VMware ESXi and vSphere Cluster Management

tcpdump Command in Linux: Capture, Filter, Save, and Analyze Network Packets

Learn tcpdump on Linux: select interfaces, filter packets with BPF, read output, capture traffic, save pcap files, and troubleshoot TCP, UDP, DNS, HTTP, and HTTPS.

tcpdump is a Linux command-line utility for capturing and decoding network packets. It observes packets available to a selected network interface, displays them live, or writes them to a binary capture file for later analysis.

What tcpdump Is Used For

tcpdump is useful when you need to verify what is actually crossing a network path. Common uses include investigating connectivity failures, checking whether a service port is reachable, troubleshooting TCP or UDP behavior, examining DNS requests and responses, and confirming inbound or outbound traffic.

A packet is a unit of network data transmitted across a network. A packet capture records packets observed at a capture point, normally a network interface. tcpdump does not automatically see every packet in an environment: it sees traffic available to the chosen interface and operating-system capture mechanism.

Installation, Permissions, and Syntax

The general command pattern is:

tcpdump [options] [BPF-filter-expression]

A packet capture normally requires root privileges or Linux capabilities such as CAP_NET_RAW and CAP_NET_ADMIN. Use an approved privileged-access method, commonly sudo.

sudo apt update && sudo apt install tcpdump
sudo dnf install tcpdump
sudo yum install tcpdump

The first command is suitable for Debian and Ubuntu. The second is common on Fedora, RHEL, Rocky Linux, and AlmaLinux. The third is used on older yum-based systems.

Stop a live capture with Ctrl+C. tcpdump then prints capture statistics, including packets captured, packets received by the filter, and packets dropped by the capture mechanism where supported.

Default Capture Behavior

Running tcpdump without a filter requests a broad capture:

sudo tcpdump

The actual interface used depends on the platform and tcpdump configuration. It may be a default interface or a special any-interface capture device. For predictable results, explicitly choose an interface with -i. An unrestricted capture can produce a large amount of output, consume CPU, and increase privacy and storage risks.

Selecting a Network Interface

An interface is a network connection endpoint, such as a physical Ethernet adapter, wireless adapter, loopback device, bridge, tunnel, or virtual interface. List interfaces available to tcpdump with:

sudo tcpdump -D

Interface names vary by distribution, hardware, virtual machine, container platform, and network configuration. Common names include eth0, ens33, enp0s3, wlan0, and lo.

sudo tcpdump -i eth0
sudo tcpdump -i wlan0
sudo tcpdump -i lo

The loopback interface, usually lo, carries communication between processes on the same host. If a local client connects to a local service, the traffic may never appear on an external Ethernet interface.

Frequently Used tcpdump Options

Reading a tcpdump Output Line

With numeric output, a TCP line may look similar to this:

2026-08-19 14:20:31.123456 IP 192.0.2.20.51544 > 203.0.113.10.443: Flags [S], seq 12345, win 64240, length 0

An IP address identifies a network endpoint numerically. A hostname is a human-readable name that may resolve to an IP address. A port is a transport-layer number identifying an application endpoint. A service name is a label mapped from a port number, such as http for port 80 or ssh for port 22.

TCP output commonly includes flags such as [S] for SYN, [S.] for SYN plus ACK, [.] for ACK, [P.] for PSH plus ACK, [F.] for FIN plus ACK, and [R] for reset. UDP output generally shows source and destination endpoints and length without connection-state flags. ICMP output describes messages such as echo requests, echo replies, or unreachable errors. ARP shows address-resolution requests and replies. IPv4 and IPv6 output is identified by protocol-family labels such as IP and IP6.

Name-Resolution Controls

By default, tcpdump may perform DNS resolution for addresses and service-name resolution for ports. Names can be easier to read, but lookups can slow output, produce delays, and add confusing DNS activity. Use numeric output during troubleshooting:

sudo tcpdump -i eth0 -n
sudo tcpdump -i eth0 -nn

-n avoids hostname lookups. -nn avoids both hostname and service-name lookups, so addresses and ports remain numeric.

