How to Use the tcpdump Command in Linux to Capture, Filter, and Analyse Network Packets

Diagnosing network connectivity failures, latency spikes, dropped TLS handshakes, and rogue broadcast storms on headless Linux servers requires direct visibility into raw packet streams. While graphical analysers like Wireshark provide rich visual protocol decoding, they cannot run natively on production cloud servers, remote firewall appliances, or stripped-down container hosts. For headless network diagnostics, the command-line packet analyser—tcpdump—is the definitive industry standard.

Powered by the libpcap packet capture library, tcpdump intercepts raw frame data directly from the network interface card driver before kernel firewall filtering or application socket delivery occurs. Using Berkeley Packet Filter (BPF) syntax, engineers can filter specific IP subnets, target transport ports, inspect TCP control flags (such as SYN, ACK, and RST), and export capture traces to standardized .pcap files for offline inspection. This technical guide explains essential capture flags, BPF filtering logic, protocol debugging recipes, and performance safeguards.

Essential tcpdump Command Flags Reference

Executing tcpdump requires elevated root privileges (sudo). Combine these core flags to control output verbosity and packet decoding:

Flag / Parameter	Functional Purpose	Operational Role
-i <interface>	Specifies the network interface to listen on.	Targets physical NICs (eth0), bridges, or any for all interfaces.
-n / -nn	Disables DNS hostname and port name resolution.	Crucial for performance; prevents tcpdump from generating DNS lookups during captures.
-v / -vv / -vvv	Increases protocol decoding verbosity.	Decodes IP TTL values, TCP options, packet IDs, and ICMP metadata.
-c <count>	Limits capture to an exact number of packets before terminating.	Prevents terminal buffers from flooding during high-bandwidth captures.
-w <file.pcap>	Writes raw binary packets directly to a PCAP capture file.	Saves captures for in-depth Wireshark inspection without terminal truncation.
-r <file.pcap>	Reads and parses packets from a previously recorded PCAP file.	Enables offline analysis with secondary BPF filters.
-X / -XX	Prints packet payload in both hexadecimal and ASCII format.	Inspects unencrypted application payloads (HTTP headers, DNS queries, SMTP).

Discovering Network Interfaces

Before launching a capture session, enumerate all available network interfaces:

sudo tcpdump -D

The console lists active interfaces (e.g., eth0, enp3s0, docker0, and any). Use -i any to capture traffic traversing all local endpoints simultaneously.

Capturing and Filtering with Berkeley Packet Filters (BPF)

BPF expressions appended after command flags allow precise packet filtering directly inside the kernel, discarding irrelevant packets with minimal CPU overhead:

Filtering by Host IP or Subnet

# Capture packets to or from a specific host
sudo tcpdump -i eth0 -nn host 192.168.1.50

# Capture packets originating from a specific IP
sudo tcpdump -i eth0 -nn src 192.168.1.100

# Capture traffic to an entire Class C subnet
sudo tcpdump -i eth0 -nn net 10.0.0.0/24

Filtering by Port or Application Protocol

# Capture all traffic on port 443 (HTTPS)
sudo tcpdump -i eth0 -nn port 443

# Capture all DNS traffic on UDP port 53
sudo tcpdump -i eth0 -nn udp port 53

# Capture port ranges (e.g., passive FTP or RTP streams)
sudo tcpdump -i eth0 -nn portrange 5000-5010

Combining Filters with Boolean Logic (and, or, not)

Construct complex compound expressions using standard logical operators:

# Capture HTTP or HTTPS traffic from a specific subnet, excluding SSH
sudo tcpdump -i eth0 -nn "(port 80 or port 443) and net 192.168.1.0/24 and not port 22"

Practical Diagnostic Recipes

1. Troubleshooting TCP Connection Drops (SYN and RST Flags)

To detect connection attempts rejected by a firewall or server reset:

sudo tcpdump -i eth0 -nn "tcp[tcpflags] & (tcp-syn|tcp-rst) != 0"

2. Inspecting DNS Queries and Latency

To monitor real-time domain lookups and upstream responses:

sudo tcpdump -i eth0 -nn -vvv -s 0 port 53

3. Capturing and Saving Traces for Wireshark

To capture 5,000 packets of web traffic and write to disk for analysis in Wireshark:

sudo tcpdump -i eth0 -nn -s 0 -c 5000 -w /tmp/web_incident.pcap "port 80 or port 443"

Note: The -s 0 flag sets the snapshot length (snaplen) to 65535 bytes, ensuring full packet payloads are captured without truncation.

Performance and Security Safeguards

Executing tcpdump on high-throughput production servers (such as 10 Gbps database or web nodes) can exhaust CPU resources and fill root filesystems if misconfigured:

• Always Use -nn: Omitting -nn forces tcpdump to issue a reverse DNS lookup for every observed IP address, generating recursive query loops that stall the terminal and consume gigabytes of bandwidth.
• Use Rotating Capture Buffers: When recording packet traces over extended periods, avoid filling the disk by employing file rotation flags:

  # Rotate every 100 MB (-C 100), keeping a ring buffer of 5 files (-W 5)
  sudo tcpdump -i eth0 -nn -s 0 -C 100 -W 5 -w /var/log/capture.pcap

• Sensitive Data Exposure: Never use -X on production networks handling unencrypted HTTP, LDAP, or Telnet traffic containing sensitive authentication tokens or plaintext passwords without strict access authorization.