for combining filtershost x and port 80

Capture Timing — When to Apply Filters

Filters can be applied at capture time or post-capture when reading a PCAP file:

WhenTradeoff
During captureReduces file size and speeds up writes; risk losing data if scope is wrong
Post-capture on PCAPPreserves everything; safer when unsure what to look for; can be slow on large files
  • Packet Sniffing
  • Packet Analysis

References / Images