Tcpdump

tcpdump lets you observe packets entering or leaving a system from the command line. The useful skill is not memorising every switch—it is learning how to choose the right interface, capture only relevant traffic, read what happened, and save evidence safely.

Use it only where you have permission. A packet capture can expose internal addresses, DNS queries, session tokens, credentials, and application data. Keep the scope small and protect every capture file.

What Is tcpdump?

tcpdump is a command-line packet-capture and packet-display tool. It uses libpcap to receive traffic from an available capture interface, applies an optional capture filter, and either prints a decoded summary or writes the raw packets to a capture file.

It is especially useful on servers and remote systems where a graphical tool may not be available. Common jobs include confirming whether traffic reaches a host, watching a TCP connection form, checking for DNS replies, narrowing an intermittent problem, and collecting a small PCAP for deeper analysis.

Tool	Best fit
tcpdump	Fast command-line capture and first-pass inspection on Unix-like systems.
TShark	Command-line capture and detailed protocol dissection using Wireshark's engine; the practical native choice on Windows.
Wireshark	Interactive, graphical packet exploration with powerful display filters and protocol views.
Zeek	Transforms network traffic into structured logs for investigation and monitoring rather than showing every packet directly.

Packet-Capture Fundamentals

A capture makes more sense when five basic ideas are clear:

• Interface: the point from which traffic is observed, such as Ethernet, Wi-Fi, loopback, a VPN, or a virtual adapter.
• Frame: link-layer data used on the local network, often containing source and destination MAC addresses.
• Packet: network-layer data, normally IPv4 or IPv6, containing source and destination IP addresses.
• Port: a number used by TCP or UDP to identify a service or application endpoint.
• Protocol: the rules used to communicate, such as ARP, ICMP, TCP, UDP, DNS, or HTTP.

The capture point controls what you can see. A capture on a web server can show packets reaching that server, but it cannot prove what happened on a client, firewall, or another network segment. NAT, tunnels, containers, and load balancers may also change addresses or move traffic through a different interface.

The capture pipeline

Installation on Linux and Windows

Linux

On Linux, install tcpdump through the normal package manager for the distribution:

# Debian or Ubuntu
sudo apt update
sudo apt install tcpdump

# Fedora or Red Hat family
sudo dnf install tcpdump

# Arch Linux
sudo pacman -S tcpdump

# Confirm the installed version
tcpdump --version

Package availability, version, and privilege configuration can vary by distribution. Using the distribution package normally makes future security updates easier to manage.

Windows

tcpdump is primarily used on Unix-like systems. WinDump is a Windows port with familiar syntax, but for a current native Windows setup, TShark with Npcap is the more practical choice.

1. Download the official Wireshark Windows installer.
2. Keep TShark selected as an installation component.
3. Install Npcap, which provides live packet capture on Windows.
4. Open an appropriately privileged terminal and run tshark -D to list capture interfaces.

TShark uses different display-filter features, but its capture filters use the same libpcap-style filter language introduced on this page.

Why WSL is not always a substitute

tcpdump works inside WSL, but it observes the network environment exposed to that Linux instance. WSL 2 normally uses a virtualised NAT network, while supported Windows 11 systems can use mirrored networking. VPNs, Windows firewall rules, DNS tunnelling, and the selected WSL networking mode can all change what appears inside the Linux environment.

Use tcpdump in WSL when you need to examine traffic generated by or delivered to WSL. To capture the Windows host's native adapters and applications, use TShark or Wireshark with Npcap instead of assuming WSL can see every host packet.

Permissions and a Safe Starting Point

Live packet capture normally requires elevated privileges or a specifically configured capture capability. Reading an existing PCAP usually does not require capture privileges.

For a beginner, start with a packet limit and numeric addresses:

sudo tcpdump -i eth0 -nn -c 20

Part	Meaning
sudo	Runs the command with the privileges required for live capture. Use only when authorised.
tcpdump	Starts the packet-capture tool.
-i eth0	Captures from the interface named eth0.
-nn	Keeps IP addresses and port numbers numeric, avoiding potentially confusing name lookups.
-c 20	Stops automatically after 20 matching packets.

