tcpdump commands

18 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 18 shown

  • Capture on interface
    tcpdump -i eth0 -n

    Capture all traffic on eth0 without DNS resolution

    network · linux

  • Capture to file
    tcpdump -i eth0 -w /tmp/capture.pcap

    Save raw packets to PCAP file for Wireshark analysis

    network · linux

  • Read PCAP file
    tcpdump -r /tmp/capture.pcap -n | head -50

    Replay and display packets from a saved PCAP file

    network · linux

  • Filter by host
    tcpdump -i any host 10.0.0.5 -n

    Capture only traffic to/from a specific IP

    network · linux

  • Filter by port
    tcpdump -i eth0 port 443 -n

    Capture HTTPS traffic only

    network · linux

  • Capture DNS queries
    tcpdump -i any -n port 53

    Monitor all DNS lookups on any interface

    network · linux · debug

  • Show HTTP GET requests
    tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /'

    Capture and print HTTP GET request lines

    network · linux · debug

  • Capture between two hosts
    tcpdump -i eth0 'host 10.0.0.1 and host 10.0.0.2'

    BPF filter: traffic between exactly two endpoints

    network · linux

  • Verbose with packet content
    tcpdump -i eth0 -vvv -A -s 0 port 5432

    Full verbose output with ASCII packet content for PostgreSQL

    network · linux · debug

  • Limit capture count
    tcpdump -i eth0 -c 100 -w capture.pcap

    Stop after capturing 100 packets

    network · linux

  • Capture only TCP SYN packets
    tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'

    Catch only connection-initiating SYNs (no SYN-ACK) to spot scans or backlog floods

    network · security · troubleshooting

  • Capture SYN and FIN flags
    tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'

    Show only connection open/close packets to trace short-lived churning sessions

    network · debug · troubleshooting

  • Host filter excluding SSH noise
    tcpdump -nn -i any host <ip> and not port 22

    Watch traffic to/from a host while dropping your own SSH session noise

    network · debug

  • Full payload hex+ascii dump
    tcpdump -nn -s 0 -X -i any port <port>

    Inspect full packet bodies in hex+ascii; -s 0 ensures no snaplen truncation

    debug · network · troubleshooting

  • Ring buffer capture by size
    tcpdump -nn -i any -s 0 -C 100 -W 5 -w /tmp/cap.pcap

    Rotate across 5 files of 100MB each so long captures never fill the disk

    disk · monitoring · network

  • Time-rotated capture files
    tcpdump -nn -i any -G 3600 -w '/tmp/cap-%Y%m%d-%H%M%S.pcap'

    Start a fresh pcap every hour with a timestamped name for unattended capture

    monitoring · network · observability

  • Filter an existing pcap offline
    tcpdump -nn -r /tmp/cap.pcap 'port 443 and host <ip>'

    Re-filter a saved capture without re-running it; BPF applies on read

    debug · tls · troubleshooting

  • DNS query capture with link header
    tcpdump -nn -e -i any port 53

    Show DNS lookups with MAC addresses (-e) to map queries to clients on the LAN

    dns · network · troubleshooting