Capture to file

Save raw packets to PCAP file for Wireshark analysis

tcpdump -i eth0 -w /tmp/capture.pcap
tool
tcpdump18 commands
tags
tcpdumpnetworklinux

More tcpdump commands

  • Read PCAP file
    tcpdump -r /tmp/capture.pcap -n | head -50

    Replay and display packets from a saved PCAP file

  • Filter by host
    tcpdump -i any host 10.0.0.5 -n

    Capture only traffic to/from a specific IP

  • Filter by port
    tcpdump -i eth0 port 443 -n

    Capture HTTPS traffic only

  • Capture DNS queries
    tcpdump -i any -n port 53

    Monitor all DNS lookups on any interface

  • Show HTTP GET requests
    tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /'

    Capture and print HTTP GET request lines

all 18 tcpdump commands