18.5 Tcpdump

Introduction

Tcpdump is a command line packet capture tool that runs on Unix-like systems such as Linux and macOS. It listens on a network interface, captures packets, and prints a human readable summary of what it sees. For beginners, it is one of the most direct ways to look at real traffic on a network without a graphical interface.

This chapter focuses on how to use tcpdump in practice, how to read its output at a basic level, and how to apply it to common troubleshooting situations. Detailed, deep packet analysis is covered elsewhere, here we focus on tcpdump itself and how it fits into a troubleshooting workflow.

Installing and basic usage pattern

On many Linux distributions and on macOS, tcpdump is already installed. If not, it is usually available through the system package manager. Running captures that see all traffic on an interface normally requires root or administrator rights, so tcpdump is usually run with sudo.

The basic pattern is:

1. Choose an interface to capture on.
2. Optionally choose a filter to limit what you capture.
3. Choose how you want the output to look, and whether to save it to a file.

A simple command that captures briefly on a specific interface might look like:

sudo tcpdump -i eth0 -c 10

This listens on interface eth0 and stops after 10 packets.

Discovering interfaces

Before capturing, you must know which interface to use. Tcpdump can list available interfaces with:

sudo tcpdump -D

The output is a numbered list of interfaces that tcpdump can capture from, for example:

You then use the interface name with the -i option, such as -i eth0. The loopback interface lo is useful when troubleshooting services that run on the same host, such as local web servers or databases that do not send traffic out to the physical network.

Permissions and safety

Because tcpdump inspects raw packets, the operating system typically restricts its use to privileged users. On most systems, running tcpdump as a normal user will fail or capture only very limited traffic. Using sudo gives tcpdump the raw socket access it needs.

Tcpdump can reveal sensitive data such as unencrypted passwords, session cookies, and internal IP addresses. When you use tcpdump:

1. Capture only what you need and for as short a time as possible.
2. Limit filters to specific hosts, ports, or protocols.
3. Protect saved capture files and delete them when they are no longer needed.

In some environments, capturing traffic without authorization is a policy violation. Always ensure you have permission to capture on a given network.

Reading tcpdump output

By default, tcpdump prints a short summary of each packet on a single line. For IP and TCP packets a typical line might look like:

12:34:56.789012 192.168.1.10.54321 > 93.184.216.34.80: Flags [S], seq 1234567890, win 65535, length 0

You can break this into parts:

For UDP, the output is simpler, for example:

10:00:01.234567 192.168.1.50.12345 > 8.8.8.8.53: UDP, length 45

You do not need to fully understand every field to use tcpdump effectively. At beginner level, focus on the timestamp, source and destination, protocol, and length. Most troubleshooting questions can be answered by looking at who is talking to whom, at what time, and over which ports.

Commonly used options

Tcpdump has many options, but beginners can be effective with a small subset. Some of the most useful general options are:

A good default combination when you first start is:

sudo tcpdump -i eth0 -nn -c 20

This gives you 20 packets on eth0, with raw IP addresses and ports, and no DNS or service name lookups. Avoiding name resolution makes the output easier to parse and prevents tcpdump from generating extra DNS traffic.

Capture filters

Capture filters let tcpdump discard packets that are not of interest before they are stored or displayed. This reduces load on your system and makes it easier to see relevant information. Tcpdump uses the Berkeley Packet Filter (BPF) syntax.

Filters are written at the end of the tcpdump command. Some fundamental filter types are:

1. Host filters: host, src host, dst host.
2. Network filters: net.
3. Port filters: port, src port, dst port.
4. Protocol filters: tcp, udp, icmp, arp and others.

Examples:

sudo tcpdump -i eth0 host 10.0.0.5
Capture only packets to or from host 10.0.0.5.

sudo tcpdump -i eth0 src host 10.0.0.5
Capture only packets sent by 10.0.0.5.

sudo tcpdump -i eth0 dst host 8.8.8.8 and port 53
Capture only packets going to 8.8.8.8 on port 53.

You can combine expressions with and, or, and not. Parentheses can group expressions, for example:

sudo tcpdump -i eth0 '(host 10.0.0.5 and tcp) or icmp'

This captures TCP traffic to or from 10.0.0.5 and all ICMP packets, such as ping.

The most frequent beginner filters are based on hosts and ports:

Quick patterns for common protocols

Certain practical filters are useful repeatedly in troubleshooting. These align with protocols that appear often in other chapters, but here we focus only on the tcpdump use.

