Mastering tcpdump: Powerful Network Packet Capture Commands

tcpdump – tracing and filtering network packets

tcpdump is a command‑line tool that prints detailed packet information for a specified network interface.

Command format

The basic invocation follows the pattern: tcpdump [options] [expression] Key options include: -i <interface> – select the network interface (e.g., eth1). -c <count> – capture a specific number of packets. -B <buffer_size> – set the kernel buffer size. -w <file> – write raw packets to a file. -r <file> – read packets from a file. -s <snaplen> – set the snapshot length. -n – disable name resolution. -nn – disable both host and port name resolution.

Basic host and port filters

Filter by host: tcpdump -i eth1 host 172.16.71.1 Filter by source host: tcpdump -i eth1 src host 172.16.71.1 Filter by destination host: tcpdump -i eth1 dst host 172.16.71.1 Filter by port (any direction): tcpdump -i eth1 port 25 Filter by source port: tcpdump -i eth1 src port 25 Filter by destination port:

tcpdump -i eth1 dst port 25

Network filtering

Filter by network: tcpdump -i eth1 net 172.16 Filter by source network: tcpdump -i eth1 src net 172.16 Filter by destination network:

tcpdump -i eth1 dst net 172.16

Protocol filtering

ARP: tcpdump -i eth1 arp IP: tcpdump -i eth1 ip TCP: tcpdump -i eth1 tcp UDP: tcpdump -i eth1 udp ICMP:

tcpdump -i eth1 icmp

Common expression operators

Negation: ! or not Logical AND: && or and Logical OR: || or

or

Complex examples

Capture TCP traffic on port 80 whose destination host is either 172.16.71.254 or 172.16.71.200:

tcpdump -i eth1 '((tcp) and (port 80) and ((dst host 172.16.71.254) or (dst host 172.16.71.200)))'

Capture ICMP packets destined for a specific MAC address:

tcpdump -i eth1 '((icmp) and ((ether dst host 00:01:02:03:04:05)))'

Capture TCP packets whose destination network is 172.16 but the destination host is not 172.16.71.200:

tcpdump -i eth1 '((tcp) and ((dst net 172.16) and (not dst host 172.16.71.200)))'

Advanced byte‑offset filtering

tcpdump allows direct byte‑offset expressions. Examples:

Match fragmented packets with the MF flag set: tcpdump -i eth1 'ip[6] = 32' Match non‑final fragments: tcpdump -i eth1 '((ip[6:2] > 0) and (not ip[6] = 64))' Match TCP packets with source port > 1024: tcpdump -i eth1 'tcp[0:2] > 1024' Match SYN packets only: tcpdump -i eth1 'tcp[13] = 2' Match SYN‑ACK packets: tcpdump -i eth1 'tcp[13] = 18' Match packets where the SYN flag is set regardless of other flags: tcpdump -i eth1 'tcp[13] & 2 = 2' Match FIN packets: tcpdump -i eth1 'tcp[13] & 1 = 1' Match RST packets:

tcpdump -i eth1 'tcp[13] & 4 = 4'

Named field shortcuts

tcpdump provides symbolic names for common fields, e.g., icmp types, tcpflags, etc. Some ICMP type values include echoreply, unreach, sourcequench, redirect, echo, routeradvert, timxceed, and others.

TCP flag symbolic values are fin, syn, rst, push, ack, urg. Example to capture only SYN packets: tcpdump -i eth1 'tcp[tcpflags] = tcp-syn' Example to capture SYN + ACK packets:

tcpdump -i eth1 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack != 0'

Protocol‑specific payload matching

SMTP (port 25) where the payload starts with "MAIL":

tcpdump -i eth1 '((port 25) and (tcp[(tcp[12]>>2):4] = 0x4d41494c))'

HTTP GET requests: tcpdump -i eth1 'tcp[(tcp[12]>>2):4] = 0x47455420' ("GET " → 0x47455420)

HTTP POST requests:

tcpdump -A -s 0 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

("POST" → 0x504f5354)

SSH banner: tcpdump -i eth1 'tcp[(tcp[12]>>2):4] = 0x5353482D' ("SSH-")

SSH version string after the banner:

tcpdump -i eth1 '(tcp[(tcp[12]>>2):4] = 0x5353482D) and (tcp[((tcp[12]>>2)+4):2] = 0x312E)'

(matches "1.")

Capturing a limited number of packets

Use -c to stop after a given count. Example that captures 10 000 SYN packets and discards the output (useful for measuring capture rate):

time tcpdump -nn -i eth0 'tcp[tcpflags] = tcp-syn' -c 10000 > /dev/null

The elapsed time gives an estimate of the traffic volume.

IPv4 header illustration

The article also shows the IPv4 header layout with fields such as Version, IHL, Total Length, Identification, Flags, Fragment Offset, TTL, Protocol, Header Checksum, Source Address, Destination Address, Options, and Data.

All examples target IPv4 packets.