VMware ESXi and vSphere Cluster Management

Intercept and Log Network Packets in Linux with tcpdump

Learn to capture, filter, inspect, rotate, save, and document Linux network traffic with tcpdump for troubleshooting and authorized forensic work.

tcpdump is a command-line utility for capturing and displaying network packets on Linux. It is useful for diagnosing connectivity, validating protocols, investigating suspicious activity, and preserving traffic for authorized analysis. This lesson covers interface selection, Berkeley Packet Filter expressions, capture files, performance, rotation, troubleshooting, and evidence handling.

What Packet Capture Does

A packet capture collects network packets observed by an authorized interface. The interface may be a physical Ethernet adapter, wireless adapter, loopback device, bridge, tunnel, virtual-machine adapter, or container-related device. Capture does not automatically reveal every packet on a network: the interface must receive or be placed on an approved path for the traffic.

Legitimate uses include checking whether a host sends traffic, verifying a TCP handshake, diagnosing DNS or ICMP failures, confirming which protocol a service uses, investigating suspicious communications, and preserving evidence during an authorized investigation.

tcpdump, libpcap, and Capture Files

tcpdump uses libpcap, a common packet-capture library that provides access to the operating system's packet-capture interface. tcpdump can print a readable summary of packets to the terminal or write binary packet data to a capture file.

  • Live display: Human-readable summaries appear while traffic is captured.
  • Text log: Terminal output can be redirected, but it contains summaries rather than complete packet data.
  • pcap file: Binary packet data can be reopened with tcpdump, Wireshark, or another compatible analyzer. A pcap file is not the same thing as a text log.

Prerequisites and Environment Preparation

You should know basic shell commands, sudo usage, Linux permissions, interfaces and IP addressing, TCP/IP, ports, DNS, and ICMP.

Check or install tcpdump

tcpdump --version
command -v tcpdump

If it is absent, use the package command appropriate for the distribution:

sudo apt update && sudo apt install tcpdump
sudo dnf install tcpdump
sudo yum install tcpdump
sudo zypper install tcpdump
sudo pacman -S tcpdump

Only run the command that matches your distribution. Package availability and privilege policy vary.

Privileges

Opening a capture device commonly requires root access or specific Linux capabilities. Use approved sudo access where necessary. Some installations grant a capture capability to tcpdump or an approved group instead, but broad packet-capture privileges should not be given to untrusted accounts. Confirm the local security policy before changing capabilities.

Find the Correct Interface

sudo tcpdump -D
ip -br link
ip addr
ip -s link

Do not assume the interface is eth0. Common names include eth0, ens33, enp0s3, wlan0, lo, docker0, bridge devices, tunnel devices, and namespace-specific virtual interfaces.

  • lo carries local loopback traffic, such as communication between processes on the same host.
  • Container traffic may appear on a container interface, a bridge such as docker0, a veth device, or the host's external interface, depending on the path.
  • Virtual machines may use a host adapter, bridge, NAT device, or a guest interface.
  • -i any captures from all available interfaces on systems that support it. This is useful for a broad diagnostic, but it can produce high-volume or confusing output and may show duplicate-looking traffic from multiple paths.

Select an Interface and Start a Capture

sudo tcpdump -i eth0 -nn

Replace eth0 with the actual interface. The -i option selects the interface, while -nn disables both hostname resolution and service-name resolution. A broad alternative is:

sudo tcpdump -i any -nn

Use an all-interface capture deliberately. Start with the interface that is known to carry the traffic whenever possible.

Read Basic tcpdump Output

12:00:01.234567 IP 192.0.2.25.51544 > 198.51.100.10.443: Flags [S], seq 12345, win 64240, length 0
  • Timestamp: The packet's capture time, normally based on the system clock and its configured timezone.
  • Protocol indicator: IP, IP6, ARP, and other labels identify the network-layer or link-layer traffic.
  • Source and destination: The originating and receiving addresses. For TCP and UDP, a following number is usually the port.
  • TCP flags: S means SYN, . commonly represents ACK, F means FIN, and R means RST. Flags help identify connection setup, normal closure, and resets.
  • Sequence and acknowledgment details: These help analyze ordering, retransmission, and handshake behavior.
  • Length: The amount of packet data represented by the summary.
  • DNS-related output: DNS queries and responses may show names, record types, and transaction details when the traffic is visible. Encrypted DNS or a non-DNS name-resolution mechanism changes what can be observed.

Without numeric options, tcpdump may perform reverse DNS and service-name lookups. These lookups can delay output and create additional resolution traffic. Use -n to suppress hostname lookups and -nn to suppress both hostname and service-name lookups. Use verbosity carefully: -v, -vv, and -vvv add progressively more protocol detail and may increase terminal and CPU overhead.

BPF Capture Filters

A BPF filter is a Berkeley Packet Filter expression that restricts the packets tcpdump collects or displays. Filtering at collection time reduces unwanted traffic, processing, and storage. Quote compound expressions so the shell does not interpret parentheses or other syntax.

