In this blog post, I assume that tcpdump is already installed since the installation method can vary from system to system, and basic Linux and CLI skills already exist. I'll try to keep it as short as possible while providing all the necessary information.

General

tcpdump is a CLI tool to capture network traffic to help you troubleshoot specific issues. I'll use a Linux system as a reference system.

To start a packet capture, simply type sudo tcpdump in your terminal. This will show you all packets from and to all interfaces, but it won't be saved anywhere. You can end the capture by pressing CTRL + C.

You can get more help with the -h / --help or get the current version of tcpdump with --version.

The following sections show you how to filter the traffic and save your packet captures to disk. For more advanced filters, you can use logical operators to combine filters.

Limit the hosts or networks

There are many ways to filter the packets you want to capture, and we are going to start with the host and network filters. Here are some examples:

Get all traffic for one specific IP address in both directions:

sudo tcpdump host 10.10.20.1

Results for a simple ping:

kuser@pleasejustwork:~/9_temp/tcpdump$ sudo tcpdump host 10.10.20.1
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlp9s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
17:51:24.396399 IP pleasejustwork > _gateway: ICMP echo request, id 15, seq 4, length 64
17:51:24.402897 IP _gateway > pleasejustwork: ICMP echo reply, id 15, seq 4, length 64
17:51:25.398088 IP pleasejustwork > _gateway: ICMP echo request, id 15, seq 5, length 64
17:51:25.404880 IP _gateway > pleasejustwork: ICMP echo reply, id 15, seq 5, length 64
17:51:26.400067 IP pleasejustwork > _gateway: ICMP echo request, id 15, seq 6, length 64
17:51:26.404658 IP _gateway > pleasejustwork: ICMP echo reply, id 15, seq 6, length 64
17:51:27.401819 IP pleasejustwork > _gateway: ICMP echo request, id 15, seq 7, length 64
17:51:27.408093 IP _gateway > pleasejustwork: ICMP echo reply, id 15, seq 7, length 64
^C
8 packets captured
8 packets received by filter
0 packets dropped by kernel

Side note: In this example, I've pinked my gateway. If you don't want to resolve hostnames, simply use the -n flag.

You can specify whether the IP should be the source or destination instead of bi-directional traffic with src or dst:

sudo tcpdump src 10.10.10.10

sudo tcpdump dst 10.10.10.10

Use logical operators to filter for more than one host.

Network filter #

If you want to traffic for a specific network, you can use the net option together with the network address and CIDR notation.

Bi-directional packet capture of a specific network:

sudo tcpdump net 10.10.10.0/24

You could combine this option with src or dst to see only the incoming or outgoing traffic:

sudo tcpdump src net 10.10.10.0/24

sudo tcpdump dst net 10.10.10.0/24

MAC address filter #

If you need to filter captures for a specific MAC address, you simply could use the previous filters with ether.

Packet capture filter by a specific MAC address:

sudo tcpdump ether host aa:aa:aa:bb:bb:bb # bi-directional

sudo tcpdump ether src aa:aa:aa:bb:bb:bb # source

sudo tcpdump ether dst aa:aa:aa:bb:bb:bb # destination

tcpdump supports the most common formats and maybe even more:

aaaaaabbbbbb

aa-aa-aa-bb-bb-bb

aa:aa:aa:bb:bb:bb

aaaa.aabb.bbbb

Directional traffic filter #

I've never used this option, but you can use a filter for incoming or outgoing traffic without any hosts with the -Q / --direction options:

sudo tcpdump -Q in / sudo tcpdump --direction=in # all incoming traffic

sudo tcpdump -Q out / sudo tcpdump --direction=out # all outgoing traffic

Port filters

Packet capture filter for a specific port:

sudo tcpdump port 53 # source or destination port

sudo tcpdump src port 53 # source port

sudo tcpdump dst port 53 # destination port

Use logical operators to filter for more than one host:

sudo tcpdump port 80 or port 443

Use portrange instead if you want to filter a range of ports:

sudo tcpdump portrange 53 # source or destination port

src and dst can be used too!

Protocol filters

The most common protocol filters are:

tcp

udp

icmp

ip

ip6

arp

Using a specific interface

Choosing the proper interface is one of my most used options to keep the pcap file as small as possible. Most servers have multiple NICs, and many troubleshooting sessions require me to be connected to multiple networks. Choosing a single interface keeps things sorted.

Since most servers have multiple network interfaces and my troubleshooting sessions with my laptop usually required me to select a specific interface, this might be one of the most used filters for me.

You can list the available interfaces with the -D / --list-interfaces options.

Example of tcpdump -D:

kuser@pleasejustwork:~/9_temp/tcpdump$ tcpdump -D
1.eth0 [Up, Running, Connected]
2.wg-mullvad [Up, Running]
3.any (Pseudo-device that captures on all interfaces) [Up, Running]
4.lo [Up, Running, Loopback]
[...]

To choose an interface, you could use the name of the interface or the number in front of it in the list.

