Advanced tcpdump: capture, filter, and analyze network traffic.
low risk
tcpdump captures network packets and displays or saves them for analysis. Beyond basic capture, it supports BPF filter expressions to target specific hosts, ports, or protocols. Captured files in pcap format can be analyzed in Wireshark.
| Flag | Meaning |
|---|---|
-i | Interface to capture on |
-w | Write to pcap file |
-r | Read from pcap file |
-n | Don't resolve hostnames |
-v/-vv/-vvv | Verbosity levels |
-c | Capture N packets then stop |
-s | Snap length (0 = full packet) |
tcpdump -i eth0 -w /tmp/capture.pcapCapture all traffic to file · explain & risk-check →tcpdump -i eth0 host 10.0.0.1 and port 443Capture HTTPS traffic to/from specific host · explain & risk-check →tcpdump -i any port 53 -nMonitor all DNS queries · explain & risk-check →tcpdump -r capture.pcap -n | grep HTTPAnalyze saved pcap for HTTP · explain & risk-check →tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'Capture only SYN packets (detect port scans) · explain & risk-check →Use `tcpdump -i any -w - | ssh user@analyst-host 'wireshark -k -i -'` to stream live capture directly to a remote Wireshark — analyze production traffic without storing pcap files locally.
Reference text is hand-written and may be incomplete — check man tcpdump for your version. Test destructive commands on a non-production system first.