When troubleshooting complex networking issues in Linux—such as diagnosing why a web server is dropping connections, verifying if a firewall rule is working, or analyzing malicious traffic during a cyberattack—standard tools like ping or netstat are insufficient. They can tell you if a connection exists, but they cannot show you the actual data flowing through the cables.
To inspect raw network traffic at the packet level, system administrators rely on tcpdump. It is the premier command-line packet sniffer for Linux.
In this guide, you will learn how to capture and analyze network packets using the tcpdump utility.
Step 1: Identifying Your Network Interface
Before you can capture packets, you must tell tcpdump which network interface (e.g., your Ethernet or Wi-Fi card) to listen to.
To list all available interfaces on your Linux machine, run:
sudo tcpdump -DYou will see a numbered list. Look for the interface connected to the network you want to monitor (commonly eth0, ens33, or wlan0). Note: Because packet sniffing requires promiscuous mode, all tcpdump commands must be run with sudo.
Step 2: Capturing Basic Traffic
To start a live capture on the eth0 interface, type:
sudo tcpdump -i eth0Your terminal will immediately explode with text as it prints the headers of every single packet entering and leaving the server. Press Ctrl + C to stop the capture.
To make the output slightly more readable, add the -n flag. This prevents tcpdump from trying to resolve IP addresses into hostnames (which slows down the capture and clutters the screen).
sudo tcpdump -i eth0 -nStep 3: Filtering by Port and Protocol
Capturing all traffic on a busy server is useless; you must filter the noise to find what you are looking for.
If you only want to see web traffic (HTTP data) on port 80, use the port filter:
sudo tcpdump -i eth0 -n port 80If you want to isolate a specific protocol, such as ICMP (the protocol used by the ping command), type:
sudo tcpdump -i eth0 -n icmpStep 4: Filtering by IP Address
If you suspect a specific computer on your network (e.g., 192.168.1.50) is infected with malware and generating bad traffic, you can isolate all packets coming from or going to that exact IP.
sudo tcpdump -i eth0 -n host 192.168.1.50You can get even more granular by specifying the direction. To only see packets originating from the suspect machine:
sudo tcpdump -i eth0 -n src 192.168.1.50Step 5: Saving Captures to a PCAP File
Reading packet headers in a terminal moving at the speed of light is difficult. For serious forensic analysis, you should save the capture to a file and open it later in a graphical tool like Wireshark.
Use the -w (write) flag to save the output to a .pcap file:
sudo tcpdump -i eth0 -n port 443 -w web_traffic.pcapThe terminal will remain blank while the capture runs silently in the background. Press Ctrl + C when you have collected enough data, and transfer the PCAP file to your workstation for deep analysis.