See the list of interfaces on which tcpdump can listen: (1)
Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater): (2)
Capture packets from a particular ethernet interface using tcpdump -i When you execute tcpdump command without any option, it will capture all the packets flowing through all the interfaces. -i option with tcpdump command, allows you to filter on a particular ethernet interface.
Capture verbose, more verbose and very verbose:
Capture only N number of packets using tcpdump -c When you execute tcpdump command it gives packets until you cancel the tcpdump command. Using -c option you can specify the number of packets to capture.
Display Captured Packets in ASCII using tcpdump -A The following tcpdump syntax prints the packet in ASCII.
Display Captured Packets in HEX and ASCII using tcpdump -XX The following tcpdump syntax prints the packet in ASCII.
Be verbose and print the data of each packet in both hex and ASCII, excluding and include the link level header:
Be less verbose (than the default) while capturing packets:
Capture the packets and write into a file using tcpdump -w display on-screen -v tcpdump allows you to save the packets to a file, and later you can use the packet file for further analysis.
Reading the packets from a saved file using tcpdump -r You can read the captured pcap file and view the packets for analysis, as shown below.
Capture packets with IP address using tcpdump -n In all the above examples, it prints packets with the DNS address, but not the ip address. The following example captures the packets and it will display the IP address of the machines involved.
Capture packets with proper readable timestamp using tcpdump -tttt
Read packets longer than N bytes You can receive only the packets greater than n number of bytes using a filter ‘greater’ through tcpdump command
Receive only the packets of a specific protocol type You can receive the packets based on the protocol type. You can specify one of these protocols — fddi, tr, wlan, ip, ip6, arp, rarp, decnet, tcp and udp. The following example captures only arp packets flowing through the eth0 interface.
Read packets lesser than N bytes You can receive only the packets lesser than n number of bytes using a filter ‘less’ through tcpdump command
Receive packets flows on a particular port using tcpdump port If you want to know all the packets received by a particular port on a machine, you can use tcpdump command as shown below.
Capture packets for particular destination IP and Port The packets will have source and destination IP and port numbers. Using tcpdump we can apply filters on source or destination IP and port number. The following command captures packets flows in eth0, with a particular destination ip and port number 22.
Display IP addresses and port numbers instead of domain and service names when capturing packets (note: on some systems you need to specify -nn to display port numbers):
To print all packets arriving at or departing from sundown:
To print traffic between helios and either hot or ace:
To print all IP packets between ace and any host except helios:
To print all traffic between local hosts and hosts at Berkeley:
To print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell from (mis-)interpreting the parentheses):
To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net).
To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets. (IPv6 is left as an exercise for the reader.)
To print IP packets longer than 576 bytes sent through gateway snup:
To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):
Capture any packets where the source or destination host, destination host or source host is 192.168.1.1. Display IP addresses and port numbers:
Capture any packets where the source or destination network, destination network or source network is 192.168.1.0/24. Display IP addresses and port numbers:
Capture only TCP packets, only UDP packets and any packet where the destination port is between 1 and 1023 inclusive. Display IP addresses and port numbers:
Capture TCP communication packets between two hosts If two different process from two different machines are communicating through tcp protocol, we can capture those packets using tcpdump as shown below.
tcpdump Filter Packets – Capture all the packets other than arp and rarp In tcpdump command, you can give “and”, “or” and “not” condition to filter the packets accordingly.
Capture any packets that are broadcast or multicast:
Capture 500 bytes of data for each packet rather than the default of 68 bytes:
Capture all bytes of data within the packet: