Linux Packet Capture Command: tcpdump

1. Introduction to tcpdump

tcpdump is the most commonly used command-line network packet capture tool in Linux systems, developed by Van Jacobson, Craig Leres, and Steven McCanne in 1987. It allows users to capture and analyze packets transmitted through network interfaces, making it an essential tool for network engineers and system administrators to troubleshoot network issues.

Core Features:

Command-line operation, no graphical interface required, suitable for server environments
Supports parsing of various network protocols (TCP, UDP, ICMP, ARP, etc.)
Provides powerful and flexible filtering capabilities
Can save packets as pcap files for analysis in Wireshark
Low resource usage, minimal performance impact

2. Uses

Network Troubleshooting: Analyze connection failures, packet loss, latency issues, etc.
Protocol Analysis: View TCP three-way handshake, HTTP requests, DNS queries, etc.
Security Auditing: Detect abnormal traffic, suspicious port access, brute force attacks
Performance Optimization: Identify slow requests, bandwidth bottlenecks, retransmission issues
Network Learning: Understand the actual working process of the TCP/IP protocol stack

3. Installation

# Debian/Ubuntu
sudo apt update && sudo apt install tcpdump

# Red Hat/CentOS
sudo yum install tcpdump

# Fedora
sudo dnf install tcpdump

4. Syntax

Basic Format:

tcpdump [options] [filter expression]

Options: Control the packet capture behavior (interface, output method, number, etc.)
Filter Expression: Control what to capture (specify protocol/IP/port/direction, etc.)

4.1 Common Options

Basic Parameters:

Option	Description
`<span>-i <interface></span>`	Specify the network interface, e.g., `<span>-i eth0</span>`, `<span>-i any</span>` captures all interfaces
`<span>-n</span>`	Do not resolve hostnames, display IP addresses directly
`<span>-nn</span>`	Do not resolve hostnames and port names
`<span>-c <number></span>`	Limit the number of captured packets
`<span>-v/-vv/-vvv</span>`	Display more detailed information

Output Control Parameters:

Option	Description
`<span>-w <file></span>`	Save captured packets to a file (pcap format)
`<span>-r <file></span>`	Read packets from a pcap file for analysis
`<span>-s <length></span>`	Set the length of captured packets, `<span>-s 0</span>` or `<span>-s 65535</span>` captures the full packet
`<span>-A</span>`	Print packet data in ASCII format
`<span>-X</span>`	Print packet data in both hexadecimal and ASCII
`<span>-e</span>`	Display link-layer information (MAC address, VLAN, etc.)
`<span>-l</span>`	Line-buffered mode, convenient for pipe processing
`<span>-G <seconds></span>`	Rotate capture files by time

4.2 Filter Expressions

The filter expression is the most powerful feature of tcpdump, allowing precise capture of the desired traffic.

Host Filtering:

host 192.168.1.10        # Specify host (source or destination)
src host 192.168.1.10    # Source address
dst host 192.168.1.10    # Destination address
net 192.168.1.0/24       # Specify subnet

Port Filtering:

port 80                  # Specify port (source or destination)
src port 53              # Source port
dst port 22              # Destination port
portrange 8000-9000      # Port range

Protocol Filtering:

tcp                      # TCP protocol
udp                      # UDP protocol
icmp                     # ICMP protocol (ping)
arp                      # ARP protocol

Logical Operators:

and (or &&)              # AND
or (or ||)               # OR
not (or !)               # NOT

Combined Filtering Examples:

# Capture HTTP traffic from a specified host
host 192.168.1.10 and port 80

# Capture traffic from multiple hosts
host 192.168.1.10 or host 192.168.1.11

# Exclude SSH traffic
not port 22

# Complex condition combination (requires quotes)
'tcp and dst port 3306 and not src net 192.168.1.0/24'

# Expression with parentheses
"host 192.168.1.10 and (port 80 or port 443)"

5. Common Command Examples

5.1 Basic Packet Capture

# Capture all packets on eth0 interface
sudo tcpdump -i eth0

# Capture packets on all interfaces
sudo tcpdump -i any

# Capture a specified number of packets
sudo tcpdump -i eth0 -c 100

# Do not resolve hostnames and ports to improve efficiency
sudo tcpdump -i eth0 -nn

5.2 Capture by Protocol

# Capture TCP traffic
sudo tcpdump -i eth0 tcp

# Capture UDP traffic
sudo tcpdump -i eth0 udp

# Capture ICMP traffic (ping packets)
sudo tcpdump -i eth0 icmp

# Capture ARP traffic
sudo tcpdump -i eth0 arp

5.3 Capture by Host and Port

# Capture traffic from a specified host
sudo tcpdump -i eth0 host 192.168.1.10

# Capture traffic from a specified port
sudo tcpdump -i eth0 port 80

# Capture traffic from a specified host on a specified port
sudo tcpdump -i eth0 host 192.168.1.10 and port 8080

# Capture DNS traffic
sudo tcpdump -i eth0 port 53

# Capture HTTP and HTTPS traffic
sudo tcpdump -i eth0 port 80 or port 443

5.4 Save and Read Capture Files

# Save capture results to a file
sudo tcpdump -i eth0 -w capture.pcap

# Save complete packets (no truncation)
sudo tcpdump -i eth0 -s 65535 -w capture.pcap

# Read and analyze from a file
tcpdump -r capture.pcap

# Read from a file and filter
tcpdump -r capture.pcap port 80

# Save by time rotation (one file per hour)
sudo tcpdump -i eth0 -G 3600 -w capture_%Y%m%d%H%M%S.pcap

5.5 Display Detailed Content

# Display ASCII content
sudo tcpdump -i eth0 -A port 80

# Display hexadecimal and ASCII
sudo tcpdump -i eth0 -X port 80

# Display detailed information
sudo tcpdump -i eth0 -vvv port 80

# Display link-layer information
sudo tcpdump -i eth0 -e

5.6 Advanced Filtering

# Capture TCP three-way handshake packets (SYN or ACK flags)
sudo tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'

