tcpdump
Networking
Usage
sudo tcpdump -i <if> -nn <filter>Captures the packets going past on the wire; it needs root, what to capture is written after the flags in its own filter syntax such as `port 443 and host x`, and capturing without a filter on a busy interface buries the terminal instantly.
Common flags
| Flag | Meaning |
|---|---|
| -i any | Capture on every interface; -i eth0 for just one. |
| -nn | No name and no port-number lookups, so nothing is guessed. |
| -c 100 | Stop after a hundred packets. |
| -w <file.pcap> | Write raw packets to a file for Wireshark; -r reads one back. |
| -A / -X | Print payloads as text / as hex and text. |
| port 443 and host 10.0.0.5 | The filter, in its own pcap syntax, after the flags. |
| -s 0 | Full packets. Modern versions already do this by default. |
Examples
sudo tcpdump -i any -nn port 443 -c 20Twenty HTTPS packets, then stop.
sudo tcpdump -i eth0 -w capture.pcap host 10.0.0.5Record one host to a file and open it in Wireshark later.
sudo tcpdump -i any -nn -A "tcp port 80"Read plain HTTP requests as they go past.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does tcpdump do?
Captures the packets going past on the wire; it needs root, what to capture is written after the flags in its own filter syntax such as `port 443 and host x`, and capturing without a filter on a busy interface buries the terminal instantly.
Q. How do I type it?
sudo tcpdump -i <if> -nn <filter> — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
7 are listed here; the full set is in man tcpdump. This command sits under Networking.
Related commands
man page: man tcpdump