Skip to content
Search

Tcpdump

lastmod 2025-12-08created 2017-02-2043 edits

tcpdump is a common packet sniffing software run from the command line. It helps users intercept and display not only TCP/IP but also other packets sent and received over the network attached to the computer. Distributed under the BSD license, tcpdump is free software.

tcpdump runs on most Unix-like operating systems such as Linux, Solaris, BSD, Mac OS X, HP-UX, and AIX, where it uses the libpcap library to capture packets. The Windows port of tcpdump is WinDump, which uses WinPcap, the Windows port of libpcap.

Synopsis 

$ tcpdump [ -AdDefIKlLnNOpqRStuUvxX ][ -B buffer_size ][ -c count ][ -C file_size ][ -G rotate_seconds ][ -F file ][ -i interface ][ -m module ][ -M secret ][ -r file ][ -s snaplen ][ -T type ][ -w file ][ -W filecount ][ -E spi@ipaddr algo:secret,... ][ -y datalinktype ][ -z postrotate-command ][ -Z user ]

Flags

-d
Converts the comiled packet-matching code into human-readable form, prints it to standard output, and exits.
-dd
Prints the packet-matching code as part of a C program.
-ddd
Prints the packet-matching code as numbers.
-e
Prints the link-level header on each output line.
-f
Prints foreign internet addresses as symbols where possible (avoid using this with Sun's yp server if possible).
-F file
Takes a file as input for the filter expression. Any additional expressions given on the command line are ignored.
-l
Line-buffers the data going to standard output. Useful when another program wants to receive data from tcpdump.
-n
Does not translate any addresses (port, host address, etc.)
-N
Does not print the domain when printing host names.
-O
Does not run the packet-matching code optimizer. This option is only used when looking for bugs in the optimizer.
-p
Does not put the interface into promiscuous mode.
-q
Prints less protocol information, so output lines are a bit shorter.
-r file
Reads packets from a file created with the -w option. If - is used as the file, reads from standard input.
-T type
Displays packets selected by the expression in the specified format. type can be one of the following.
  • rpc(Remote Procedure Call)
  • rtp(Real-Time Applications protocol)
  • rtcp(Real-Time Application control protocal)
  • vat(Visual Audio Tool)
  • wb(distributed White Board)
-S
Prints TCP sequence numbers as absolute rather than relative numbers.
-t
Does not print a timestamp on each output line.
-tt
Prints an unformatted timestamp on each output line.
-v
Prints more information.
-vv
Prints even more information than -v.
-x
When parsing and printing, in addition to printing the headers of each packet, prints the data of each packet (minus its link-level header) in hex. The smaller of the entire packet or the number of bytes is printed. Since this is the entire link-layer packet, for link layers that pad (e.g. Ethernet), the padding bytes are also printed when the higher-layer packet is shorter than the required padding.
-xx
When parsing and printing, in addition to printing the headers of each packet, prints the data of each packet, including its link-level header, in hex.
-X
When parsing and printing, in addition to printing the headers of each packet, prints the data of each packet (minus its link-level header) in hex and ASCII. This is very handy for analyzing new protocols.
-XX
When parsing and printing, in addition to printing the headers of each packet, prints the data of each packet, including its link-level header, in hex and ASCII.

Packet flags

S(SYN)
SYN packet, the packet sent when requesting a connection. It is the first packet sent when making a TCP connection.
ack(ACK)
ACK packet, the packet sent to acknowledge receipt of a packet from the other side. It is sometimes printed together with other flags.
F(FIN)
A flag for ending a connection, used when the sender wants to close the connection with the side it is currently connected to.
R(RESET)
Used when the sender wants to immediately cut the connection with the side it is currently connected to.
P(PUSH)
Means send the data to the destination immediately. For programs where interaction is important, such as telnet, fast response matters. This flag is used in such cases.
URG(UGENT)
Urgent data must have higher priority than other data. For example, like when receiving [CTRL]+[C] while downloading data over ftp must stop the download immediately, this flag is used in such cases.
.(Placeholder)
This flag is set when the packet has none of the SYN, FINISH, RESET, PUSH, etc. flags. This flag is sometimes used together with the ACK flag.