# Capture TCP RST packets (connection reset)
sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-rst != 0'

# Capture TCP SYN packets (connection request)
sudo tcpdump -i eth0 'tcp[tcpflags] == tcp-syn'

# Capture packets larger than 100 bytes
sudo tcpdump -i eth0 'greater 100'

# Capture packets smaller than 64 bytes
sudo tcpdump -i eth0 'less 64'

# Exclude common ports to discover abnormal traffic
sudo tcpdump -i eth0 'tcp and not port 22 and not port 80 and not port 443'

6. Engineering Practice Scenarios

6.1 Troubleshooting Service Unreachable

A service is deployed at 10.0.0.5:8080, and the client connection fails:

sudo tcpdump -i eth0 host 10.0.0.5 and port 8080 -nn

Analysis Results:

The client sends a SYN packet, but the server does not respond → The service is not listening or the firewall is blocking
The server replies with RST → The port is not open
Normal three-way handshake followed by disconnection → Application layer issue

6.2 DNS Troubleshooting

Domain name cannot be resolved:

sudo tcpdump -i eth0 port 53 -nn -vvv

Analysis Results:

No DNS requests sent → Client configuration issue
Requests sent but no response → DNS server unreachable
Response received but resolution failed → DNS server configuration issue

6.3 Locating Slow Requests

Users report website lag:

sudo tcpdump -i eth0 tcp port 80 -w web.pcap

Import into Wireshark for analysis to check for:

TCP Retransmission → Network packet loss
TCP Window Full → Slow processing on the receiving end
Numerous RST packets → Abnormal connection disconnection

6.4 Analyzing TCP Handshake Issues

Application connection timeout:

sudo tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' -nn

Observe the three-way handshake process:

Did the client send SYN?
Did the server reply with SYN-ACK?
Did the client send ACK confirmation?

6.5 HTTP Traffic Analysis

# Capture HTTP requests and responses
sudo tcpdump -i eth0 -A -s 0 port 80 | grep -E '(GET|POST|HTTP)'

# Capture complete HTTP content
sudo tcpdump -i eth0 -A port 80 -c 50

6.6 Security Auditing

Detect abnormal traffic:

# Exclude common services to discover suspicious connections
sudo tcpdump -i eth0 'tcp and not port 22 and not port 80 and not port 443' -nn

# Detect ICMP flood attacks
sudo tcpdump -i eth0 icmp -c 1000

# Count traffic distribution by IP
sudo tcpdump -i eth0 -nn | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn

6.7 VLAN Issue Troubleshooting

# Check VLAN tags
sudo tcpdump -i eth0 -e vlan

# Capture unexpected VLAN traffic
sudo tcpdump -i eth0 vlan and not vlan 10 and not vlan 20

7. Using tcpdump with Wireshark

Best Practice Process:

Lightweight Capture Online:

sudo tcpdump -i eth0 -s 65535 -w capture.pcap

Transfer File to Local:

scp user@server:/path/capture.pcap ./

Local Wireshark Deep Analysis:

Open Wireshark to load the pcap file
Use display filters (e.g., tcp.port==80, ip.addr==192.168.1.10)
Utilize statistical tools (I/O graphs, traffic distribution) to locate performance bottlenecks

Engineering Principle: Online servers are only responsible for packet capture to avoid performance loss; local Wireshark is used for visual analysis to improve efficiency.

8. Performance Optimization Suggestions

**Use-n or -nn**: Avoid DNS resolution to improve capture efficiency
Limit Capture Quantity: Use -c to limit the number of packets to avoid exhausting disk space
Precise Filtering Conditions: Reduce unnecessary data capture
**Set-s**: Only capture the required number of bytes to reduce I/O
Run in Background: Use & or nohup for long-term captures

# Run in background and save
nohup tcpdump -i eth0 -w /var/log/capture.pcap &

# Rotate by time to avoid large single files
tcpdump -i eth0 -G 3600 -w capture_%Y%m%d%H%M%S.pcap &

9. Network Packet Format

Understanding packet structure is the foundation of analysis. A typical TCP/IP packet format includes:

IP Header: Source IP, Destination IP, TTL, Protocol Number
TCP Header: Source Port, Destination Port, Sequence Number, Acknowledgment Number, Flags (SYN/ACK/FIN/RST), Window Size
Payload: Actual data being transmitted

Recommended Learning Resources:

Protocol Map
TCP/IP Packet Format – GeeksforGeeks

10. Source Code

tcpdump is an open-source project developed based on the libpcap library:

Official Homepage: https://www.tcpdump.org/
GitHub Source: tcpdump/tcpdump
libpcap Library: tcpdump/libpcap

11. References

Official Documentation: tcpdump Official Homepage
Man Page: tcpdump(1)
Filter Syntax: pcap-filter(7)
System Manual: man tcpdump

Link Acquisition Method: Follow the official account and reply “tcpdump” in the backend