Common patterns

host — traffic to or from a host — host 192.0.2.25

src host — traffic originating at a host — src host 192.0.2.25

dst host — traffic destined for a host — dst host 192.0.2.25

net — traffic involving a network — net 192.0.2.0/24

src net / dst net — traffic from or to a network — src net 192.0.2.0/24

port — source or destination port — port 443

src port / dst port — one direction of port traffic — dst port 443

tcp, udp, icmp, arp — protocol traffic — icmp

and, or, not — combine or exclude conditions — tcp and port 22

Parentheses — control compound logic — 'tcp and (port 80 or port 443)'

Practical filters

sudo tcpdump -i eth0 -nn host 192.0.2.25
sudo tcpdump -i eth0 -nn src host 192.0.2.25
sudo tcpdump -i eth0 -nn dst port 443
sudo tcpdump -i eth0 -nn 'tcp and (port 80 or port 443)'
sudo tcpdump -i eth0 -nn 'not port 22'

Protocol-specific examples include:

sudo tcpdump -i eth0 -nn udp port 53
sudo tcpdump -i eth0 -nn 'udp port 53 or tcp port 53'
sudo tcpdump -i eth0 -nn icmp
sudo tcpdump -i eth0 -nn arp
sudo tcpdump -i eth0 -nn 'tcp port 80 or tcp port 443'

The DNS filter should include both UDP and TCP when you need broad coverage. HTTP and HTTPS port filters identify traffic using those conventional ports; they do not prove the application protocol, and capturing port 443 does not decrypt TLS payloads.

A capture filter is applied while packets are collected. A review filter in Wireshark or another analysis tool is applied while examining an existing file. Reading a saved file with a tcpdump expression selects packets for display; it does not rewrite or retroactively remove packets from the original file.

Save Packet Data and Text Logs

sudo tcpdump -i eth0 -nn -s 0 -w incident-eth0-2026-08-18T1200Z.pcap

-w writes binary capture data for later analysis. -s 0 requests the full available packet, subject to the operating system and capture environment. Full packets need more storage and may contain more sensitive content.

A readable text log can be useful for a quick operational record:

sudo tcpdump -i eth0 -nn 'host 192.0.2.25' > capture-summary.txt

Text output is not a substitute for a pcap when packet-level forensic analysis may be needed. It omits information that may be present in the binary capture, and formatting depends on tcpdump options and version.

Use names that identify the system, interface, date, time, timezone, and incident or case identifier, for example server-a-eth0-2026-08-18T1200Z-case042.pcap. Use UTC or clearly document the timezone.

Bound Duration, Packet Count, and File Size

Stop a foreground capture with an interrupt signal, normally Ctrl-C. tcpdump then prints capture statistics, including packets received by the filter and packets dropped by the kernel when supported by the platform.

sudo tcpdump -i eth0 -nn -c 100 'tcp port 22'
sudo tcpdump -i eth0 -nn -c 500 -w sample.pcap
sudo tcpdump -i eth0 -nn -C 100 -W 10 -w capture.pcap
sudo tcpdump -i eth0 -nn -G 300 -W 12 -w capture-%Y%m%d%H%M%S.pcap
  • -c stops after a packet count.
  • -C rotates when a file reaches an approximate size in megabytes.
  • -G rotates after a time interval in seconds.
  • -W limits the number of rotated files in supported modes.

Rotation behavior and filename time formatting can vary by tcpdump version, so test the command in a non-sensitive environment. Plan disk capacity before starting. Consider filter scope, snaplen, capture duration, retention period, and the effect of high-volume links. Monitor free space even when rotation is configured; a bounded file set does not replace operational monitoring.

Capture Fidelity and Performance

Snapshot length

Snaplen is the maximum number of bytes retained from each packet. A small snaplen saves space but may truncate application headers or payloads. Use an appropriate value for the question being answered. Use -s 0 when complete packets are required, policy permits payload collection, and storage is sufficient.

Promiscuous mode and visibility

Promiscuous mode allows an interface to accept more frames than those addressed directly to it. It does not bypass switch forwarding behavior. On a switched network, an endpoint normally cannot see unrelated unicast traffic merely because promiscuous mode is enabled. Wi-Fi monitoring also depends on adapter, driver, channel, and mode support. For broader visibility, use an endpoint, gateway, firewall, approved network tap, or switch SPAN destination that is actually on the traffic path.

Drops and system impact

A packet drop occurs when a packet cannot be retained during capture, often because processing or buffer capacity is insufficient. High traffic rates, verbose terminal output, name lookups, slow storage, CPU load, and large snaplen values can contribute. Use -nn, narrow the BPF filter, avoid unnecessary verbosity, write to fast approved storage, and consider a dedicated collection point. More detail improves fidelity but increases CPU, memory, storage, and privacy costs.

Read and Review Saved Captures

tcpdump -nn -r capture.pcap
tcpdump -nn -r capture.pcap 'udp port 53'
tcpdump -nn -r incident-eth0-2026-08-18T1200Z.pcap 'tcp and port 443'

-r reads an existing capture. The original file remains unchanged when you display a filtered view. Wireshark or another packet-analysis tool is useful for stream reconstruction, protocol dissection, display filters, graphs, expert information, and more detailed investigation. Preserve the original and perform analysis on a working copy when evidence handling requires it.