Displaying Packet Contents

sudo tcpdump -i eth0 -A -nn tcp port 80
sudo tcpdump -i eth0 -X -nn tcp port 80
sudo tcpdump -i eth0 -XX -nn tcp port 80

-A displays payload bytes as ASCII and is suitable for authorized inspection of unencrypted text protocols. -X displays hexadecimal bytes alongside ASCII, while -XX also includes link-layer headers. TLS and HTTPS payloads are encrypted, so their application data normally cannot be read as plain text. Payload output and files can expose secrets and personal data; handle them carefully.

Filtering Traffic with BPF Expressions

tcpdump accepts Berkeley Packet Filter (BPF) expressions. A BPF filter selects packets matching conditions such as host, network, protocol, direction, and port. Put compound expressions in single quotes so the shell does not interpret operators such as and or or.

Common Capture Filters

sudo tcpdump -i eth0 -nn host 192.168.198.2
sudo tcpdump -i eth0 -nn dst host 192.168.198.2
sudo tcpdump -i eth0 -nn tcp
sudo tcpdump -i eth0 -nn udp
sudo tcpdump -i eth0 -nn port 80
sudo tcpdump -i eth0 -nn udp port 53
sudo tcpdump -i eth0 -nn 'tcp and dst host 203.0.113.10 and dst port 443'
sudo tcpdump -i eth0 -nn 'tcp port 22'

port 443 matches traffic involving port 443 in either direction. dst port 443 restricts the match to packets sent to that port, while src port 443 matches packets originating from it.

Timestamps, Verbosity, Counts, and Snap Length

sudo tcpdump -i eth0 -nn -tttt -c 20
sudo tcpdump -i eth0 -nn -vv tcp port 443
sudo tcpdump -i eth0 -nn -s 128 tcp port 80

Default timestamps show time with fractional seconds. -tttt adds a human-readable date and time, which is useful when comparing packets with application logs. -v, -vv, and -vvv progressively increase decoded detail. -c limits the capture to a fixed number of packets.

The snap length is the maximum number of bytes captured from each packet. A larger value preserves more payload for analysis but uses more storage and may increase privacy exposure and processing cost. A smaller value can be sufficient for headers and metadata but may omit application data. Use the smallest value that meets the authorized investigation’s needs. For piping output to another process, line-buffering or immediate-output options such as -l may help, depending on the consumer.

Saving Packet Captures

sudo tcpdump -i eth0 -nn -w capture.pcap
sudo tcpdump -i eth0 -nn -c 500 -w web-troubleshooting.pcap 'tcp port 80 or tcp port 443'

-w writes binary packet-capture data, commonly in pcap format, instead of printing decoded packet lines. Do not inspect a pcap file with ordinary text tools. Use a clear filename, a restrictive filter, a packet count or controlled duration, and storage with adequate free space.

Capture files should have controlled permissions and retention. They may contain credentials, cookies, private addresses, and application data even when the terminal output appears harmless. Protect the file during transfer and remove it when it is no longer needed.

Reading and Analyzing Saved Captures

tcpdump -nn -r web-troubleshooting.pcap
tcpdump -nn -r web-troubleshooting.pcap 'udp port 53'

-r reads a previously saved capture. Display options such as -nn, -tttt, and -vv can be used while reading, and BPF filters can narrow the displayed packets. A capture-time filter reduces storage and exposure because unwanted packets are never written. A display-time filter preserves the original capture but only selects packets during later analysis.

For deeper protocol inspection, open the file in Wireshark, a graphical packet-analysis application that can decode streams, follow conversations, and display protocol fields visually.

Practical Troubleshooting Workflow

1. Identify the correct interface with sudo tcpdump -D. Consider lo, bridges, tunnels, container interfaces, VLANs, and virtual adapters.
2. Start with a narrow filter based on the expected host, protocol, or port.
3. Use -nn to remove DNS and service-name lookup noise.
4. Start tcpdump, then generate or reproduce the application request.
5. Compare request and response directions, source and destination ports, timing, retransmissions, resets, and ICMP errors.
6. Save a short pcap if live output is insufficient.
7. Stop the capture, protect the file, and inspect it with tcpdump or Wireshark.

