What Is tcpdump?
tcpdump is a network packet analyzer tool that was developed and released in 1988 by a team of computer scientists working at the Lawrence Berkeley Laboratory and its Network Research Group. It is used to display the contents of packets that a computer sends and receives. The utility comes with a variety of options to make the packet capture more specific and focused. Some of these options include different networking protocols and network interfaces.
Installation
Many Linux distributions come with the utility installed straight out of the box. However, if your distro of choice doesn’t, installation is luckily quick and simple. If you are using Ubuntu or Debian, for example, it can be installed using apt: On CentOS, the same is done using yum: And on Arch Linux by using pacman:
The Basics
With tcpdump installed, you can take a look at the manual by using the -h flag: This shows you a list of the flags you can utilize when using the tool. If you want to have a look at a more comprehensive and detailed manual, you can view the man page (manual page) by using the man command: You can run a basic packet capture by typing: Using the command by itself and by not specifying a network interface, the tool will choose one out of the available interfaces on your system. If you don’t want tcpdump to resolve the hostnames and instead want it to output only IP addresses, you can use the -n flag: If you want to specify the number of packets you want to capture, use the -c flag:
Specifying a Network Interface
You can specify your choice of network interface by using the -i flag: Two of the most common network interface names on most systems are eth0 and wlan0: If you want to capture data on all interfaces, you can use the any option:
Specifying a Port/Port Range
If you only want to capture data that uses a specific port number, use the command: Let’s say you want to capture traffic on the eth0 interface and for port 443 (HTTPS). Type the following: Additionally, tcpdump allows you to specify a range of ports:
Specifying a Host or Subnet
There will be times where you want to limit the captured packets only to the ones sent/received from a specific host or subnet. Luckily, tcpdump allows you to do so. You can specify a host by using the following format: As an example, capture traffic on the eth0 interface and specify the host as 127.0.0.1 (your own loopback IP address): If you want to specify a network subnet using the CIDR notation, you can use the following format: For example: You can also directly specify a source host: And a destination host:
Specifying Verbosity
tcpdump allows you to specify the verbosity of the packet capture. This is very useful when you don’t want to be overwhelmed by the amount of information during a capture. There are three incremental options for verbosity, the flags -v, -vv and -vvv: The first option specifies the least verbosity, while the third option specifies the most.
Saving the Capture to a File
It is often useful to save the captured data to a file, so it can be further analyzed and interpreted. This is done by using the -w flag: As an example, you can save the captured data to a file called “capture.txt”:
1. I received an “Operation not permitted” error. How do I resolve it?
The following is a common error users might receive when trying to use tcpdump: tcpdump gives you this error when you don’t have the necessary permissions to perform packet capture. In most scenarios, you can resolve this by using sudo. For example:
2. How do I know which network interfaces are available?
tcpdump has a built-in functionality that allows you to check the available network interfaces on your system. To check the interfaces, use the -D flag:
