DEV Community

howtouselinux
howtouselinux

Posted on • Updated on

How to use tcpdump in Linux

Tcpdump command is a famous network packet analyzing tool that is used to display TCP IP & other network packets being transmitted over the network attached to the system on which tcpdump has been installed. Tcpdump uses libpcap library to capture the network packets & is available on almost all Linux/Unix flavors.

Linux Tcpdump: Filter ipv6 ntp ping packets

Tcpdump: capture DHCP & DHCPv6 packets

20 Advanced Tcpdump Examples On Linux

10 Useful tcpdump command examples

TCPDUMP

README

Tcpdump is one of the best network analysis-tools ever for information security professionals.
Tcpdump is for everyone for hackers and people who have less of TCP/IP understanding.

OPTIONS

Below are some tcpdump options (with useful examples) that will help you working with the tool. They’re very easy to forget and/or confuse with other types of filters, i.e. ethereal, so hopefully this article can serve as a reference for you, as it does me:)

  • The first of these is -n, which requests that names are not resolved, resulting in the IPs themselves.
  • The second is -X, which displays both hex and ascii content within the packet.
  • The final one is -S, which changes the display of sequence numbers to absolute rather than relative.

Show the packet’s contents in both hex and ascii. 

tcpdump -X ....
Enter fullscreen mode Exit fullscreen mode




Same as -X, but also shows the ethernet header.


tcpdump -XX
Enter fullscreen mode Exit fullscreen mode




Show the list of available interfaces


tcpdump -D
Enter fullscreen mode Exit fullscreen mode




Line-readable output (for viewing as you save, or sending to other commands)


tcpdump -l
Enter fullscreen mode Exit fullscreen mode




Be less verbose (more quiet) with your output.


tcpdump -q
Enter fullscreen mode Exit fullscreen mode




Give human-readable timestamp output.


tcpdump -t :
Enter fullscreen mode Exit fullscreen mode




Give maximally human-readable timestamp output.


tcpdump -tttt :
Enter fullscreen mode Exit fullscreen mode




Listen on the eth0 interface.


tcpdump -i eth0
Enter fullscreen mode Exit fullscreen mode




Verbose output (more v’s gives more output).


tcpdump -vv
Enter fullscreen mode Exit fullscreen mode




Only get x number of packets and then stop.


tcpdump -c
Enter fullscreen mode Exit fullscreen mode




Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.


tcpdump -s
Enter fullscreen mode Exit fullscreen mode




Print absolute sequence numbers.


tcpdump -S
Enter fullscreen mode Exit fullscreen mode




Get the ethernet header as well.


tcpdump -e
Enter fullscreen mode Exit fullscreen mode




Decrypt IPSEC traffic by providing an encryption key.


tcpdump -E
Enter fullscreen mode Exit fullscreen mode




For more options, read manual:

BASIC USAGE

Display Available Interfaces 

tcpdump -D

tcpdump --list-interfaces
Enter fullscreen mode Exit fullscreen mode




Let’s start with a basic command that will get us HTTPS traffic:


tcpdump -nnSX port 443
Enter fullscreen mode Exit fullscreen mode




Find Traffic by IP


tcpdump host 1.1.1.1
Enter fullscreen mode Exit fullscreen mode




Filtering by Source and/or Destination


tcpdump src 1.1.1.1 

tcpdump dst 1.0.0.1
Enter fullscreen mode Exit fullscreen mode




Finding Packets by Network


tcpdump net 1.2.3.0/24
Enter fullscreen mode Exit fullscreen mode




Low Output:


tcpdump -nnvvS
Enter fullscreen mode Exit fullscreen mode




Medium Output:


tcpdump -nnvvXS
Enter fullscreen mode Exit fullscreen mode




Heavy Output:


tcpdump -nnvvXSs 1514
Enter fullscreen mode Exit fullscreen mode




Getting Creative

  • Expressions are very nice, but the real magic of tcpdump comes from the ability to combine them in creative ways in order to isolate exactly what you’re looking for.

