tcpdump(1)
Capture and display network packets in real-time or save them to a file for analysis.
Synopsis
tcpdump [OPTION]... [EXPRESSION]Description
tcpdump captures network traffic on network interfaces and displays packets matching a filter expression. It can print packet contents in real-time or write packets to a file for later inspection with tools like Wireshark. Requires root or CAP_NET_RAW capability.
Filter expressions use a simple syntax: protocol keywords (tcp, udp, icmp), operators (and, or, not), and comparisons (host, port, net). For example, 'tcp port 80' matches TCP traffic on port 80.
Common options
| Flag | What it does |
|---|---|
-i INTERFACE | Specify network interface to capture on (e.g., eth0, wlan0, any) |
-c COUNT | Exit after capturing COUNT packets |
-w FILE | Write raw packets to FILE instead of parsing and printing |
-r FILE | Read packets from FILE (previously saved with -w) |
-n | Don't resolve hostnames; show IP addresses instead |
-nn | Don't resolve hostnames or port names; show numbers only |
-X | Print packet data in hex and ASCII |
-v | Verbose output; -vv and -vvv increase verbosity |
-s SNAPLEN | Capture only first SNAPLEN bytes of packet (default 65535) |
-A | Print packet data in ASCII |
-e | Print link-layer headers (MAC addresses) |
-S | Print TCP sequence numbers in absolute form |
Examples
Capture all packets on eth0 and print them to stdout in real-time
sudo tcpdump -i eth0Capture only HTTP traffic (TCP port 80) on eth0
sudo tcpdump -i eth0 tcp port 80Capture all packets and save to capture.pcap file
sudo tcpdump -i eth0 -w capture.pcapRead and display packets from a previously saved capture file
sudo tcpdump -r capture.pcapCapture packets to/from a specific IP address
sudo tcpdump -i eth0 host 192.168.1.100Capture 10 packets, show IPs/ports as numbers, and display hex/ASCII data
sudo tcpdump -i eth0 -c 10 -nn -XCapture SSH and Telnet traffic with a compound filter expression
sudo tcpdump -i eth0 'tcp port 22 or tcp port 23'Capture ICMP packets (ping) on all interfaces, showing numeric IPs
sudo tcpdump -i any -n icmp