Information Security 7 min read

Master tcpdump: Install, Capture, and Analyze Network Packets on Linux

This guide walks you through installing tcpdump on various Linux distributions, explains its core features, and provides step‑by‑step command examples for capturing packets from specific interfaces, limiting packet counts, displaying data in ASCII or hex, saving to files, and filtering by IP, port, or protocol.

MaGe Linux Operations

Aug 4, 2023

Master tcpdump: Install, Capture, and Analyze Network Packets on Linux

Here we demonstrate how to install tcpdump and present useful command examples with practical demonstrations.

Linux tcpdump command examples

tcpdump is a powerful and widely used command‑line packet sniffer for capturing or filtering TCP/IP packets on a specific interface. It is preinstalled on many Linux/Unix systems and can save captured packets in pcap format for later analysis with tcpdump or Wireshark.

How to install tcpdump on Linux

$ sudo apt install tcpdump         # Debian, Ubuntu, Mint
$ sudo yum install tcpdump         # RHEL/CentOS/Fedora, Rocky/AlmaLinux
$ sudo emerge -a sys-apps/tcpdump  # Gentoo
$ sudo apk add tcpdump             # Alpine
$ sudo pacman -S tcpdump           # Arch
$ sudo zypper install tcpdump      # OpenSUSE

Start using tcpdump command examples

1. Capture packets from a specific interface

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -i ens33

2. Capture a specified number of packets

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -c 5 -i ens33

3. Print captured packets in ASCII format

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -A -i ens33

4. Show available interfaces

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -D

5. Display packets in hex and ASCII

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -XX -i ens33

6. Capture and save packets to a file

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -w 0001.pcap -i ens33

7. Read a captured packet file

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -r 0001.pcap

8. Capture packets with IP addresses

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -n -i ens33

9. Capture only TCP packets

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -i ens33 tcp

10. Capture packets from a specific port

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -i ens33 port 443

11. Capture packets from a source IP

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -i ens33 src 192.168.174.132

12. Capture packets to a destination IP

root@linuxmi:/home/linuxmi/www.linuxmi.com# tcpdump -i ens33 dst 192.168.174.132

For more details, visit the original article at https://www.linuxmi.com/tcpdump.html.

Original Source

Signed-in readers can open the original source through BestHub's protected redirect.

Republication Notice

This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.

Linux command-line network analysis Packet Capture tcpdump

Written by

MaGe Linux Operations

Founded in 2009, MaGe Education is a top Chinese high‑end IT training brand. Its graduates earn 12K+ RMB salaries, and the school has trained tens of thousands of students. It offers high‑pay courses in Linux cloud operations, Python full‑stack, automation, data analysis, AI, and Go high‑concurrency architecture. Thanks to quality courses and a solid reputation, it has talent partnerships with numerous internet firms.

0 followers

Reader feedback

How this landed with the community

Rate this article

Was this worth your time?

Discussion

0 Comments

Thoughtful readers leave field notes, pushback, and hard-won operational detail here.