Tcpdump Cheat Sheet: Commands & Filters

Tcpdump is a command-line packet analyzer that captures and displays network traffic in real time. This cheat sheet covers the most useful tcpdump commands and filter syntax, so you can capture, filter, and interpret packets efficiently. Below you’ll find common options, filter expressions, and practical examples to get you started.

What Is Tcpdump?

Tcpdump is a packet sniffer that runs on Unix-like operating systems (Linux, macOS, BSD). It uses the libpcap library to capture raw network frames from a network interface. You can save captures to a file for later analysis (with -w) or read them back (with -r). It’s a standard tool for network troubleshooting, security analysis, and learning how protocols work.

Basic Syntax and Options

The general syntax is: tcpdump [options] [filter]. Here are the most commonly used options:

• -i <interface> – specify the network interface (e.g., eth0, wlan0). Use -i any to capture on all interfaces.
• -c <count> – exit after capturing count packets.
• -n – don’t resolve hostnames (show IP addresses instead).
• -nn – don’t resolve hostnames or port names (show port numbers).
• -v, -vv, -vvv – increase verbosity of packet details.
• -w <file> – write raw packets to a file (use .pcap extension).
• -r <file> – read packets from a file instead of capturing live.
• -s <snaplen> – set snapshot length (bytes captured per packet). Default is 262144 bytes; use -s 0 for full packets.
• -e – print the link-layer header (e.g., MAC addresses).
• -X – print packet data in hex and ASCII.
• -A – print packet data as ASCII (useful for HTTP).

Common Filter Expressions

Filters use the Berkeley Packet Filter (BPF) syntax. Combine with and, or, and not (or use symbols &&, ||, !).

• host 192.168.1.1 – traffic to or from that IP.
• src 192.168.1.1 / dst 192.168.1.1 – traffic from or to that IP.
• port 80 – traffic on port 80 (HTTP).
• src port 443 – traffic from source port 443.
• tcp, udp, icmp – protocol filters.
• tcp port 22 – TCP traffic on port 22 (SSH).
• net 10.0.0.0/8 – traffic to or from that subnet.
• broadcast / multicast – filter by packet type.

Practical Examples

Here are real-world commands you might use:

1. Capture all HTTP traffic on eth0: sudo tcpdump -i eth0 -nn port 80
2. Capture 100 packets and stop: sudo tcpdump -i any -c 100
3. Save a capture to a file: sudo tcpdump -i wlan0 -w capture.pcap
4. Read a capture file and show IPs only: tcpdump -r capture.pcap -n
5. Capture traffic from a specific host and port: sudo tcpdump -i eth0 src 192.168.1.10 and port 53

Interpreting Output

A typical line looks like: 14:23:45.123456 IP 192.168.1.1.54321 > 93.184.216.34.80: Flags [S], seq 12345, win 64240, length 0. The timestamp, source IP.port, destination IP.port, TCP flags (S=SYN, P=PSH, F=FIN, R=RST), sequence number, window size, and payload length are shown. With -v you get TTL, protocol, and checksum details.

Common Pitfalls and Tips

• Permission errors: Use sudo or run as root; otherwise you may see “You don’t have permission to capture on that device.â€�
• Filter syntax mistakes: The shell may interpret parentheses and operators. Quote the filter: tcpdump -i eth0 "tcp port 80 and not src 192.168.1.1".
• Hostname resolution delays: Use -n to avoid DNS lookups that slow down capture.
• Large captures: Use -c or -w to avoid flooding your terminal.
• Interface not found: Run tcpdump -D to list available interfaces.

Frequently Asked Questions

How do I capture traffic on a specific port?

Use tcpdump -i eth0 port 80 to capture all traffic on port 80. Add tcp or udp to narrow it: tcpdump -i eth0 tcp port 80.

How do I save a tcpdump capture to a file?

Use the -w option: sudo tcpdump -i eth0 -w output.pcap. To read it later, use tcpdump -r output.pcap.

Why do I see “tcpdump: no suitable device found�?

This usually means the interface name is wrong or you don’t have permission. Run tcpdump -D to list interfaces, and use sudo if needed.

How do I capture only HTTP GET requests?

Use tcpdump -i eth0 -A -s 0 'tcp port 80 and (tcp[((tcp[12] & 0xf0) >> 2):4] = 0x47455420)' – the hex 0x47455420 is “GET â€� in ASCII. Alternatively, use a tool like ngrep for easier regex matching.

Can tcpdump capture IPv6 traffic?

Yes, tcpdump supports IPv6. Use ip6 in the filter, e.g., tcpdump -i eth0 ip6. The output will show IPv6 addresses.

What is the difference between tcpdump and Wireshark?

Tcpdump is command-line and lightweight; Wireshark has a GUI and more analysis features. You can capture with tcpdump and open the file in Wireshark for deeper inspection.

Related

• Android Screen Recording Privacy: What Gets Captured
• Best Ways to Delete Temp Files on Mac
• Recover Files or Windows from a Macrium Reflect 8 Image

in t | Capture duration | sec | 60 | 1
in n | Max packets | packets | 100 | 1
out p | Packets per second | pps | n / t | 2