Find the Right Interface

Use tcpdump -D to list interfaces that tcpdump can open. A system may show entries like these:

user@linux:~$ tcpdump -D
1.eth0 [Up, Running, Connected]
2.any (Pseudo-device that captures on all interfaces) [Up, Running]
3.lo [Up, Running, Loopback]
4.bluetooth-monitor (Bluetooth Linux Monitor) [Wireless]
5.nflog (Linux netfilter log (NFLOG) interface) [none]
6.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]
7.dbus-system (D-Bus system bus) [none]
8.dbus-session (D-Bus session bus) [none]

Interface	What it represents	When to use it
eth0	A named Ethernet-style interface. Modern systems may instead use names such as enp0s3.	Traffic entering or leaving that specific network adapter.
any	A Linux pseudo-interface that listens across available interfaces.	Useful when the traffic path is unknown, but link-layer details and capture behaviour can differ from a single-interface capture.
lo	The loopback interface used when applications communicate with the same host.	Local services using 127.0.0.1 or ::1. This traffic does not travel through the physical network card.
bluetooth-monitor	A Linux monitor source for supported Bluetooth traffic.	Specialised Bluetooth troubleshooting; it is not ordinary IP capture from Ethernet or Wi-Fi.
nflog	Packets sent to the Linux Netfilter logging facility by firewall rules.	Inspect traffic explicitly directed to an NFLOG group.
nfqueue	Packets queued by Linux Netfilter for a userspace decision.	Specialised firewall or packet-processing workflows.
dbus-system / dbus-session	Supported D-Bus message sources rather than normal network adapters.	Advanced inspection of system or user-session message-bus traffic.

Interface names and special capture sources vary by operating system, kernel, libpcap build, virtualisation platform, and installed software. Generate the list on the system being investigated instead of copying an interface name from another machine.

Understand the Command Structure

sudo tcpdump [options] -i <interface> [filter expression]

• Options normally begin with - and control how tcpdump captures, prints, or saves packets.
• The filter expression selects which traffic is processed—for example, host 192.168.1.10 and tcp port 443.

Quote compound filters, especially when they contain parentheses or shell-sensitive characters. The words and, or, and not are clearer for beginners than symbolic forms such as &&.

Command Quick Reference

Check and choose

Command	What it does
tcpdump --version	Prints the tcpdump and libpcap versions, then exits.
tcpdump -h	Prints the installed version's help and usage information.
tcpdump -D	Lists interfaces that are available for capture.
sudo tcpdump -i eth0	Starts a live capture on eth0 and continues until interrupted.
sudo tcpdump -i 1	Selects interface number 1 from the list when the platform supports numeric selection.

Limit, save, and reopen

Command	What it does
sudo tcpdump -i eth0 -nn -c 50	Captures 50 packets, keeps addresses and ports numeric, then stops.
sudo tcpdump -i eth0 -w capture.pcap	Writes raw packets to a file instead of printing the normal decoded packet lines.
tcpdump -nn -r capture.pcap	Reads and prints packets from an existing capture file.
tcpdump -nn -r capture.pcap 'port 53'	Reads only packets in the file that match the DNS-port filter.
sudo tcpdump -i eth0 -C 100 -W 5 -w capture.pcap	Rotates capture files at roughly 100 million bytes and keeps a bounded set of five files.

Send printed output to another tool

# Search the decoded lines from a live capture
sudo tcpdump -l -i eth0 -nn 'tcp port 80' | grep 'GET'

# Search decoded lines from a saved capture
tcpdump -l -nn -r capture.pcap | grep 'example'

The -l option makes printed output line-buffered. Do not combine the usual -w file.pcap workflow with this example and expect decoded lines: -w writes raw packet data to the capture file.

