How to Use tcpdump in Linux to Capture Network Packets, Filter Protocols, and Analyse PCAP Traces

Architectural Foundation of the Linux Packet Capture Subsystem and BPF

Debugging network connectivity drops, transient application timeouts, and unauthorized port communications requires deterministic packet-level visibility. In Linux systems, tcpdump serves as the industry-standard command-line packet analyser, operating directly on top of the libpcap userland library and the kernel’s Berkeley Packet Filter (BPF) subsystem.

When tcpdump initialises a capture on a network interface, it opens a raw AF_PACKET network socket. Rather than transmitting all raw network traffic into userland memory space—which would cause severe CPU cache churn and catastrophic packet drops—the Linux kernel compiles user-defined filter expressions into optimized in-kernel BPF bytecode routines. Incoming frames passing through the network interface card (NIC) driver are inspected inside the kernel’s interrupt handler. Only frames that satisfy the BPF filter logic are copied into the socket receive ring buffer for tcpdump to process and record.

Capture Architecture Component	Kernel / Userland Layer	Operational Role	Performance Impact
Network Device Driver (NIC)	Kernel Ring Buffer	Direct Memory Access (DMA) frame ingestion	Physical hardware line rate
Berkeley Packet Filter (BPF)	Kernel Socket Filter	JIT-compiled boolean evaluation of packet headers	Microsecond filtering; discards unwanted frames
AF_PACKET Socket Buffer	Kernel-to-Userland Bridge	Circular ring buffer queuing filtered packets	Subject to drops if userland process stalls
libpcap & tcpdump	Userland Application	Decodes protocol headers, writes PCAP binaries	Disk I/O and display rendering bottleneck

Essential Execution Flags and Performance Tuning

Running tcpdump on production high-throughput servers without appropriate flags can introduce server performance degradation or trigger cascading network feedback loops. Always apply performance-optimised invocation parameters:

• -i <interface>: Binds capture to a specific physical or virtual interface (e.g., eth0, ens3) or captures across all interfaces via any.
• -n: Disables reverse DNS resolution. (CRITICAL: If omitted, tcpdump issues a DNS lookup for every captured packet’s IP, generating infinite circular DNS capture loops).
• -nn: Disables both hostname resolution and port-to-service name resolution (e.g., prints :443 instead of :https).
• -s 0: Sets the snapshot length (snaplen) to 0 (unlimited), capturing full, untruncated packet payloads rather than truncating headers.
• -w <file.pcap>: Streams raw binary packet data directly to a standard PCAP file for offline analysis in Wireshark, bypassing expensive terminal rendering.
• -c <count>: Halts execution automatically after capturing a specified number of frames.

Capturing Network Traffic with High-Precision BPF Expressions

Berkeley Packet Filter syntax enables pinpoint isolation of network traffic based on network layers, protocol headers, and bitwise flags.

Step 1: Isolate Specific Hosts, Subnets, and Ports

# Capture all HTTPS traffic to or from a specific database server
sudo tcpdump -i eth0 -nn -s 0 host 192.168.1.50 and port 443

# Capture all traffic traversing an internal corporate subnet excluding SSH sessions
sudo tcpdump -i eth0 -nn net 10.200.0.0/16 and not port 22

# Capture bidirectional DNS query traffic across port 53
sudo tcpdump -i any -nn udp port 53 or tcp port 53

Step 2: Inspect TCP Handshakes and Control Flags via Bitwise Masking

TCP packet headers encode flags at byte offset 13. System administrators can isolate specific TCP lifecycle stages using bitwise operators:

# 1. Capture exclusively TCP SYN packets (Connection Initiation)
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-syn) != 0 and tcp[tcpflags] & (tcp-ack) == 0'

# 2. Capture TCP Reset (RST) packets indicating connection aborts or refused ports
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-rst) != 0'

# 3. Capture TCP SYN-ACK packets (Server Acceptance)
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)'

Exporting and Analysing PCAP Traces

To diagnose intermittent application errors, capture traffic to a rotating file buffer on the server, transfer the archive, and analyze it using desktop diagnostic utilities.

Step 1: Record Traffic with Size-Based File Rotation

Prevent disk exhaustion on busy servers by using rotating ring buffers:

# Capture traffic into rotating 100 MB files, retaining a maximum of 5 files
sudo tcpdump -i eth0 -nn -s 0 -w /var/log/capture_%Y-%m-%d_%H-%M-%S.pcap -C 100 -W 5 'port 80 or port 443'

Step 2: Read and Filter Existing PCAP Files Offline

# Read captured PCAP file and display ASCII text payload (HTTP headers, payload fragments)
tcpdump -A -r /var/log/capture_trace.pcap 'port 80'

# Display packet contents in both Hexadecimal and ASCII format
tcpdump -X -r /var/log/capture_trace.pcap 'icmp'

Troubleshooting Common Packet Capture Faults

Observed Issue	Underlying Root Cause	Diagnostic Verification Method	Remediation Protocol
“Packets dropped by kernel” in capture summary	Socket receive buffer overflow; disk write speed or terminal printing cannot keep pace with packet ingress	Summary upon Ctrl + C shows elevated packets dropped by kernel counter	Increase OS buffer size via -B 4096 (4 MB buffer); write directly to disk with -w rather than stdout
“Permission denied” / Operation not permitted	Standard non-root user accounts lack raw socket privileges (CAP_NET_RAW and CAP_NET_ADMIN)	Terminal returns immediate permission error	Execute via sudo or grant Linux ambient capability: sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
Missing Inter-VM / Local Container Traffic	Capturing on physical NIC (eth0) instead of virtual bridge (docker0, cni0, or veth*)	Traffic visible inside container but absent from physical interface dump	Identify virtual bridge via ip link; capture on -i docker0 or -i any
Payload Data Appears Encrypted / Inscrutable	Application traffic encrypted via TLS 1.3 or SSH; payload contents scrambled by design	Packet payload shows binary entropy without plain text HTTP headers	Inspect TLS Client Hello and Server Hello SNI extensions; configure SSLKEYLOGFILE for decryption in Wireshark