Common tcpdump Options

-i — select an interface — -i eth0 — verify the traffic path first.

-D — list capture interfaces — -D — names and numbering vary by host.

-n — disable hostname lookups — -n — keeps addresses numeric.

-nn — disable hostname and service lookups — -nn — improves speed and preserves numeric ports.

-v, -vv, -vvv — increase detail — -vv — extra output costs processing and screen space.

-c — stop after a count — -c 100 — useful for bounded tests.

-s — set snaplen — -s 0 — full packets require more storage.

-w — write a capture file — -w capture.pcap — protect the resulting binary data.

-r — read a capture file — -r capture.pcap — does not modify the source.

-C — rotate by size — -C 100 — confirm units and rotation behavior locally.

-G — rotate by time — -G 300 — use with an approved naming and retention plan.

-W — limit rotated files — -W 10 — test interaction with the selected rotation mode.

-p — do not use promiscuous mode — -p — may reduce visibility but can be required by policy.

Capture Output Choices

Live terminal display — run tcpdump without -w — quick validation — scrolls away, omits full packet data, and can add processing load.

Redirected text log — use shell redirection such as > summary.txt — human-readable operational notes — not a complete forensic record and may expose sensitive data.

Binary pcap capture — use -w file.pcap — later tcpdump or Wireshark analysis — potentially large and highly sensitive.

Rotated capture set — combine -C or -G with -W — ongoing collection with storage bounds — requires testing, monitoring, and retention management.

Forensic and Evidence-Handling Practices

  • Record the capture question, authorization, hostname, interface, command, BPF filter, operator, system context, and start and end times.
  • Use UTC where possible, or record the capture timezone and clock context.
  • Protect files because they may contain credentials, tokens, private content, addresses, and timing metadata.
  • Use restricted permissions and approved secure storage. For example, set a restrictive umask before creating files:
umask 077
chmod 600 capture.pcap
sha256sum capture.pcap > capture.pcap.sha256

Hashing supports integrity verification; it does not by itself establish authenticity or chain of custody. A chain of custody documents how potential evidence was collected, protected, transferred, and handled. Store hashes and collection notes according to the applicable procedure. Do not modify the original evidence file. Make a working copy for analysis and record any conversion, filtering, or export performed.

Safe Operational Workflow

  1. Define the question before collecting traffic.
  2. Confirm authorization, privacy requirements, retention rules, and the approved storage location.
  3. Identify the interface and traffic path using tcpdump -D, ip -br link, routing information, and relevant virtual or container networking details.
  4. Start with a narrow filter, suitable snaplen, numeric output, and a finite count or rotation plan.
  5. Confirm that packets are arriving and that the output is relevant. Broaden the filter only when justified.
  6. Save the pcap, record metadata, calculate an integrity hash when required, and protect the files.
  7. Review offline using tcpdump or a packet-analysis tool, keeping the original unchanged.
  8. Remove, archive, or rotate sensitive logs according to the approved retention policy.

Capture Troubleshooting

Permission denied or cannot open device — missing root access, capture capability, or policy approval — run an authorized sudo command and confirm local privilege configuration — do not grant broad capture rights to untrusted users.

No packets appear — wrong interface, restrictive filter, different namespace, VLAN, tunnel, bridge, or no application traffic — compare interfaces and counters with ip -s link, then test a broader authorized filter — inspect routing and virtual networking.

Hostnames appear or output is slow — name or service resolution is enabled — use -n or -nn — keep numeric output for diagnostics and collection.

File grows too quickly — high-volume unfiltered traffic, full snaplen, or no bounds — narrow the filter, use -c, -C, -G, and -W — monitor capacity and stop at the approved limit.

Kernel drops are reported — capture rate exceeds CPU, buffer, or storage capacity — use -nn, reduce verbosity, narrow the filter, and inspect resources — use faster storage or an approved dedicated collector.

Payload is incomplete — snaplen is too small, traffic is encrypted, or capture began too late — use an appropriate snaplen, understand TLS limits, and begin before an authorized reproduction.

Expected switched-network traffic is absent — promiscuous mode does not bypass switch forwarding — capture on the endpoint, gateway, firewall, tap, or SPAN destination on the traffic path.

File cannot be opened or is incomplete — abrupt termination, full disk, or permissions — stop cleanly when possible and verify size, space, and permissions — preserve the file and document suspected incompleteness.

Exam-Relevant Notes

  • -i chooses an interface; -D lists interfaces; -nn disables hostname and service resolution.
  • -w creates binary capture data, while shell redirection creates a text summary.
  • -r reads a saved capture and a following BPF expression filters what is displayed.
  • -c limits packets, -C rotates by size, -G rotates by time, and -W limits rotated files.
  • Promiscuous mode does not guarantee visibility of unrelated unicast traffic on a switched network.
  • A pcap containing HTTPS traffic does not automatically expose decrypted application content.
  • Always distinguish packets received, packets matched by a filter, and packets dropped by the kernel when interpreting capture statistics.

For a related internal lesson, see Intercept and Log Network Packets in Linux.