tcpdump Cheat Sheet

Capture and inspect packets — filters, captures on a port/host, and the summary stats that find the smoking gun.

Troubleshooting3 sections · 22 commands
⌘K

Capturing

9
tcpdump -i eth0

Capture on an interface

tcpdump -i any

Any interface

tcpdump -c 50 -i eth0

Stop after 50 packets

tcpdump -w capture.pcap

Write to a file

tcpdump -r capture.pcap

Read a pcap file

tcpdump -i eth0 -nn

No name resolution

tcpdump -i eth0 -A

Print ASCII payload (HTTP inspect)

tcpdump -i eth0 -X

Hex + ASCII dump

tcpdump -i eth0 -s 0

Snapshot full packets (no truncation)

Filters

9
tcpdump -i any port 443

Any traffic on 443

tcpdump -i any tcp port 22

TCP on port 22

tcpdump -i any host 10.0.0.5

To or from a host

tcpdump -i any src 10.0.0.5

From a source only

tcpdump -i any dst port 53 or port 80

Boolean expressions

tcpdump -i any 'tcp[tcpflags] & tcp-syn != 0'

Only SYN packets

tcpdump -i any udp port 53

DNS over UDP

tcpdump -i any portrange 8000-8005

A range of ports

tcpdump -i any ether proto ipv6

Protocol-level filters

Stats & Analysis

4
tcpdump -G 60 -w '%Y%m%d%H%M.pcap' -i eth0

Rotate capture every 60s

tcpdump -nn -i any | grep -oE 'Flags \[[A-Z\.]+\]' | sort | uniq -c

Count TCP flags seen

tcpdump -q -i eth0

Quiet low-level output

capinfos capture.pcap

Metadata about a capture (wireshark)