tcpdump

What is tcpdump?

tcpdump is a command-line packet sniffer. It captures and prints network traffic using BPF filters — ideal on servers without a GUI.

Capture packets on Linux/Unix for troubleshooting, evidence collection, or later analysis in Wireshark.

Official website: tcpdump · Documentation

When do you use it?

• SSH’d into a Linux box and need a quick capture without Wireshark GUI.
• You want a small pcap to download and open in Wireshark later.
• Scripted / remote capture in an authorized lab.

When not to use it

• Deep protocol decoding UI — use Wireshark on the saved pcap.
• Unauthorized networks — illegal without permission.

Who uses it?

• Network engineers
• SOC / IR
• Sysadmins
• Pentesters (authorized)

How do you use it? (typical flow)

1. Pick interface (ip link / tcpdump -D).
2. Add a BPF capture filter to reduce noise.
3. Write to -w file.pcap or print summaries to stdout.
4. Stop with Ctrl+C; analyze offline if needed.

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

1. 1. Help

   tcpdump --help

   Lists common flags.

2. 2. Man page

   man tcpdump

   Full BPF and option reference.

3. 3. List interfaces

   tcpdump -D

   Same idea as tshark -D.

1. Installation

2. Basic commands

1. 1. Capture on interface

   sudo tcpdump -i eth0 -nn

   -nn skips name resolution for speed/clarity.

2. 2. Write pcap

   sudo tcpdump -i eth0 -w lab.pcap

   Save for Wireshark.

3. 3. Port filter

   sudo tcpdump -i eth0 port 53

   DNS only (BPF).

4. 4. Read pcap

   tcpdump -r lab.pcap -nn

   Replay summary from file.

5. 5. Count limit

   sudo tcpdump -i eth0 -c 100

   Stop after 100 packets.

Options / flags

5. Useful features

• BPF filter syntax
• Writing pcap files
• Reading captures
• Verbose decoding

6. Practical examples

1. Example 1: Capture on interface

   sudo tcpdump -i eth0 -nn

   -nn skips name resolution for speed/clarity.

2. Example 2: Write pcap

   sudo tcpdump -i eth0 -w lab.pcap

   Save for Wireshark.

3. Example 3: Port filter

   sudo tcpdump -i eth0 port 53

   DNS only (BPF).

4. Example 4: Read pcap

   tcpdump -r lab.pcap -nn

   Replay summary from file.

5. Example 5: Count limit

   sudo tcpdump -i eth0 -c 100

   Stop after 100 packets.

7. Important notes

• BPF capture filters ≠ Wireshark display filters.
• Root/capabilities usually required to sniff.
• Standard on Linux servers for diagnosing network issues and collecting evidence.
• Authorized targets only — labs, systems you own, or written permission.
• Prefer reading --help / man / official docs for your installed version; flags change over time.