Useful Output Switches

Switch	Meaning
-D	List available capture interfaces.
-i eth0	Select a capture interface by name or supported list number.
-n	Do not convert network addresses to names.
-nn	Also keep protocol and service names numeric, so port 443 remains 443.
-e	Print the link-layer header when available. It changes displayed detail; it does not add Ethernet data that the capture source never provided.
-A	Print packet data as ASCII. Use cautiously because readable application data may be sensitive.
-X	Print packet data in hexadecimal and ASCII, excluding the link-layer header.
-XX	Print hexadecimal and ASCII data including the link-layer header.
-v, -vv, -vvv	Increase the detail in decoded printed output. These do not add more raw bytes to a file written with -w.
-c 20	Stop after 20 matching packets.
-s <bytes>	Set the snapshot length: the maximum amount captured from each packet.
-S	Print absolute TCP sequence numbers instead of the easier-to-read relative numbers.
-q	Use shorter, quieter protocol summaries.
-tttt	Print a full date and time before each packet line.
-Q in|out|inout	Select a capture direction when the operating system and interface support it.
-r file.pcap	Read raw packets from a capture file.
-w file.pcap	Write raw packets to a capture file for later analysis.

Build Capture Filters

tcpdump filters are commonly called BPF capture filters. A simple expression combines a traffic type with optional protocol and direction qualifiers.

Filter	What it selects	Example
host	Traffic where the named IP address or host is the source or destination.	host 192.168.1.10
src / dst	Restricts the following host, network, or port to one direction.	src host 192.168.1.10
net	Traffic involving an IPv4 or IPv6 network prefix.	net 192.168.1.0/24
port	Traffic where the TCP, UDP, or SCTP source or destination port matches.	port 53
portrange	Traffic within a port range.	tcp portrange 8000-8100
tcp, udp, icmp, icmp6, arp	Traffic using a named protocol.	udp port 53
ip proto	An IPv4 protocol number or known protocol name. Prefer a clear name such as tcp when possible.	ip proto 6
less / greater	Packets whose length is less than or equal to, or greater than or equal to, a value.	greater 1200
and	Both conditions must match.	src host 10.0.0.5 and tcp port 443
or	Either condition may match.	port 80 or port 443
not	Excludes a condition.	host 10.0.0.5 and not port 22

Practical filter recipes

# Everything to or from one host
sudo tcpdump -i eth0 -nn 'host 192.168.1.10'

# HTTPS over TCP going to one server
sudo tcpdump -i eth0 -nn 'dst host 192.168.1.10 and tcp dst port 443'

# DNS over UDP or TCP
sudo tcpdump -i eth0 -nn 'udp port 53 or tcp port 53'

# A subnet, excluding SSH
sudo tcpdump -i eth0 -nn 'net 10.10.0.0/16 and not port 22'

# Group alternatives explicitly
sudo tcpdump -i eth0 -nn 'host 10.0.0.5 and (port 80 or port 443)'

Capture filters are not Wireshark display filters. A tcpdump expression such as tcp port 443 selects packets during capture or reading. A Wireshark expression such as tcp.port == 443 uses a separate display-filter language.

Read tcpdump Output

A TCP packet might be printed like this:

14:32:10.123456 IP 192.168.1.10.51544 > 93.184.216.34.443: Flags [S], seq 12345, win 64240, length 0

Output	Meaning
14:32:10.123456	The packet timestamp.
IP	The decoded network-layer protocol; IPv6 output may be labelled IP6.
192.168.1.10.51544	Source IP address and source TCP port.
>	The displayed direction from source to destination.
93.184.216.34.443	Destination IP address and destination TCP port.
Flags [S]	A TCP SYN asking to begin a connection.
seq 12345	The TCP sequence number. tcpdump normally makes sequence numbers relative for readability.
win 64240	The advertised TCP receive-window value.
length 0	No application payload is carried in this SYN packet.

Common TCP flag notation

tcpdump notation	Meaning	Typical role
[S]	SYN	Begin a TCP connection.
[S.]	SYN + ACK	Accept and acknowledge the connection request.
[.]	ACK	Acknowledge received TCP data or a handshake step.
[P.]	PSH + ACK	Deliver application data promptly while acknowledging traffic.
[F.]	FIN + ACK	Close one direction of a connection cleanly.
[R] or [R.]	RST, optionally with ACK	Reset or reject a connection.