Example

tcpdump -i eth0
Shows interface eth0
tcpdump -w tcpdump.log
Saves the result to a file, in bin format rather than txt
tcpdump -r tcpdump.log
Reads the saved file
tcpdump -i eth0 -c 10
Shows only 10 counts
tcpdump -i eth0 tcp port 80
Shows packets communicating over tcp port 80
tcpdump -i eth0 tcp port 80
Shows packets communicating over tcp port 80
tcpdump -i eth0 src 192.168.0.1
Shows packets whose source ip is this
tcpdump -i eth0 dst 192.168.0.1
Shows packets whose dest ip is this
tcpdump -i eth0 src 192.168.0.1 and tcp port 80
Shows packets whose source ip is this and that are on tcp port 80
Various conditions can be combined with the and option
tcpdump -i eth0 dst 192.168.0.1
Shows packets whose dest ip is this
tcpdump host 192.168.0.1
When host is specified, shows packets in both directions, coming into or going out of this ip
tcpdump src 192.168.0.1
Of host, specifies only those whose src is this
tcpdump dst 192.168.0.1
Of host, specifies only those whose dst is this
tcpdump net 192.168.0.1/24
Can be specified in CIDR format.
tcpdump tcp
TCP only
tcpdump udp
UDP only
tcpdump -nn icmp
Prints all ICMP (ping) packets coming into the server; with the -nn option, they are shown as IP addresses (raw).
tcpdump port 3389
Port is this, in both directions.
tcpdump src port 3389
src port is this.
tcpdump dst port 3389
dst port is this.
tcpdump udp and src port 53
UDP and src port is 53
Various conditions can be combined with and, or, not
tcpdump src x.x.x.x and not dst port 22
src ip is x.x.x.x and dst port is not 22
tcpdump 'src x.x.x.x and ( dst port 3389 or 22 )'
src ip is x.x.x.x and (dst port is 3389 or 22)
Grouping using ( and )
tcpdump -i eth1 -w 0906.pcap -C 16 -s 1500 -n -Z root
How to capture packets split into Wireshark (PCAP) files using TCPDump on Linux.
Captures on the eth1 interface, saves to the 0906.pcap file, and splits it into 16M files. Captures only packets of 1500 bytes or less, and the account is root.
tcpdump -i eth1
Capture packets on a specific Ethernet interface using tcpdump -i
tcpdump -c 2 -i eth0
Capture only N packets using tcpdump -c
tcpdump -A -i eth0
Display captured packets in ASCII using tcpdump -A
tcpdump -XX -i eth0
Display captured packets in HEX and ASCII using tcpdump -XX
tcpdump -w 08232010.pcap -i eth0
Capture packets and write them to a file using tcpdump -w
tcpdump -tttt -r data.pcap
Read packets from a saved file using tcpdump -r
tcpdump -n -i eth0
Capture packets with IP addresses using tcpdump -n
tcpdump -n -tttt -i eth0
Capture packets with proper readable timestamps using tcpdump -tttt
tcpdump -w g_1024.pcap greater 1024
Read packets longer than N bytes
tcpdump -i eth0 arp
Receive only packets of a specific protocol type
tcpdump -w l_1024.pcap less 1024
Read packets smaller than N bytes
tcpdump -i eth0 port 22
Receive packet flow on a specific port using tcpdump port
tcpdump -w xpackets.pcap -i eth0 dst 10.181.140.216 and port 22
Capture packets for a specific destination IP and port
tcpdump -w comm.pcap -i eth0 dst 16.181.170.246 and port 22
Capture TCP communication packets between two hosts
tcpdump -i eth0 not arp and not rarp
Packet filtering - capture all packets other than arp and rarp

