tcpdump — capturing and analyzing network traffic

cheat sheet · tcpdump https://lab.dimsanych.ru/en/wiki/tcpdump/

Cheat sheet

sudo tcpdump -ni any port 80 port 80, no resolving
sudo tcpdump -ni any host IP by host
sudo tcpdump -ni any 'tcp and not port 22' TCP without your own ssh
sudo tcpdump -ni any -c 20 20 packets and stop
sudo tcpdump -ni any -A port 80 payload (HTTP text)
sudo tcpdump -ni any port 80 -w cap.pcap to a file → Wireshark

Options

-n doesn't resolve IPs into names, -nn also doesn't resolve port numbers into service names — without them tcpdump noticeably slows down on DNS lookups for every new address. By default a packet is truncated to part of its headers; -s 0 captures it in full, needed to see the complete payload.