Tcpdump captures and analyzes network traffic on Linux in real time. It filters packets by host, port, and protocol, allowing you to isolate suspicious communications and save evidence in .pcap format for Wireshark analysis.
Anomalous outbound traffic from a server. No useful application logs. Tcpdump showed a connection to an external IP on port 4444 every 30 seconds in just 3 commands. When I investigated an environment with 2,000 endpoints experiencing mysterious slowdowns, system logs were clean. Firewalls logged no blocks. I launched tcpdump and the truth emerged: a compromised process was communicating with a C2 infrastructure every 30 seconds. 73% of breaches start from unmonitored external communications (Verizon DBIR 2025). With tcpdump, you have no interpretive filters. You see exactly what travels on the wires. This tcpdump guide gives you the commands to capture, filter, and save traffic, transforming you from a sysadmin into an analyst.
Prerequisites for This Tcpdump Guide
You need a Linux machine with root access or the CAP_NET_RAW capability. I tested these commands on Ubuntu 24.04 and Rocky Linux 9, but they apply to any modern distribution. On Debian and Ubuntu, install the package with sudo apt install tcpdump. On RHEL or Rocky Linux, use sudo dnf install tcpdump. Verify the installation with tcpdump --version. The basic syntax is straightforward: tcpdump [options] [filter]. Without options, it captures everything on the first available interface. On an enterprise network, the volume of data will overwhelm you in seconds. Learn to filter immediately.
Capturing and Filtering Network Traffic
A modern machine has multiple NICs. Run sudo tcpdump -D to list available interfaces. If you specify nothing, tcpdump picks the first one. On a server with 300+ VMs and VLAN bridges, you must target the correct interface. The base command is sudo tcpdump -i eth0. If you want to capture on all active interfaces, use sudo tcpdump -i any. Be careful: -i any creates aggregated traffic that Wireshark interprets with inconsistent timestamps. Targeting the specific interface is always the best choice for forensic analysis.
Filter by Host and Port
Total traffic is noise. Isolating a specific host reduces the load and shows you only the relevant conversation. sudo tcpdump -i eth0 host 192.168.1.1 captures everything entering or leaving 192.168.1.1. If you want only outbound traffic to that IP, use src: sudo tcpdump -i eth0 src host 192.168.1.1. For inbound traffic, use dst host. When I hunt for suspicious communications in an enterprise environment, I filter by the compromised server IP and watch who it contacts externally.
Ports identify services. Filtering by port focuses you on DNS, HTTP, or SSH without distractions. sudo tcpdump -i eth0 port 80 captures web traffic. For SSH, use port 22. To combine ports: port 80 or port 443. Port filters are your first line of defense when debugging a service that does not respond. If traffic does not arrive on the expected port, the problem is routing or firewall, not the application.
Filter by Protocol and BPF Syntax
Tcpdump distinguishes layer 3 and 4 protocols. sudo tcpdump -i eth0 tcp captures only TCP segments. udp, icmp, arp are other common filters. If you investigate a volumetric DDoS attack, filtering by icmp immediately shows the ping wave. If you debug a DNS resolution issue, udp port 53 is more precise, but filtering by udp in general gives you an overview of all active connectionless services.
Berkeley Packet Filter (BPF) is the language tcpdump uses to filter directly in the kernel. A well-written BPF filter discards packets before they reach the application, reducing CPU load. I don’t have a definitive answer on whether BPF filtering completely eliminates packet drop under extreme DDoS conditions, but in my experience, pushing the filter to the kernel level saves enough CPU to maintain control of the machine.
sudo tcpdump -i eth0 'host 10.0.0.1 and port 443'
sudo tcpdump -i eth0 'not port 22 and host 10.0.0.1'
sudo tcpdump -i eth0 'net 192.168.0.0/24'You can use and, or, not. To exclude your monitoring SSH session, use the second command in the block above. BPF filters also support network masks. When I analyze an incident, I use complex BPF combinations to isolate C2 traffic while excluding legitimate background noise.
Saving and Analyzing PCAP Files
Packets fly across the terminal. You cannot analyze 50,000 packets in real time. You must save them. sudo tcpdump -i eth0 -w capture.pcap writes the raw output to a file. The .pcap format is the universal standard for network analysis. Add -c 1000 to capture only 1000 packets and avoid filling the disk. An organization with 2,000 endpoints generates gigabytes of traffic in a few hours. Capturing without limits on a full disk destroys your filesystem. Always use -c or a cron job to stop the capture.
Read HTTP Traffic in Clear Text
The .pcap file is unreadable for a human. You need Wireshark. Transfer the file from the Linux server to your workstation with scp. When you transfer the file, ensure you use binary mode. SCP handles this natively, but FTP clients might corrupt the PCAP if set to ASCII mode. A corrupted PCAP means lost forensic evidence. Open Wireshark, load the file, and navigate the traffic with GUI filters, colorizations, and statistics. Wireshark decodes application protocols, showing the content of HTTP requests, TLS certificates, and DNS queries. Tcpdump captures. Wireshark analyzes. They are two sides of the same coin. You can find the complete official documentation on the tcpdump man page.
For quick checks, use the ASCII flag. sudo tcpdump -i eth0 -A port 80 prints packet contents in ASCII. You see GET requests, headers, and cookies. On an unencrypted network, this shows exactly what travels. 40% of internal web traffic is still in clear text (Statista 2025), making this filter a goldmine during debugging.
Here is a quick cheatsheet for your daily operations:
| Goal | Command |
|—|—|
| Total traffic on eth0 | sudo tcpdump -i eth0 |
| Specific host only | sudo tcpdump -i eth0 host 192.168.1.1 |
| Port 80 only | sudo tcpdump -i eth0 port 80 |
| TCP only | sudo tcpdump -i eth0 tcp |
| Combined host and port | sudo tcpdump -i eth0 'host 10.0.0.1 and port 443' |
| Save capture | sudo tcpdump -i eth0 -w capture.pcap |
| Read HTTP ASCII | sudo tcpdump -i eth0 -A port 80 |
Common Errors and Troubleshooting
“No suitable device found” means you lack root privileges or the interface is down. Verify with ip link. “Packet capture is too verbose” is solved by adding -q for quiet output or -t to remove timestamps. If the capture fills the disk, set -c for the packet count or -G 3600 for file rotation every hour. Do not use -i any for forensics, as timestamps are unreliable.
People often ask how to see traffic in real time without saving it. Use tcpdump without the -w option. Add -nn to avoid reverse DNS resolution, which slows down the output, and -v to increase the detail level of captured packets. Another frequent question concerns capturing traffic from a specific VLAN. Specify the VLAN interface (e.g., -i eth0.10) or use the BPF filter vlan 10. On managed switches, ensure the port is configured as a SPAN mirror to capture traffic from other ports.
If you experience dropped packets, the kernel ring buffer might be too small. You can check dropped packets with tcpdump -i eth0 --number. Increase the buffer size using the -B option, for example sudo tcpdump -i eth0 -B 4096 to set it to 4096 KiB. This prevents data loss during high traffic spikes.
Conclusions with Operational Takeaways
Tcpdump is not a tool for lab analysts. It is the first instrument I launch when logs lie and the network hides the truth. Learn BPF filters, use -w to save, and -A to read clear text. In an enterprise infrastructure, the ability to capture and analyze traffic in 3 commands is the difference between an incident resolved in 10 minutes and a breach that lasts months. Read also: Hardening SSH en Linux: Guía Completa 2026