---

To choose an interface for your packet capture, simply use -i / --interface like this:

sudo tcpdump -i 1 or

sudo tcpdump --interface=eth0

You could use any as an interface for all interfaces, which is the current default anyway.

Miscellaneous options

These are just some filters that are important to know.

Tell tcpdump not to resolve hostnames:

-n

Tell tcpdump not to resolve host or port names:

-nn

Limit the number of packets captured and stop the capture if the limit is reached:

-c NUMBER

Print absolute TCP sequence numbers:

-S / --absolute-tcp-sequence-numbers

Import filter expression from file:

-F FILENAME

sudo tcpdump -i 2 -F filterfile # example

kuser@pleasejustwork:~/9_temp/tcpdump$ cat filterfile 
net 10.10.20.0/24 and port 53

Important: Some options - like the choice of the interface - can not be put into this file, and the tcpdump user must be an owner or in the owner group of the file with the filters to get it working. Additional filters provided in the CLI will be ignored!

Logical operators

As mentioned before, filters can be combined, and logical operators can be used for more advanced filter combinations.

Here is the list of logical operators:

and / &&

or / ||

not / !

<

>

A more complex tcpdump with more options could look like this:

sudo tcpdump -n -i 2 "host 10.10.21.1 and (port 80 or port 443)"

Side note: You need to place the filters in quotes if you want to use parentheses.

Display options

You've got various options to adjust the display of the captured packets in the terminal. This won't affect the raw packet capture that you would write to disk.

Increase the verbosity of the output:

-v / -vv / -vvv

Decrease the verbosity of the output:

-q

Print the packet number at the beginning of the line:

-# / --number

Various options for timestamps at the beginning of the line:

Default is 20:03:46.735488

-t # no timestamp

-tt # as seconds since Jan 1, 1970, 00:00:00, UTC > 1686506678.821116

-ttt # print the delta to the previous packet in microseconds per default > 00:00:00.006491

-tttt # human readable with date and time > 2023-06-11 20:11:56.431621

-ttttt # delta between current and the first packet of this capture in microseconds per default > 00:00:04.013707

Saving capture to a file on disk

Before we start, tcpdump overwrites files and does not append existing files. There is no option to change that, to my knowledge.

Use the -w flag to write the raw packets to disk:

-w traffic.pcap # saves file to the current directory

-w - # sends output to stdout

Side note: The file will contain the raw binary packet data and won't be human-readable. To change that, you can import the data with the -r option that I will explain later in this post.

The default owner and group of the file will be tcpdump but can be changed with the -Z USERNAME option. This drops the ownership, and the provided user will be the new owner of this file.

When you write the raw information to a file, tcpdump won't show any packets in the terminal. This can be changed with the --print option. That said, in the older version, --print is not available, and the same can be achieved with the following oneliner.

--print replacement for older versions:

sudo tcpdump -w - -U | tee traffic.pcap | tcpdump -r -

-w - # sends binary data to stdout

-U # no buffering between packets

tee traffic.pcap # write binary data to file and its own stdout

-r - # reads binary data from stdin and presents it in a human-readable form

Source - Thanks to cnicutar on stackoverflow

Working with big files / long packet captures #

Sometimes it is necessary to capture a lot of packets. There are some options on how to handle large pcap files.

Set the maximum size of the pcap file and creates a new pcap file if the limit is reached:

-C NUMBER # default unit is 1.000.000 bytes or 1 MB. According to the docs, it can be changed to kilo- and gigabyte by adding k/K and g/G, respectively, after the number, but it did not work in my tests.

tcpdump will just add a number behind the filename and count up.

Side note: If you encounter the Permission denied error, make sure that the user tcpdump is the owner or part of the owner group of the directory or use the -Z USERNAME option to choose another user for the file!

Example:

kuser@pleasejustwork:~/9_temp/tcpdump$ sudo tcpdump -n -w traffic.pcap -C 1 -Z kuser
tcpdump: listening on wlp9s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C3040 packets captured
3040 packets received by filter
0 packets dropped by kernel

kuser@pleasejustwork:~/9_temp/tcpdump$ ls -l
total 3096
-rw-r--r-- 1 kuser kuser 1000460 Jun 11 21:18 traffic.pcap
-rw-r--r-- 1 kuser kuser 1000708 Jun 11 21:18 traffic.pcap1
-rw-r--r-- 1 kuser kuser 1000574 Jun 11 21:18 traffic.pcap2
-rw-r--r-- 1 kuser kuser  157610 Jun 11 21:18 traffic.pcap3

If you want to limit the number of files, you can create a rotating buffer with -W NUMBER. If the chosen number of files is reached, tcpdump starts to overwrite the first file again. It must be combined with the -C option.

Reading PCAPs

As mentioned before, tcpdump saves everything raw in binary in a file that is not human readable. You can read this file again, make it human readable again, and apply new filters again.

Use the -r flag to read the pcap file:

-r traffic.pcap # saves file to the current directory

-r - # sends output to stdin

Almost all filters that are mentioned in this post can be applied to already existing pcap files.

---

I'll keep this blog post up to date. Feedback and tips are welcome.

---