Capture and analyze raw network packets on a network interface.
low risk
tcpdump captures packets matching Berkeley Packet Filter (BPF) expressions. Requires root. -i specifies the interface. Write to .pcap files for analysis in Wireshark.
| Flag | Meaning |
|---|---|
-i | Network interface to capture on (use 'any' for all) |
-n | Don't resolve hostnames or port names |
-w | Write packets to a .pcap file |
-c | Exit after capturing N packets |
tcpdump -i eth0 -n port 80 -w /tmp/http.pcapCapture HTTP traffic to file for Wireshark analysis · explain & risk-check →tcpdump -i any -n 'host 10.0.1.5 and port 5432'Capture PostgreSQL traffic to/from a specific host · explain & risk-check →tcpdump -i eth0 -n -c 100 port 53Capture 100 DNS queries and exit · explain & risk-check →Combine with -G and -W to auto-rotate capture files: `-G 60 -W 10` keeps 10 files of 60 seconds each.
Reference text is hand-written and may be incomplete — check man tcpdump for your version. Test destructive commands on a non-production system first.