Filtering UDP Packets with tcpdump

Yes, you can filter UDP packets with tcpdump by using the udp keyword or the protocol number 17 in your filter expression. For example, tcpdump udp captures only UDP traffic, and you can narrow it further by port, host, or even packet content.

What tcpdump Is and Why Filter UDP?

tcpdump is a command-line packet analyzer that runs on most Unix-like systems, including Linux and macOS. It captures packets that pass through a network interface and prints a line of information about each one. By default, it captures all traffic, which can be overwhelming on a busy network. Filtering lets you focus on the traffic you care about, such as UDP packets, which are used by DNS, DHCP, streaming media, VoIP, and many games.

UDP (User Datagram Protocol) is a connectionless transport protocol. Unlike TCP, it does not establish a session or guarantee delivery. This makes it fast and lightweight, but also means that packet loss or ordering issues are not automatically corrected. When troubleshooting UDP-based applications, seeing exactly which packets are sent and received is often essential.

Basic UDP Filter Syntax

The simplest filter is just udp. This tells tcpdump to only show packets where the IP protocol field is 17 (UDP). You can combine it with other primitives using and, or, and not.

Common examples:

• tcpdump udp – all UDP traffic
• tcpdump udp port 53 – DNS queries and responses
• tcpdump udp port 67 or port 68 – DHCP traffic
• tcpdump 'udp and host 192.168.1.10' – UDP to or from a specific host
• tcpdump 'udp and not port 53' – all UDP except DNS

Note that the port keyword applies to both source and destination ports. If you need only one direction, use src port or dst port.

Understanding the Output

When tcpdump prints a UDP packet, it shows something like:

12:34:56.789012 IP 192.168.1.1.5353 > 224.0.0.251.5353: UDP, length 32

This line includes the timestamp, protocol (IP), source address and port, destination address and port, the word UDP, and the total length of the UDP payload in bytes. The length is the UDP datagram size, not including the IP header. For example, a DNS query might be 32 bytes, while a large video stream packet could be 1400 bytes or more.

If you need more detail, use the -v (verbose) flag to see additional fields like the IP TTL and checksum. The -vv flag adds even more, including UDP checksum details.

Filtering by Port, Host, and Network

Port filtering is the most common way to narrow UDP captures. For example, to watch DNS traffic, you would use udp port 53. But you can also filter by host or subnet:

• tcpdump 'udp and host 10.0.0.5' – UDP to or from 10.0.0.5
• tcpdump 'udp and net 192.168.1.0/24' – UDP within a subnet
• tcpdump 'udp and src net 10.0.0.0/8' – UDP from a specific network

You can also combine multiple conditions. For instance, to capture NTP traffic from a specific server: tcpdump 'udp and host 129.6.15.28 and port 123'.

Remember that the host keyword matches either source or destination. If you need a specific direction, use src host or dst host.

Common Problems and Pitfalls

One common mistake is forgetting that the port filter applies to both source and destination. If you want only packets sent to a specific port, use dst port.

Another issue is that some UDP protocols use random high ports. For example, streaming media might use ports above 1024. In that case, you might need to filter by the application’s known port range or use a more complex BPF (Berkeley Packet Filter) expression.

Also, tcpdump may not show the UDP checksum by default. Use -v to see it. A bad checksum can indicate corrupted packets, but on many systems the checksum is offloaded to the network card, so it might not be calculated or verified correctly.

Finally, when capturing on a busy interface, you might drop packets. The output will show a message like tcpdump: packet dropped. To reduce drops, capture to a file with -w and increase the buffer size with -B (e.g., tcpdump -B 4096 udp -w udp.pcap).

Advanced Filtering: BPF Syntax

tcpdump uses the Berkeley Packet Filter (BPF) syntax. This allows you to filter on individual bits and bytes of the packet. For example, to capture only UDP packets with a specific destination port, you could write:

tcpdump 'udp[2:2] = 53'

This checks the UDP header’s destination port field (bytes 2-3 of the UDP header) against 53. Similarly, udp[0:2] = 53 would match source port 53.

You can also filter on the payload. For instance, to find DHCP packets that contain a specific option, you would need to examine the payload bytes. This is more advanced and requires knowing the protocol structure, but it gives you complete control.

Another useful filter is to capture only UDP packets that are not fragmented. Fragmented UDP packets can be tricky because only the first fragment has the port numbers. To capture only the first fragment, you can use udp and (ip[6:2] & 0x1fff = 0).

Reading and Saving Captures

You can save captured packets to a file with -w and read them later with -r. For example:

tcpdump -i eth0 udp -w udp.pcap

This writes all UDP packets to the file udp.pcap. To read it later:

tcpdump -r udp.pcap

You can apply filters when reading a file, just like when capturing live. This is useful for analyzing a capture without having to re-capture.

To see the output in hex and ASCII, use -X or -XX. This is helpful for inspecting the payload of DNS queries or other text-based protocols.

Frequently Asked Questions

How do I capture only UDP packets on a specific port?

Use tcpdump udp port 53 to capture only UDP traffic on port 53 (DNS). To capture only traffic to that port, use tcpdump udp dst port 53. For traffic from that port, use src port 53.

Why does tcpdump show ‘UDP, length 0’?

A length of 0 means the UDP payload is empty. This can happen with some protocols that send empty datagrams as keepalives or acknowledgments. It is not an error; the UDP header itself is still 8 bytes.

Can I filter UDP by source or destination IP?

Yes, use src host or dst host. For example, tcpdump 'udp and src host 192.168.1.1' captures UDP packets that originate from that IP.

What is the difference between ‘udp’ and ‘ip proto 17’?

They are equivalent. UDP is protocol number 17 in the IP header. Using ip proto 17 is a lower-level filter that also matches UDP. Some users prefer udp for readability.

How do I capture UDP traffic from a specific application?

You need to know the port(s) the application uses. For example, if a game uses UDP port 7777, use tcpdump udp port 7777. You can find the port by checking the application’s documentation or using netstat while it runs.

Does tcpdump affect the performance of my network?

tcpdump can drop packets on high-traffic interfaces. To minimize drops, use a larger buffer with -B and write directly to a file with -w. Also, consider capturing only the traffic you need by using specific filters.

Related

• How to Exit Twitch on Desktop
• Scaling Telecom Manufacturing: Assembly to R&D
• Print in Place 3D Printer Model Meaning