arsenal/tcpdump

tcpdump

CLI packet capture · BSD-3-Clause

The console packet sniffer: capture and filter traffic on any interface, the natural companion to wireshark on a headless box.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Install

tcpdump lives in every distribution's base repositories and is often already installed.

$ sudo emerge net-analyzer/tcpdump # Gentoo

$ sudo apt install tcpdump # Debian / Ubuntu / Kali

$ sudo dnf install tcpdump # Fedora / RHEL

02The sniffer that is already there

tcpdump is the command-line packet capture that ships on nearly every Unix system. When you are on a server over SSH with no GUI, tcpdump is how you see the traffic. It uses the same BPF filter language as wireshark's capture filters, and it writes the same pcap files, so the usual workflow is: capture on the remote box with tcpdump, copy the file back, open it in wireshark to analyse.

↑ contents

03A first capture

Point it at an interface with -i and it prints a line per packet. -n stops it turning IPs into names (faster and clearer), and it needs root for raw capture. Ctrl-C to stop; it prints how many it saw.

$ sudo tcpdump -i eth0 -n

04BPF filters

The filter expression is what makes tcpdump usable; without it you drown. The language is compact: name hosts, ports, protocols, and directions, and combine them with and, or, not. These are the same expressions wireshark calls capture filters.

$ sudo tcpdump -i eth0 -n host 10.0.0.12

$ sudo tcpdump -i eth0 -n port 53

$ sudo tcpdump -i eth0 -n 'tcp port 443 and host 10.0.0.12'

$ sudo tcpdump -i eth0 -n 'tcp[tcpflags] & tcp-syn != 0'

05Write a file, analyse in wireshark

The most useful habit: do not try to read everything in the terminal. Write a pcap with -w, filtered tightly so it stays small, then move it to a machine with wireshark. -s0 (default in modern versions) captures full packets, not just headers.

$ sudo tcpdump -i eth0 -n 'host 10.0.0.12 and port 443' -w session.pcap

$ scp server:session.pcap .

$ wireshark session.pcap

» tcpdump to capture where the traffic is, wireshark to analyse where your screen is. That division is the whole point of knowing both.

06Reading a capture back

tcpdump also reads pcap files, which is handy for a quick look on the same headless box without copying anything, and for applying a new filter to an existing capture.

$ sudo tcpdump -n -r session.pcap 'port 443'

↑ contents

07Quick answers on a live server

On a server that is misbehaving, tcpdump answers questions in seconds: is anything hitting this port, who is this box talking to, is that connection actually happening or being dropped upstream. A tight filter and a few seconds of capture usually settles it. For anything deeper, write the file and open it in wireshark.

» Confirm a service is reachable: capture on its port and watch for inbound SYNs.

» Find unexpected outbound connections: capture with a filter that excludes your known traffic and see what is left.

» Prove a firewall rule: capture on both sides and see where the packets stop.

Keep it to your own servers and networks. A standard, ubiquitous tool is still bound by the same authorization rules.

↑ contents