tcpdump

Packet capture and filtering for the command line, grouped by what you're trying to do. Click any command to copy it.

Start here

The shape of a command

Almost every tcpdump run is tcpdump [options] [filter expression] — pick an interface, add options, then a BPF filter to keep only what matters. Needs root (or CAP_NET_RAW). Add -w file.pcap to save for Wireshark.

tcpdump -i anyCapture on every interface. The fastest way to see if anything's moving.
tcpdump -i eth0 -nOne interface, no name resolution. -n keeps it fast and shows real IPs, not hostnames.
tcpdump -i eth0 -nn -c 100-nn skips both host and port name lookups; -c 100 stops after 100 packets.
tcpdump -DList the interfaces available to capture on.
tcpdump -i eth0 -w capture.pcapWrite raw packets to a file for Wireshark. No screen output while writing.
tcpdump -r capture.pcapRead a saved pcap back. Filters and output options work the same on a file.

Options

Interfaces, files & limits

-i anyAll interfaces at once (Linux).
-n   -nnDon't resolve host names (-n); don't resolve host or port names (-nn).
-c <count>Stop after N packets.
-s 0Snap length — capture the whole packet. Modern tcpdump defaults to full already, but be explicit for older versions.
-w file.pcap   -r file.pcapWrite to / read from a capture file.
-w cap-%Y%m%d-%H%M%S.pcap -G 3600Rotate to a new file every 3600s, timestamped. Great for long captures.
-C 100 -W 10 -w cap.pcapRotate every 100 MB, keep 10 files (ring buffer) — bounded disk use.
-pDon't put the interface in promiscuous mode — only traffic to/from this host.
-Q in   -Q outCapture only inbound or only outbound (direction).

BPF

Filter expressions

The filter language: primitives (host, net, port) combined with and / or / not.

host 10.0.0.5Traffic to or from an IP. Add src or dst to pick a direction.
src host 10.0.0.5Only where that IP is the source. dst host for destination.
net 10.0.0.0/24A whole subnet. src net / dst net too.
port 443TCP or UDP on a port. src port / dst port to pin the side.
portrange 1-1024A range of ports.
host 10.0.0.5 and port 443Combine with and. Precedence follows the parentheses.
'host 10.0.0.5 and (port 80 or port 443)'Quote the whole expression when it has parentheses or shell-special characters.
not port 22Everything except SSH — the classic "don't capture my own session" filter.
ether host 00:11:22:33:44:55Filter by MAC address at layer 2.
vlan 100Only traffic on VLAN 100 (802.1Q tagged).
less 128   greater 1400Filter by packet length — tiny beacons or near-MTU bulk transfer.

Layers

Protocols & ports

tcp   udp   icmpFilter by protocol. arp, ip6, ip work too.
port 53DNS. Pair with udp for lookups, tcp for zone transfers / large responses.
tcp port 80 or tcp port 443Web traffic.
port 445 or port 139SMB — lateral movement and file access.
tcp port 3389RDP.
udp port 123NTP.
icmpPings and errors — and ICMP tunneling if you see oddly large payloads.
arpARP — watch for spoofing / gratuitous replies on the segment.
ip proto 47Match by IP protocol number (47 = GRE). Useful for tunneling protocols.

Reading

Output & verbosity

-v   -vv   -vvvMore detail per packet — TTL, IP options, protocol fields. Add v's for more.
-XHex and ASCII payload — read the actual bytes. -XX includes the link-layer header.
-APrint payload as ASCII — quick way to read cleartext HTTP, SMTP, creds.
-eShow the link-layer (Ethernet) header — MAC addresses, VLAN tags.
-ttttHuman-readable date + time on each line. -t removes timestamps entirely.
-SAbsolute TCP sequence numbers instead of relative — matching against other tools.
-lLine-buffered output so it flows through a pipe: tcpdump -l … | grep ….
-qQuieter, shorter lines — less protocol detail.

Advanced

TCP flags & byte offsets

Reach into the packet with proto[offset] to match specific bytes and bits.

'tcp[tcpflags] & tcp-syn != 0'Any packet with the SYN flag set — connection attempts.
'tcp[tcpflags] == tcp-syn'SYN only (no ACK) — the first packet of a handshake. Spot scans and half-open floods.
'tcp[tcpflags] & (tcp-rst|tcp-fin) != 0'Resets and FINs — connections being torn down or refused.
'tcp[13] & 2 != 0'The numeric form of the SYN check (byte 13, bit 2) — same result, portable to older builds.
'icmp[icmptype] == icmp-echo'Echo requests (ping) only. icmp-echoreply for the replies.
'ip[8] < 5'TTL under 5 — unusual, can signal traceroute or a crafted packet.
'udp[8:2] = 0x0100'Reach into the DNS header — here, a standard query. Byte-slice syntax is proto[start:len].

Put it together

SOC one-liners

Practical captures for triage and hunting. Always exclude your own SSH so you don't capture the capture.

tcpdump -i any -nn -c 200 'not port 22'A quick "what's happening" snapshot, minus your session. First move on any box.
tcpdump -i any -nn -w /tmp/full-$(hostname)-$(date +%F).pcap 'not port 22'Full capture to disk for later analysis. Name it so you know the host and day.
tcpdump -i any -nn -A 'tcp port 80'Read cleartext HTTP live — requests, hosts, and any creds in the clear.
tcpdump -i any -nn 'udp port 53' -l | grep -E 'A\?|AAAA\?'Watch DNS queries as they happen — spot tunneling and C2 domains.
tcpdump -i any -nn 'dst host 203.0.113.10'Everything going to a suspect IP — confirm and characterize a beacon or exfil.
tcpdump -i any -nn 'tcp[tcpflags] == tcp-syn' | awk '{print $3}' | sort | uniq -c | sort -rnRank SYN sources — a port scan or SYN flood floats to the top.
tcpdump -i any -nn -w exfil.pcap 'greater 1400 and dst net not 10.0.0.0/8'Large outbound packets leaving the internal range — a rough exfil filter.
tcpdump -i any -nn 'arp' -eARP with MACs — catch spoofing and gratuitous replies on the local segment.
tcpdump -r capture.pcap -nn 'host 10.0.0.5 and port 445'Re-filter a saved pcap down to one host's SMB — no need to recapture.
tcpdump -r capture.pcap -nn -A | grep -E 'GET |POST 'Pull HTTP request methods out of a saved pcap. -A prints the ASCII payload so the methods are visible, and -E makes the | mean "or" (with -F it'd match the literal text "GET|POST" and find nothing).
tcpdump -r capture.pcap -A | grep -v 'User-Agent' | grep -i 'user\|pass\|login'Sweep the cleartext payload for credential-ish strings. Drops the noisy User-Agent lines first, then case-insensitively greps for user / pass / login. Only catches unencrypted protocols (HTTP, FTP, telnet, SMTP) — TLS payloads are ciphertext.
tcpdump -r capture.pcap -nn -A 'tcp port 21' | grep -Ei 'RETR|STOR'FTP file transfers — RETR (download) and STOR (upload) on the control channel. Tells you what was pulled or pushed over cleartext FTP, a classic exfil path.

Handoff: capture with -w and hand the .pcap to Wireshark or Zeek for deep analysis — tcpdump is for grabbing and quick-filtering, not for reading a whole investigation on the terminal.