Follow a TCP Conversation

TCP first establishes shared connection state, then transfers data, and finally closes the session. The exact packet sequence can vary, but this is the core pattern to recognise:

These patterns narrow the investigation; they do not identify the cause by themselves. Compare captures from both ends or from either side of a firewall when that access is authorised.

Capture Common Protocols

Troubleshooting Playbooks

DNS lookup fails

sudo tcpdump -i eth0 -nn 'udp port 53 or tcp port 53'

1. Look for a query leaving the client.
2. Check whether a reply returns from the expected resolver.
3. If a reply arrives, inspect its status and returned records.
4. If no ordinary DNS packets appear, verify the interface, resolver configuration, and whether encrypted DNS or WSL DNS tunnelling is being used.

Connection times out

sudo tcpdump -i eth0 -nn 'host 10.0.0.20 and tcp port 443'

Repeated SYN packets without a SYN-ACK show that the captured host is retrying. Check routing, security rules, the destination's availability, and whether the reply could be returning by another path. Capture at another authorised point before deciding where the packet disappeared.

Connection is refused

A SYN followed quickly by an RST normally means something replied but did not accept the connection. Confirm the destination address and port, whether the service is listening, and whether a firewall or load balancer is actively rejecting traffic.

TCP connects but the application is slow

If SYN, SYN-ACK, and ACK complete promptly, the initial TCP path is working. Continue by checking TLS negotiation, application requests and responses, upstream dependencies, server processing time, and whether retransmissions appear after the connection is established.

Possible packet loss or retransmission

Repeated sequence ranges, duplicate acknowledgements, or increasing delays can support a loss investigation. They do not automatically prove a defective network: capture loss, reordering, congestion, and the observation point can produce similar clues. Wireshark or TShark can provide richer TCP analysis for the saved PCAP.

No packets appear

• Confirm the interface with tcpdump -D.
• Temporarily simplify the filter.
• Check capture privileges.
• Consider loopback, VPN, container, WSL, and network-namespace boundaries.
• Generate known test traffic while the capture is running.

Common Mistakes and Misleading Clues

• Using the wrong interface: traffic on lo, a VPN, or a container bridge will not necessarily appear on eth0.
• Forgetting capture privileges: listing interfaces may work while opening one for live capture fails.
• Leaving name resolution enabled: names can hide the real ports and addresses, slow output, or create additional lookup traffic. Begin with -nn.
• Combining filters without grouping: quote the whole filter and use parentheses when mixing and with or.
• Expecting -w to print decoded lines: it writes raw packet data for later reading.
• Assuming encrypted means invisible: payload content is protected, but endpoints, timing, packet sizes, and connection behaviour remain observable.
• Believing every bad checksum: outbound packets may be captured before the network card completes checksum offloading, producing a local warning even though the transmitted packet is valid.
• Capturing too broadly: busy interfaces can fill disks, expose unrelated data, and cause kernel drops. Filter, limit, and rotate captures.
• Ignoring the final counters: review packets captured, packets received by the filter, and packets dropped by the kernel. Counter meaning and availability vary by platform.
• Treating a PCAP as a verdict: packets are evidence. Interpret them with the capture point, application behaviour, routing, logs, and surrounding timeline.

A Repeatable tcpdump Workflow

1. Define the question: for example, “Does this server receive a TCP connection on port 443?”
2. Choose the capture point: identify the host and interface that can actually observe the traffic.
3. Start narrow: use -nn, a host or port filter, and a packet or time limit.
4. Generate known traffic: perform one controlled test and note its time.
5. Read the conversation: compare both directions, flags, timing, lengths, and retries.
6. Save only when needed: write a small PCAP for deeper analysis and protect it as sensitive evidence.
7. Confirm elsewhere: combine packet evidence with application logs, firewall records, routing information, and another capture point when necessary.