tcpdump Command Examples: Filters and Practical Packet Capture

When an application works on one host but misbehaves on another, or a switch port shows errors that SNMP cannot explain, tcpdump is usually the fastest way to see what is actually on the wire. This guide collects the tcpdump commands that network and Linux engineers use every day: interface selection, host/port/protocol filters, packet capture files, and troubleshooting patterns, all with copy-paste syntax.

tcpdump Basics: Choosing the Capture Interface

tcpdump must run as root (or with CAP_NET_RAW) and the first decision is always which interface to listen on. List interfaces with tcpdump -D, then capture on one:

sudo tcpdump -i eth0        # specific interface
sudo tcpdump -i any         # all interfaces (good for VPN/tunnel debugging)
sudo tcpdump -D             # list available interfaces

Always add -n (no DNS resolution) and -nn (no port-name resolution) in production: name resolution makes output slow and hides numeric truth. For noisy links, bound the capture with -c N or a timeout with -G.

Filtering by Host, Port and Protocol

Capture filters use Berkeley Packet Filter (BPF) syntax and are evaluated by the kernel, so they are extremely fast. The core vocabulary:

sudo tcpdump host 192.168.1.10              # traffic to/from one host
sudo tcpdump src host 192.168.1.10          # only from that source
sudo tcpdump dst host 192.168.1.10          # only to that destination
sudo tcpdump port 22                        # SSH traffic
sudo tcpdump src port 443                   # from source port 443
sudo tcpdump tcp                            # TCP only
sudo tcpdump udp                            # UDP only
sudo tcpdump icmp                           # ICMP (ping) traffic
sudo tcpdump arp                            # ARP traffic
sudo tcpdump port 53                        # DNS queries/responses
sudo tcpdump vlan 100                       # frames tagged for VLAN 100

Combining Filters with Boolean Operators

Real problems need compound expressions. Quote them so the shell does not split them, and use and/or/not:

sudo tcpdump 'tcp and port 80'                        # HTTP over TCP
sudo tcpdump 'host 10.0.0.5 and port 22'              # SSH for one host
sudo tcpdump 'port 80 or port 443'                    # web traffic
sudo tcpdump 'net 192.168.1.0/24 and not port 22'     # subnet, minus SSH
sudo tcpdump 'tcp[13] & 2 != 0'                       # SYN packets only
sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'  # new connections

Saving and Reading Capture Files

When a problem needs analysis after the fact (or a ticket needs evidence), write the capture to a pcap file with -w and inspect it later:

sudo tcpdump -i eth0 -w /tmp/capture.pcap 'port 443'
sudo tcpdump -r /tmp/capture.pcap | head -20        # read back, text
sudo tcpdump -r /tmp/capture.pcap -n -c 100          # first 100 packets

pcap files open directly in Wireshark, which is useful when you need to reassemble streams or follow TCP conversations; see our guide on Wireshark capture vs display filters to translate BPF knowledge into Wireshark syntax.

Practical Troubleshooting Recipes

• No packets appear? Verify the interface with -D; try -i any. On Linux, tcpdump does not see traffic between local processes on the loopback unless you capture on lo.
• Output too slow: hostnames cause DNS lookups per packet - add -n.
• Permission denied: run with sudo or grant the CAP_NET_RAW capability.
• Packets truncated: add -s 0 to capture full frames (older tcpdump versions default to 262144 or 96 bytes).
• Watch retransmissions: sudo tcpdump -i eth0 'tcp[13] & 4 != 0' isolates RST, and tcp[13] & 16 != 0 isolates ACK-heavy retransmit patterns - combine with -S for absolute sequence numbers.
• Inspect payload: -A prints ASCII payload, -X/-XX prints hex + ASCII dumps.

tcpdump pairs well with the rest of the Linux network toolbox: use ethtool to check driver-level counters first, capture with tcpdump to confirm what crosses the NIC, and validate throughput with iperf3 when the question is performance rather than correctness.

原文链接：https://linuxize.com/cheatsheet/tcpdump