tcpdump
18 commands
18 shown
Capture on interface
Capture all traffic on eth0 without DNS resolution
tcpdump -i eth0 -n
Capture to file
Save raw packets to PCAP file for Wireshark analysis
tcpdump -i eth0 -w /tmp/capture.pcap
Read PCAP file
Replay and display packets from a saved PCAP file
tcpdump -r /tmp/capture.pcap -n | head -50
Filter by host
Capture only traffic to/from a specific IP
tcpdump -i any host 10.0.0.5 -n
Filter by port
Capture HTTPS traffic only
tcpdump -i eth0 port 443 -n
Capture DNS queries
Monitor all DNS lookups on any interface
tcpdump -i any -n port 53
Show HTTP GET requests
Capture and print HTTP GET request lines
tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /'
Capture between two hosts
BPF filter: traffic between exactly two endpoints
tcpdump -i eth0 'host 10.0.0.1 and host 10.0.0.2'
Verbose with packet content
Full verbose output with ASCII packet content for PostgreSQL
tcpdump -i eth0 -vvv -A -s 0 port 5432
Limit capture count
Stop after capturing 100 packets
tcpdump -i eth0 -c 100 -w capture.pcap
Capture only TCP SYN packets
Catch only connection-initiating SYNs (no SYN-ACK) to spot scans or backlog floods
tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'
Capture SYN and FIN flags
Show only connection open/close packets to trace short-lived churning sessions
tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'
Host filter excluding SSH noise
Watch traffic to/from a host while dropping your own SSH session noise
tcpdump -nn -i any host <ip> and not port 22
Full payload hex+ascii dump
Inspect full packet bodies in hex+ascii; -s 0 ensures no snaplen truncation
tcpdump -nn -s 0 -X -i any port <port>
Ring buffer capture by size
Rotate across 5 files of 100MB each so long captures never fill the disk
tcpdump -nn -i any -s 0 -C 100 -W 5 -w /tmp/cap.pcap
Time-rotated capture files
Start a fresh pcap every hour with a timestamped name for unattended capture
tcpdump -nn -i any -G 3600 -w '/tmp/cap-%Y%m%d-%H%M%S.pcap'
Filter an existing pcap offline
Re-filter a saved capture without re-running it; BPF applies on read
tcpdump -nn -r /tmp/cap.pcap 'port 443 and host <ip>'
DNS query capture with link header
Show DNS lookups with MAC addresses (-e) to map queries to clients on the LAN
tcpdump -nn -e -i any port 53
no commands match