tcpdump

Capture & filter packets from the CLI — hosts, ports, flags & pcaps

tcpdump Cheat Sheet

tcpdump is a command-line packet capture tool built on libpcap; it sniffs traffic and filters it with BPF (Berkeley Packet Filter) expressions. For authorized testing only.

1. Basic usage

tcpdump                         # capture on the default interface
tcpdump -D                      # list available interfaces
tcpdump -i eth0                 # capture on a specific interface
tcpdump -i any                  # all interfaces
tcpdump -c 100                  # stop after 100 packets
sudo tcpdump -i eth0 -c 20      # typically needs root

2. Output / verbosity flags

Flag Effect
-n Don't resolve hostnames (faster)
-nn Don't resolve hosts or port names
-v -vv -vvv Increasing verbosity
-X Hex + ASCII payload dump
-XX Same, including link-layer header
-A Print payload as ASCII (great for HTTP)
-e Show link-layer (MAC) header
-t No timestamp · -tttt human-readable timestamp
-S Absolute TCP sequence numbers
-s 0 Full packet (snaplen 0 = unlimited; default is already full on modern builds)
-q Quiet / less protocol info
-l Line-buffer output (for piping to grep)

3. Write & read capture files

tcpdump -i eth0 -w capture.pcap          # write raw packets to file
tcpdump -i eth0 -w capture.pcap -c 1000  # cap size by packet count
tcpdump -r capture.pcap                  # read back
tcpdump -r capture.pcap -nn 'tcp port 80'  # filter while reading

# Rotate files: 50 MB each, keep 10
tcpdump -i eth0 -w cap-%Y%m%d-%H%M%S.pcap -C 50 -W 10
# Rotate every 3600s
tcpdump -i eth0 -w cap.pcap -G 3600

4. Host / network filters

tcpdump host 10.0.0.5
tcpdump src host 10.0.0.5
tcpdump dst host 10.0.0.5
tcpdump net 192.168.1.0/24
tcpdump src net 10.0.0.0/8
tcpdump ether host 00:11:22:33:44:55     # by MAC
tcpdump gateway 10.0.0.1

5. Port & protocol filters

tcpdump port 80
tcpdump src port 443
tcpdump dst port 22
tcpdump portrange 8000-8100
tcpdump tcp
tcpdump udp
tcpdump icmp
tcpdump arp
tcpdump 'tcp port 80 or tcp port 443'
tcpdump 'udp port 53'                     # DNS

6. Combining with and / or / not

tcpdump 'host 10.0.0.5 and port 443'
tcpdump 'src 10.0.0.5 and not port 22'    # ignore your own SSH session
tcpdump 'tcp and (port 80 or port 8080)'
tcpdump 'dst net 10.0.0.0/24 and icmp'

Operators: and (&&), or (||), not (!). Parenthesize compound filters (quote them so the shell doesn't expand).

7. TCP flag filters

# SYN only — connection attempts / scans
tcpdump 'tcp[tcpflags] == tcp-syn'

# SYN or SYN-ACK — start of handshakes
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'

# RST packets
tcpdump 'tcp[tcpflags] & tcp-rst != 0'

# FIN packets
tcpdump 'tcp[tcpflags] & tcp-fin != 0'

# PSH+ACK (data segments)
tcpdump 'tcp[tcpflags] & (tcp-push|tcp-ack) == (tcp-push|tcp-ack)'

Named flags: tcp-syn tcp-ack tcp-fin tcp-rst tcp-push tcp-urg.

8. Byte-offset (advanced) filters

# HTTP GET requests (G,E,T = 0x47,0x45,0x54 at TCP payload start)
tcpdump -A -s 0 'tcp port 80 and tcp[((tcp[12]&0xf0)>>2):4] = 0x47455420'

# ICMP echo request only (type 8)
tcpdump 'icmp[icmptype] == icmp-echo'

# Packets larger than 1000 bytes
tcpdump 'greater 1000'

9. Real-world one-liners

# Watch HTTP traffic in cleartext
sudo tcpdump -i any -A -s 0 'tcp port 80'

# Pull DNS queries with timestamps
sudo tcpdump -i eth0 -nn -tttt 'udp port 53'

# Catch cleartext creds (POST / FTP / auth)
sudo tcpdump -i any -A -s 0 'tcp port 80 or tcp port 21' | grep -iE 'pass|user|login'

# Capture to file for Wireshark, no name resolution, quietly
sudo tcpdump -i eth0 -nn -w evidence.pcap

# See who's talking to a host, MACs included
sudo tcpdump -i eth0 -e -nn host 10.0.0.5

# Detect a SYN flood / scan
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] == tcp-syn'

10. Tips

Authorized testing only. Practice on the AYSEC challenges. Open your captures with Wireshark display filters and correlate with nmap scans.