Web Service Appears Unreachable

sudo tcpdump -i eth0 -nn 'tcp and host 203.0.113.10 and port 443'

Look for SYN packets leaving the client, SYN-ACK replies, resets, ICMP unreachable messages, or repeated retransmissions. These observations help distinguish routing problems, firewall drops, rejected connections, unreachable hosts, and application-level failures.

DNS Lookups Fail or Are Slow

sudo tcpdump -i eth0 -nn '(udp port 53 or tcp port 53)'

Verify that requests go to the expected resolver, responses return, and response timing is reasonable. Include both UDP and TCP because DNS may use either transport.

Inbound Traffic Does Not Reach an Application

sudo tcpdump -i eth0 -nn 'dst port 8080'

Capture on the interface connected to the expected traffic path. If packets arrive but no response leaves, investigate the host firewall or application. If no packets arrive, investigate upstream routing, load balancers, security groups, firewalls, the selected interface, or the capture point.

Local Client Cannot Reach a Local Service

sudo tcpdump -i lo -nn 'tcp port 3000'

Inspect the local handshake and determine whether the service accepts the connection, resets it, or never responds.

Common Limitations and Safety Practices

• tcpdump sees only traffic available to the selected interface and capture point.
• On switched networks, a host generally does not see unrelated unicast traffic simply because promiscuous mode is enabled. A promiscuous mode interface may receive more traffic visible on the local segment, but switches, operating systems, virtual networks, and cloud controls still limit what is available.
• Containers, namespaces, bridges, VPNs, bonds, VLANs, and cloud networking can place the relevant traffic on a different interface or namespace.
• Under heavy load, packet capture can lose packets. A broad filter, large snap length, excessive console output, or slow storage can contribute to drops.
• Encrypted traffic normally reveals metadata such as addresses, ports, timing, packet sizes, and some handshake information, but not readable application contents.
• Minimize capture scope, snap length, duration, and retention to reduce system impact and data exposure.

Diagnosing Common Problems

Expected Packets Do Not Appear

• The wrong interface may be selected; run tcpdump -D.
• Traffic may be local and visible only on lo.
• The BPF expression may be too restrictive or use the wrong direction.
• The path may use a container, bridge, VPN, bond, VLAN, tunnel, or virtual interface.
• Routing, firewalling, switching, or cloud-network controls may prevent traffic from reaching the capture point.

Temporarily broaden the filter, use -nn, and inspect relevant virtual or loopback interfaces.

tcpdump Reports Packet Drops

Apply a narrower BPF filter, use -c, reduce snap length when full payloads are unnecessary, write to fast local storage, and avoid excessive terminal output. Check CPU, memory, and disk constraints.

Payload Is Unreadable

The protocol may be encrypted, compressed, binary, fragmented, or truncated by snap length. Use IPs, ports, TLS metadata, packet sizes, and timing for encrypted sessions. Use -X when hexadecimal and ASCII inspection is appropriate, and increase snap length only when authorized and necessary.

Permission Errors

Use approved privileged access such as sudo or follow organizational procedures for delegated capture capabilities. Do not weaken system access controls solely for convenience.

Exam-Relevant Notes

• -i selects the capture interface, -D lists interfaces, -nn disables both hostname and service-name resolution, -w writes a capture, and -r reads one.
• host is bidirectional; src host and dst host impose direction.
• port matches either direction; src port and dst port distinguish the endpoint.
• BPF expressions use operators such as and, or, and not; quote compound expressions for the shell.
• TCP SYN, SYN-ACK, ACK, FIN, and RST flags describe connection behavior and are central to handshake troubleshooting.
• Capture-time filtering saves storage and limits exposure; reading-time filtering preserves more original evidence for later analysis.

For related packet-analysis work, see the tcpdump command reference.