HTTP server example

  • When the server PC is 192.168.0.100 (using port 8080)
  • and the client PC is 192.168.0.2

To capture packets coming into the server 

sudo tcpdump -XX -i eth0 dst 192.168.0.100 and tcp port 8080
## 또는 (src 경로가 여러 이름일 수 있다. 따라서 src 조건을 제거한다.)
sudo tcpdump -XX -i eth0 tcp port 8080

To capture packets going out from the client to the server 

sudo tcpdump -XX -i eth0 dst 192.168.0.100 and tcp port 8080
## 또는 (src 경로가 여러 이름일 수 있다. 따라서 src 조건을 제거한다.)
sudo tcpdump -XX -i eth0 tcp port 8080

For reference, when testing on the local PC such as 127.0.0.1, you may need to use the Loopback Interface (lo).

Analyzing server packets

Save the server's packets to a pcap file: 

sudo -s
cd ~
tcpdump -i eno4 -w eno4.pcap tcp

When done, stop with Ctrl+C, then drag and drop the saved eno4.pcap file into Wireshark.

Setting the split interval for saved files and putting the date in file names 

tcpdump -i eno4 -w "eno4_%Y-%m-%d_%H-%M.pcap" -G 3600 tcp
  • -i eno4 - Captures packets on the eno4 network interface.
  • -w "eno4_%Y-%m-%d_%H-%M.pcap" - Saves captured packets to a file, with the date and time in the file name.
    • %Y - year (e.g. 2024)
    • %m - month (e.g. 11)
    • %d - day (e.g. 21)
    • %H - hour (e.g. 14)
    • %M - minute (e.g. 30)
  • -G 3600 - Splits into a new file every 3600 seconds (1 hour).
  • tcp - Captures only TCP packets.

Trimming packets

Probably need to use editcap or tshark

Simulating saved packets

  • tcpreplay - A tool that retransmits traffic saved in PCAP files onto the network.
  • NS-3 - An open-source platform supporting network simulation.
  • Mininet - Replays PCAP data by setting up a virtualized network topology. Useful for testing OpenFlow switches and controllers.
  • scapy - Scapy is a Python program that can send, sniff, or forge network packets.

Penetration testing

Simulate attack traffic to check how firewalls and IDS/IPS respond.

Performance testing

Evaluate the processing capacity of network equipment or applications.

Troubleshotting

No tcp header 

$ tcpdump -i lo -l -w - port 23 | tcpflow -C -r -

or 

$ tcpflow -c port 6667

Couldn't change ownership of savefile 

$ sudo tcpdump -i eno4 -w eno4.pcap tcp
tcpdump: Couldn't change ownership of savefile

In short, you must write the file to a directory in a location with the same user Ownership. 

sudo -s
cd ~
tcpdump -i eno4 -w eno4.pcap tcp

Permission denied

If you run it as follows 

tcpdump -i eno4 -w "eno4_%Y%m%d_%H%M.pcap" -G 3600 tcp

the first file is saved fine, but a permission error occurs from the second file onward. 

tcpdump: listening on eno4, link-type EN10MB (Ethernet), capture size 262144 bytes
tcpdump: eno4_20241121_1227.pcap: Permission denied

Create a new directory owned by the tcpdump user/group and run it from that directory. 

mkdir tcpdump
chown tcpdump:tcpdump tcpdump
cd tcpdump
tcpdump -i eno4 -w "eno4_%Y%m%d_%H%M.pcap" -G 3600 tcp

Note that if the save path of the pcap file is an absolute path, the "tcpdump" user/group check seems to apply to the entire path. 

tcpdump -i eno4 -w /root/tcpdump/eno4_%Y%m%d_%H%M.pcap -G 3600 tcp

So rather than entering an absolute path as above, it is recommended to just write to the current directory where you have permission: 

tcpdump -i eno4 -w eno4_%Y%m%d_%H%M.pcap -G 3600 tcp

See also

Favorite site

author Zer0 sitemap