tcpdump in Linux: capturing and analyzing network traffic

Q: "Does the request even reach the server?"

On the server, sudo tcpdump -ni any port 80, then make a request from the client. Packets show up — traffic arrives (the problem is in the app/local firewall); silence — it doesn't arrive (route/firewall/wrong network/wrong interface).

Q: Too much output

Narrow it with a filter (host/port), limit with -c N, exclude your own session (not port 22), write to .pcap and analyze in Wireshark.

Overview

tcpdump captures network packets — the last resort when it's unclear whether traffic even arrives at all. Needs root.

bash

sudo tcpdump -i any -n            # all traffic, no name resolution (-n)
sudo tcpdump -i eth0 -nn port 80  # on eth0, port 80, no name/port resolution

-n skips resolving IPs, -nn also skips resolving ports; without them tcpdump slows down on DNS lookups.

Options

10

/

-n doesn't resolve IPs into names, -nn also doesn't resolve port numbers into service names — without them tcpdump noticeably slows down on DNS lookups for every new address. By default a packet is truncated to part of its headers; -s 0 captures it in full, needed to see the complete payload.

Option	What it does	Example
`-i` IFACE	Interface to capture on; any captures on every interface at once.	`sudo tcpdump -i any port 80`
`-n`	Do not resolve IP addresses to names.	`sudo tcpdump -ni any`
`-nn`	Resolve neither addresses nor port numbers to service names.	`sudo tcpdump -nni any port 80`
`-c` N	Stop after capturing N packets.	`sudo tcpdump -ni any -c 20`
`-w` FILE	Write a raw dump to a .pcap file instead of printing to the screen (for Wireshark).	`sudo tcpdump -ni any port 80 -w cap.pcap`
`-r` FILE	Read packets from a .pcap file instead of a live capture.	`sudo tcpdump -r cap.pcap 'host 10.0.0.5'`
`-A`	Show the packet payload as ASCII — useful for unencrypted HTTP.	`sudo tcpdump -ni any -A port 80`
`-s` N	Capture length in bytes; 0 captures the whole packet.	`sudo tcpdump -ni any -s 0 -w cap.pcap`
`-X`	Show the packet payload in both hex and ASCII.	`sudo tcpdump -ni any -X port 80`
`-e`	Show the link-layer header (MAC addresses).	`sudo tcpdump -ni any -e`

Nothing found. Try a shorter query.

Recipes

1

Filters

BPF syntax: host, net, port, portrange, src/dst, tcp/udp/icmp, combine with and/or/not:

bash

sudo tcpdump -ni any host 10.0.0.5            # traffic to/from a host
sudo tcpdump -ni any net 10.0.0.0/24          # to/from a subnet
sudo tcpdump -ni any port 443                 # by port
sudo tcpdump -ni any portrange 8000-8100      # a port range
sudo tcpdump -ni any src 10.0.0.5 and port 22 # a combination
sudo tcpdump -ni any 'tcp and not port 22'    # all TCP except your own ssh session
sudo tcpdump -ni any icmp                      # pings
sudo tcpdump -ni any 'tcp[tcpflags] & tcp-syn != 0'   # SYN only (connection attempts)
sudo tcpdump -ni any -c 20                     # 20 packets and stop
sudo tcpdump -ni any -A port 80               # see HTTP text (payload)
sudo tcpdump -ni any port 80 -w cap.pcap       # write to a file
sudo tcpdump -r cap.pcap 'host 10.0.0.5'       # read from a file with a filter

Useful over an SSH session to exclude your own traffic: and not port 22 — otherwise you mostly see your own packets.

Troubleshooting

5

"Does the request even reach the server?"

On the server, sudo tcpdump -ni any port 80, then make a request from the client. Packets show up — traffic arrives (the problem is in the app/local firewall); silence — it doesn't arrive (route/firewall/wrong network/wrong interface).

SYN is visible, but no SYN-ACK

Packets arrive but the server doesn't reply: the service isn't listening (ss -tlnp) or the local firewall drops it (see firewall).

SYN-ACK is visible, but the connection doesn't come up

An asymmetric route or a firewall on the return path/client side. Capture on both sides at the same time.

Too much output

Narrow it with a filter (host/port), limit with -c N, exclude your own session (not port 22), write to .pcap and analyze in Wireshark.

No permissions / no interface

tcpdump requires root (raw socket access). List interfaces with sudo tcpdump -D or ip -br a.

tcpdump — capturing and analyzing network traffic

Cheat sheet