How to Use the tcpdump and tshark Commands to Capture and Analyze Network Packets in Linux

When investigating intermittent connection drops, unexpected DNS latencies, application timeout errors, or unauthorized network probes, high-level monitoring utilities like ping or netstat reveal only symptoms. Diagnosing root causes requires inspecting raw network packets as they transit physical and virtual network interfaces. In Linux, tcpdump and tshark (the command-line counterpart to Wireshark) provide industrial-grade packet capture, protocol dissection, and hexadecimal inspection directly from the terminal without requiring a graphical desktop.

Installing tcpdump and tshark on Linux

Both utilities are available across standard Linux package managers:

sudo apt update
sudo apt install tcpdump tshark -y

During tshark installation, the debconf package wizard asks whether non-superusers should be allowed to capture packets. Selecting Yes adds the local user to the wireshark system group, allowing packet analysis without root privileges.

Identifying Active Interfaces for Packet Capture

Before launching a capture session, identify active physical, bridge, or tunnel interfaces:

sudo tcpdump -D

Common interface identifiers include eth0, enp3s0, wlan0, lo (local loopback), or any (aggregates traffic across all active interfaces).

Capturing Live Packets with Berkeley Packet Filters (BPF)

The core strength of tcpdump lies in Berkeley Packet Filters (BPF), which evaluate and filter traffic at the kernel level before copying packets into user space:

• Capture by Host and Port: Monitor HTTP and HTTPS traffic involving a specific server:

  sudo tcpdump -i eth0 host 192.168.1.50 and port 443

• Capture Specific Protocols: Trace DNS lookup queries and responses across port 53:

  sudo tcpdump -i any -n udp port 53

  The -n flag disables reverse DNS resolution of IP addresses, speeding up packet display significantly.

• Inspect Full Packet Headers and Payloads: Display timestamps, ASCII payloads, and hex representations:

  sudo tcpdump -i eth0 -nn -X -s 0 port 80

  Here, -X prints both hex and ASCII output, while -s 0 sets snapshot length to capture whole packets without truncation.

Saving and Reading PCAP Capture Files

To record suspicious network incidents for offline analysis in Wireshark:

sudo tcpdump -i eth0 -w incident_capture.pcap -C 100 -W 5

This command captures traffic to incident_capture.pcap, creating a rotating ring buffer of 5 files limited to 100 MB each.

To inspect a previously captured PCAP file in the terminal:

tcpdump -r incident_capture.pcap -nn

Advanced Protocol Dissection Using tshark

While tcpdump provides lightning-fast raw capture, tshark excels at deep protocol dissection, HTTP header decoding, and TLS handshake analysis:

• Extracting Specific Protocol Fields: Print HTTP request methods, hostnames, and URIs cleanly in tabular columns:

  tshark -r incident_capture.pcap -Y "http.request" -T fields -e ip.src -e http.request.method -e http.host -e http.request.uri

• Analyzing TLS Handshakes: Inspect Server Name Indication (SNI) hostnames inside encrypted TLS client hellos:

  tshark -i eth0 -f "tcp port 443" -Y "tls.handshake.type == 1" -T fields -e ip.src -e tls.handshake.extensions_server_name

• Generating Conversation Latency Statistics: Summarize network conversations by IP endpoint and data volume:

  tshark -r incident_capture.pcap -q -z conv,ip