Capture only TCP SYN packets

Catch only connection-initiating SYNs (no SYN-ACK) to spot scans or backlog floods

tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'
tool
tcpdump18 commands
tags
tcpdumpnetworksecuritytroubleshooting

More tcpdump commands

  • Capture SYN and FIN flags
    tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'

    Show only connection open/close packets to trace short-lived churning sessions

  • Host filter excluding SSH noise
    tcpdump -nn -i any host <ip> and not port 22

    Watch traffic to/from a host while dropping your own SSH session noise

  • Full payload hex+ascii dump
    tcpdump -nn -s 0 -X -i any port <port>

    Inspect full packet bodies in hex+ascii; -s 0 ensures no snaplen truncation

  • Ring buffer capture by size
    tcpdump -nn -i any -s 0 -C 100 -W 5 -w /tmp/cap.pcap

    Rotate across 5 files of 100MB each so long captures never fill the disk

  • Time-rotated capture files
    tcpdump -nn -i any -G 3600 -w '/tmp/cap-%Y%m%d-%H%M%S.pcap'

    Start a fresh pcap every hour with a timestamped name for unattended capture

all 18 tcpdump commands