Network Troubleshooting with tcpdump & Wireshark: Step‑by‑Step Guide and Ready‑to‑Use Scripts

The article begins by emphasizing that network fault diagnosis is a core skill for operations engineers, and that packet capture with tcpdump (command‑line) and Wireshark (GUI) provides the most direct view of communication problems.

1. Overview and methodology – It defines the problem space (connection timeouts, latency, packet loss) and explains why combining tcpdump for fast capture with Wireshark for deep inspection yields the best results. A survey from SharkFest/Packet Pushers shows that over 85% of network incidents can be solved with packet analysis.

2. tcpdump basics – The syntax of the tool is listed, with common options ( -i, -c, -w, -n, -nn, -s, -v) and concrete examples such as capturing the first 100 packets on eth0, filtering by port, or saving to a timestamped file. The article also provides a reusable Bash script that demonstrates basic capture, error handling, and output formatting.

3. Advanced filtering – Both capture‑time BPF filters and Wireshark display filters are explained. Tables list BPF primitives (host, net, port, src, dst) and Wireshark operators (==, !=, >, <, contains, matches, and, or, not). Sample filter strings like tcp port 80 and host 192.168.1.100 and display filter ip.addr == 192.168.1.100 && tcp.port == 80 are provided.

4. Expert Information – Wireshark’s Expert Information panel is described, with severity levels (Error, Warning, Note, Chat) and typical messages (malformed packet, TCP retransmission, zero window). The article shows how to extract these messages via tshark -z expert and interpret them for root‑cause analysis.

5. Typical fault scenarios – Detailed Bash scripts cover TCP three‑way‑handshake failures, retransmission analysis, HTTP/HTTPS diagnostics (method distribution, status‑code breakdown, slow request detection, TLS handshake errors), DNS troubleshooting (query types, response codes, latency, NXDOMAIN spikes), and database protocol inspection (MySQL, PostgreSQL, Redis). Each script prints step‑by‑step statistics, filters relevant packets, and generates concise reports.

6. Automation and batch processing – The guide provides a smart capture daemon that monitors error counts and latency thresholds, automatically starts a timed tcpdump session, and produces a post‑capture analysis report (protocol distribution, TCP issues, packet‑size histogram). A batch analysis script scans a directory of .pcap files, aggregates packet counts, retransmissions, RST packets, and produces an HTML summary with severity coloring.

7. Storage and lifecycle management – Recommendations for capture point selection (client, load balancer, server, switch SPAN) are illustrated with ASCII diagrams. A storage‑management script creates a directory hierarchy, rotates old captures, compresses files older than seven days, enforces a 100 GB quota, and sends alerts when usage exceeds thresholds.

8. Team workflow – A collaborative workflow script defines naming conventions, generates a standard analysis template, bundles captures, reports, and screenshots for hand‑off, and provides a checklist for reviewers. This ensures consistent documentation and smooth knowledge transfer across team members.

Overall, the article equips operations engineers with a complete end‑to‑end process: from selecting the right capture point, writing efficient filters, extracting expert insights, automating repetitive tasks, managing storage, to delivering reproducible analysis reports.