To observe web traffic to or from your machine:

sudo tcpdump -i eth0 -nn port 80 or port 443

To look at DNS traffic, which can help diagnose name resolution issues:

sudo tcpdump -i eth0 -nn port 53

To observe pings, which use ICMP:

sudo tcpdump -i eth0 -nn icmp

To monitor DHCP, which is useful when a client cannot get an IP address:

sudo tcpdump -i eth0 -nn port 67 or port 68

To troubleshoot SSH connectivity:

sudo tcpdump -i eth0 -nn port 22

These patterns let you quickly narrow your view to the protocol that matches the symptom you are investigating.

Writing and reading capture files

Tcpdump can store all captured packets in files using the pcap format. These files can be opened later with tcpdump itself or with graphical tools.

To write to a file, use -w:

sudo tcpdump -i eth0 -nn -w web_traffic.pcap port 80 or port 443

In this case, tcpdump writes packet data to web_traffic.pcap but does not print packet summaries to the terminal. If you want minimal status while capturing, you can add -v to see some progress, but most people rely on Ctrl + C to stop the capture and tcpdump then prints basic statistics.

To read from a capture file:

tcpdump -nn -r web_traffic.pcap

When reading, you do not need root privileges, because the packets are already captured. You can apply additional filters when reading to focus on certain traffic types without changing the original file:

tcpdump -nn -r web_traffic.pcap host 10.0.0.5

This filters the stored packets so you only see those involving host 10.0.0.5.

This separation of capture and analysis is powerful. You can capture for a short period on a remote system, transfer the pcap file to your workstation, and then analyze it at your own pace, possibly with more capable tools.

Tcpdump in a troubleshooting workflow

Tcpdump becomes most useful when you connect it with specific troubleshooting questions. A few typical problems and how tcpdump can help are:

1. A host cannot reach a server.
   Capture on the client or gateway, filter by the server IP and port, and see whether SYN packets go out and whether any response returns.

For example:

sudo tcpdump -i eth0 -nn host 203.0.113.10 and port 443

If you see outbound packets with no replies, the issue may be beyond the local network. If you see no outbound packets at all, the client might not be sending them due to local configuration or firewall.

2. DNS resolution is slow or failing.
   Capture DNS traffic and look at timing between queries and responses.

sudo tcpdump -i eth0 -nn port 53

You can see which DNS servers the client is querying and whether queries receive timely responses.

3. A client is not getting an IP address.
   Capture DHCP traffic on the network segment that serves the client.

sudo tcpdump -i eth0 -nn port 67 or port 68

Then look for DHCP discovery and offer messages. Their presence or absence helps you locate the part of the process that fails.

In all cases, start with a focused filter that directly matches the symptom. Tcpdump is not about capturing everything, it is about capturing the right subset of packets that help answer a specific question.

Limiting output and load

Network interfaces can see large amounts of traffic. Unfiltered captures can quickly flood your terminal, consume CPU, and create huge files. Beginners should always limit captures in at least one of the following ways:

1. Packet count, using -c.
2. Time, by running for a short period then stopping manually.
3. Size of each packet, using -s to capture only the first part of each packet.

The -s option sets the snapshot length, in bytes. If you do not need full payloads, you can save space and resources:

sudo tcpdump -i eth0 -nn -s 128 -w small.pcap port 80

This stores only the first 128 bytes of each packet. That is often enough to see headers and basic payload without retaining full application data.

Integration with other tools

While tcpdump is fully capable of both capturing and basic inspection, it often serves as a front end for deeper analysis with other tools. For example, you might:

1. Capture traffic on a server with tcpdump.
2. Transfer the pcap file to another machine.
3. Open it in a graphical analyzer to inspect flows and payloads in more detail.

Tcpdump’s strength is that it is widely available, works over terminals and remote connections, and can act as a universal capture tool for later analysis.

Practice suggestions

To become comfortable with tcpdump, you can run simple exercises in a safe environment, such as a home network or a lab machine:

1. Capture a small number of packets while you load a simple web page. Notice the IPs and ports used.
2. Run a ping to a known IP address while capturing ICMP, and verify that you see request and reply packets.
3. Start a DNS lookup and capture port 53 traffic to see queries and responses.

Keep the focus on recognizing patterns in the output, not on decoding every field. Over time, the combination of filters, basic options, and familiarity with common protocols will make tcpdump a natural tool in your troubleshooting toolkit.