When diagnosing low-level network issues—such as TLS handshake timeouts, asymmetric routing failures, DNS resolution drops, or malicious port scans—system administrators and security engineers rely on packet capture utilities. While GUI tools like Wireshark provide rich interactive trees, headless production servers require command-line interfaces. Combining tcpdump (the industry-standard lightweight packet sniffer) with tshark (the CLI version of Wireshark) enables automated, high-precision network packet analysis directly from the Linux shell.
Capturing Network Traffic with tcpdump
The tcpdump utility captures raw packet data passing across a physical or virtual network interface using the libpcap subsystem. To inspect available network interfaces and start capturing:
# List all active capture interfaces
sudo tcpdump -D
# Capture live traffic on interface eth0
sudo tcpdump -i eth0 -n -vv| tcpdump Flag | Operational Behavior | Diagnostic Purpose |
|---|---|---|
-n / -nn |
Disables DNS name and service port resolution. | Prevents capture latency and misleading reverse DNS lookups. |
-v / -vv / -vvv |
Increases protocol decoding verbosity. | Displays TTL values, packet IDs, flags, and options. |
-w capture.pcap |
Writes raw unparsed frames directly to disk. | Preserves exact packet data for offline dissection. |
-r capture.pcap |
Reads and replays an existing capture file. | Analyzes historical telemetry without capturing live packets. |
-s 0 |
Sets packet capture snap length to unlimited (default in modern versions). | Prevents packet payload truncation. |
Filtering Packets Using Berkeley Packet Filters (BPF)
On high-traffic web servers, capturing all packets saturates disk buffers instantly. Use Berkeley Packet Filter (BPF) expressions to restrict packet capture to relevant flows:
# Capture only DNS traffic (UDP port 53)
sudo tcpdump -i eth0 -n -vv 'udp port 53'
# Isolate TCP SYN packets (detecting inbound connection requests)
sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0 and not src host 192.168.1.1'
# Capture traffic to a specific web server on HTTPS port 443
sudo tcpdump -i eth0 -n -w https_traffic.pcap 'host 10.0.0.15 and port 443'Dissecting Protocols with tshark
While tcpdump excels at rapid, low-overhead packet writing, tshark provides full Wireshark dissection engines to extract specific protocol fields (such as HTTP request headers, TLS SNI server names, and DNS query strings) into clean tabular output.
# Install tshark on Debian/Ubuntu
sudo apt install tshark -yTo extract all TLS Client Hello Server Name Indication (SNI) domain queries from a live interface without reading payloads:
sudo tshark -i eth0 -T fields -e frame.time_relative -e ip.src -e tls.handshake.extensions_server_name -Y "tls.handshake.type == 1"Analyzing DNS Latency and Response Codes
To detect slow DNS upstream resolvers or domain query failures:
sudo tshark -i eth0 -f "udp port 53" -T fields -e ip.src -e dns.qry.name -e dns.flags.response -e dns.time -E header=y -E separator=,This outputs a comma-separated stream showing the queried domain, whether the packet is a response, and the exact round-trip response time in seconds. By piping this output into command-line utilities like awk or logging engines like Fluentbit, administrators can detect transient packet loss and identify latency regressions with surgical accuracy.