Techzone/tcpdump

tcpdump

3 min readArticle

Tcpdump is the classic command-line packet capture tool. Lightweight, available on virtually every Unix/Linux system, and extremely fast. Where Wireshark is better for interactive analysis, tcpdump is better for headless servers, quick captures, automation, and piping output to other tools. Essential to know.

Installation

bash 
sudo apt install tcpdump
# Usually pre-installed on Linux/macOS

Basic Capture

bash 
# Capture on default interface
sudo tcpdump

# Specify interface
sudo tcpdump -i eth0
sudo tcpdump -i wlan0mon  # Monitor mode for WiFi

# Capture N packets
sudo tcpdump -i eth0 -c 100

# Don't resolve hostnames (faster, shows IPs)
sudo tcpdump -n

# Don't resolve hostnames or port names
sudo tcpdump -nn

# Verbose output
sudo tcpdump -v    # verbose
sudo tcpdump -vv   # more verbose
sudo tcpdump -vvv  # maximum verbose

Saving to File

bash 
# Save to pcap
sudo tcpdump -i eth0 -w capture.pcap

# Read from pcap
tcpdump -r capture.pcap

# Save to pcap and display on screen
sudo tcpdump -i eth0 -w capture.pcap | tee /dev/tty

Filtering (BPF - Berkeley Packet Filter)

bash 
# By host
sudo tcpdump host 192.168.1.1
sudo tcpdump src host 192.168.1.1      # Source only
sudo tcpdump dst host 192.168.1.1      # Destination only

# By port
sudo tcpdump port 80
sudo tcpdump port 22 or port 443

# By protocol
sudo tcpdump tcp
sudo tcpdump udp
sudo tcpdump icmp

# By network
sudo tcpdump net 192.168.1.0/24

# Combine filters
sudo tcpdump 'host 192.168.1.1 and port 443'
sudo tcpdump 'tcp port 80 or tcp port 443'
sudo tcpdump 'not port 22'   # Exclude SSH noise

# TCP flags
sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0'  # SYN packets
sudo tcpdump 'tcp[tcpflags] == tcp-rst'       # RST packets

Useful Combinations

bash 
# Capture HTTP traffic with content
sudo tcpdump -i eth0 -A port 80

# Show packet contents in hex
sudo tcpdump -i eth0 -X port 80

# Watch for specific string in traffic
sudo tcpdump -i eth0 -A | grep -i "password"

# Capture all traffic to/from host except SSH
sudo tcpdump -i eth0 host 192.168.1.5 and not port 22

# DNS queries only
sudo tcpdump -i eth0 udp port 53

# Capture WiFi management frames (monitor mode)
sudo tcpdump -i wlan0mon -e type mgt

# Capture deauth frames
sudo tcpdump -i wlan0mon 'wlan[0] == 0xc0'

Remote Capture (SSH Pipe)

Capture on a remote host and view locally in Wireshark:

bash 
# Capture on remote host, pipe to local Wireshark
ssh user@remote "sudo tcpdump -i eth0 -w -" | wireshark -k -i -

# Or save on remote, pull back
ssh user@remote "sudo tcpdump -i eth0 -c 1000 -w /tmp/cap.pcap"
scp user@remote:/tmp/cap.pcap ./local_cap.pcap

File Rotation

bash 
# Rotate files every 100MB
sudo tcpdump -i eth0 -C 100 -w /tmp/capture.pcap

# Rotate every 60 seconds, keep 5 files
sudo tcpdump -i eth0 -G 60 -W 5 -w /tmp/capture_%Y%m%d_%H%M%S.pcap

Display Filters for Common Scenarios

bash 
# Find HTTP POST requests (credential capture)
sudo tcpdump -i eth0 -A 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

# Watch ARP traffic
sudo tcpdump -i eth0 arp

# Monitor ICMP
sudo tcpdump -i eth0 icmp and not icmp[0]=0

Quick Tips

  • -n is almost always what you want (skip DNS resolution)
  • -A shows ASCII content of packets (grep-able)
  • Combine with grep for quick keyword searching
  • Use -w for later analysis in Wireshark or tshark
  • For WiFi captures: interface must be in monitor mode

See Also

  • tshark-cli-guide - More powerful command-line alternative
  • scapy-packet-crafting - Inject as well as capture
  • pyshark-python-packet-analysis - Parse tcpdump/Wireshark captures in Python
techzonesite.comUnlock Your IT Potential