tcpdump Command Examples: 25 Practical Uses

This article answers the question directly: useful tcpdump command examples are those that filter traffic by interface, host, port, protocol, or packet content, and that format output for readability. Below you’ll find a practical set of commands you can adapt immediately, along with explanations of how tcpdump works, how to choose filters, and how to avoid common mistakes.

What tcpdump Does and Why It’s Useful

tcpdump is a command-line packet analyzer available on most Unix-like systems (Linux, macOS, BSD). It captures packets that traverse a network interface and prints a line summarizing each one. It is the go‑to tool for debugging network connectivity, inspecting protocol behavior, and verifying that traffic is flowing as expected. Unlike full GUI tools like Wireshark, tcpdump runs anywhere, uses minimal resources, and is scriptable.

It works by putting the network interface into promiscuous mode (if you have the right permissions) so it can see all packets on the wire, not just those addressed to your host. It then applies a filter expression (using the Berkeley Packet Filter syntax) and prints matching packets.

Basic tcpdump Command Syntax

The general form is:

tcpdump [options] [filter-expression]

Common options:

• -i <interface> – listen on a specific interface (e.g., eth0, en0). Use -i any to capture on all interfaces.
• -c <count> – exit after capturing count packets.
• -n – don’t resolve hostnames (faster, shows IPs).
• -nn – don’t resolve hostnames or port names (shows numeric ports).
• -v, -vv, -vvv – increase verbosity (more protocol details).
• -w <file> – write raw packets to a file (for later analysis with Wireshark or tcpdump).
• -r <file> – read packets from a file instead of live capture.
• -s <snaplen> – set snapshot length (bytes to capture per packet). Use -s 0 to get the full packet.
• -e – print link‑layer header (MAC addresses).

Essential tcpdump Command Examples

Here are the most useful commands, grouped by what they accomplish.

Capture Everything on an Interface

sudo tcpdump -i eth0

This captures all traffic on eth0. Press Ctrl+C to stop. Add -c 20 to stop after 20 packets.

Capture on All Interfaces

sudo tcpdump -i any

Useful when you don’t know which interface carries the traffic you care about.

Filter by Host

sudo tcpdump -i eth0 host 192.168.1.10

Only packets to or from that IP. Use src host or dst host for one direction.

Filter by Port

sudo tcpdump -i eth0 port 80

Shows HTTP traffic (unencrypted). For HTTPS, use port 443. You can combine ports: port 80 or port 443.

Filter by Protocol

sudo tcpdump -i eth0 icmp

Shows ping traffic. Replace icmp with tcp, udp, or arp for those protocols.

Capture Traffic Between Two Hosts

sudo tcpdump -i eth0 host 192.168.1.10 and host 192.168.1.20

Only packets exchanged between those two IPs.

Exclude Traffic (Negative Filter)

sudo tcpdump -i eth0 not port 22

Captures everything except SSH traffic (port 22). Useful to avoid your own SSH session flooding the capture.

Capture TCP Flags (e.g., SYN Packets)

sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'

Shows only TCP SYN packets (connection attempts). Useful for spotting port scans.

Capture HTTP Requests (GET/POST)

sudo tcpdump -i eth0 -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

The -A flag prints the packet contents in ASCII. The complex filter ensures you only see packets with data (not pure ACKs). This is a classic way to see HTTP requests.

Read a Capture File

tcpdump -r capture.pcap

Reads packets from a file saved with -w. Add filters after the file name to narrow down.

Write to a File

sudo tcpdump -i eth0 -w capture.pcap

Saves raw packets. Open the file later in Wireshark or with tcpdump. Use -C <size> to split files at a size (in MB) and -W <count> to limit the number of files.

How to Choose the Right Filter

Think about what you’re trying to see:

• Is the traffic to/from a specific machine? Use host.
• Is it a specific service? Use port (e.g., 53 for DNS, 80 for HTTP, 443 for HTTPS, 22 for SSH).
• Is it a protocol? Use tcp, udp, icmp, arp.
• Do you need to see both sides of a conversation? Use host A and host B.
• Do you want to exclude noise? Use not (e.g., not port 22).

Combine conditions with and, or, and not. Parentheses are required for complex expressions, and you should quote the whole filter to avoid shell interpretation.

Common Problems and How to Fix Them

• “You don’t have permission to capture on that device� – Run tcpdump with sudo or as root. On some systems you need the CAP_NET_RAW capability.
• No output at all – Check the interface name (ip link show on Linux, networksetup -listallhardwareports on macOS). Make sure you’re on the right interface. Try -i any to see all traffic.
• Too much output – Narrow your filter. Use -c to limit packet count, or add -n to avoid DNS lookups that slow things down.
• Truncated packets – The default snaplen is 262144 bytes on modern systems, but if you see “truncated� in the output, increase it with -s 0 (full packet).
• Capture file is huge – Use -c to stop after a certain number of packets, or use -C to split files.

tcpdump vs. Wireshark vs. tshark

tcpdump is a command‑line tool; Wireshark is a graphical packet analyzer. Wireshark can read tcpdump capture files (and vice versa). tshark is the command‑line version of Wireshark, offering more protocol dissection options than tcpdump. For quick checks and scripting, tcpdump is usually enough. For deep protocol analysis (e.g., following TCP streams, decoding application data), Wireshark is more convenient.

Safety and Ethical Considerations

Capturing network traffic can expose sensitive data (passwords, personal messages). Only capture on networks you own or have explicit permission to monitor. Be aware that tcpdump can consume significant CPU and disk space if you’re not careful with filters. Never use tcpdump to intercept traffic without authorization – it may be illegal and is certainly unethical. Also, note that tcpdump does not decrypt encrypted traffic; you’ll only see the encrypted payload.

Frequently Asked Questions

How do I see the whole packet in tcpdump?

Use -s 0 to capture the full packet (no truncation). Combine with -X to print hex and ASCII, or -A for ASCII only.

How do I capture only outgoing traffic?

Use src host <your-ip> or src port <port>. For example, sudo tcpdump -i eth0 src host 192.168.1.10.

How do I save tcpdump output to a file and read it later?

Use -w filename.pcap to save raw packets. To read, use tcpdump -r filename.pcap. You can also open the file in Wireshark.

Why does tcpdump show a lot of ARP packets?

ARP is used to resolve IP addresses to MAC addresses on local networks. It’s normal to see ARP traffic. If you don’t want it, add not arp to your filter.

Can tcpdump capture traffic on a Wi-Fi interface?

Yes, but you may need to put the interface into monitor mode (if supported) to capture other clients’ traffic. On Linux, use iwconfig or airmon-ng; on macOS, it’s often not possible without special drivers. In most cases, capturing on a Wi-Fi interface in managed mode will only show your own traffic.

How do I see TCP handshake packets (SYN, ACK)?

Use a filter like 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'. To see only SYN packets, use 'tcp[tcpflags] & tcp-syn != 0'.

Related

• Halloween The Game Prologue Challenge 5 No Alerts Guide
• Turntable Sounds Quiet or Distorted: Fixes
• Dig to Escape Classes Tier List: Ranking