There are three ways to do combination:

AND 

and or &&
Enter fullscreen mode Exit fullscreen mode




OR


or or ||
Enter fullscreen mode Exit fullscreen mode




EXCEPT


not or !
Enter fullscreen mode Exit fullscreen mode




Usage Example:

Traffic that’s from 192.168.1.1 AND destined for ports 3389 or 22 

tcpdump 'src 192.168.1.1 and (dst port 3389 or 22)'
Enter fullscreen mode Exit fullscreen mode




Advanced

Show me all URG packets: 

tcpdump 'tcp[13] & 32 != 0'
Enter fullscreen mode Exit fullscreen mode




Show me all ACK packets:


tcpdump 'tcp[13] & 16 != 0'
Enter fullscreen mode Exit fullscreen mode




Show me all PSH packets:


tcpdump 'tcp[13] & 8 != 0'
Enter fullscreen mode Exit fullscreen mode




Show me all RST packets:


tcpdump 'tcp[13] & 4 != 0'
Enter fullscreen mode Exit fullscreen mode




Show me all SYN packets:


tcpdump 'tcp[13] & 2 != 0'
Enter fullscreen mode Exit fullscreen mode




Show me all FIN packets:


tcpdump 'tcp[13] & 1 != 0'
Enter fullscreen mode Exit fullscreen mode




Show me all SYN-ACK packets:


tcpdump 'tcp[13] = 18'
Enter fullscreen mode Exit fullscreen mode




Show all traffic with both SYN and RST flags set: (that should never happen)


tcpdump 'tcp[13] = 6'
Enter fullscreen mode Exit fullscreen mode




Show all traffic with the “evil bit” set:


tcpdump 'ip[6] & 128 != 0'
Enter fullscreen mode Exit fullscreen mode




Display all IPv6 Traffic:


tcpdump ip6
Enter fullscreen mode Exit fullscreen mode




Print Captured Packets in ASCII


tcpdump -A -i eth0
Enter fullscreen mode Exit fullscreen mode




Display Captured Packets in HEX and ASCII


tcpdump -XX -i eth0
Enter fullscreen mode Exit fullscreen mode




Capture and Save Packets in a File


tcpdump -w 0001.pcap -i eth0
Enter fullscreen mode Exit fullscreen mode




Read Captured Packets File


tcpdump -r 0001.pcap
Enter fullscreen mode Exit fullscreen mode




Capture IP address Packets


tcpdump -n -i eth0
Enter fullscreen mode Exit fullscreen mode




Capture only TCP Packets.


tcpdump -i eth0 tcp
Enter fullscreen mode Exit fullscreen mode




Capture Packet from Specific Port


tcpdump -i eth0 port 22
Enter fullscreen mode Exit fullscreen mode




Capture Packets from source IP


tcpdump -i eth0 src 192.168.0.2
Enter fullscreen mode Exit fullscreen mode




Capture Packets from destination IP


tcpdump -i eth0 dst 50.116.66.139
Enter fullscreen mode Exit fullscreen mode




Capture any packed coming from x.x.x.x


tcpdump -n src host x.x.x.x
Enter fullscreen mode Exit fullscreen mode




Capture any packet coming from or going to x.x.x.x


tcpdump -n host x.x.x.x
Enter fullscreen mode Exit fullscreen mode




Capture any packet going to x.x.x.x


tcpdump -n dst host x.x.x.x
Enter fullscreen mode Exit fullscreen mode




Capture any packed coming from x.x.x.x


tcpdump -n src host x.x.x.x
Enter fullscreen mode Exit fullscreen mode




Capture any packet going to network x.x.x.0/24


tcpdump -n dst net x.x.x.0/24
Enter fullscreen mode Exit fullscreen mode




Capture any packet coming from network x.x.x.0/24


tcpdump -n src net x.x.x.0/24
Enter fullscreen mode Exit fullscreen mode




Capture any packet with destination port x


tcpdump -n dst port x
Enter fullscreen mode Exit fullscreen mode




Capture any packet coming from port x


tcpdump -n src port x
Enter fullscreen mode Exit fullscreen mode




Capture any packets from or to port range x to y


tcpdump -n dst(or src) portrange x-y
Enter fullscreen mode Exit fullscreen mode




Capture any tcp or udp port range x to y


tcpdump -n tcp(or udp) dst(or src) portrange x-y
Enter fullscreen mode Exit fullscreen mode




Capture any packets with dst ip x.x.x.x and port y


tcpdump -n "dst host x.x.x.x and dst port y"
Enter fullscreen mode Exit fullscreen mode




Capture any packets with dst ip x.x.x.x and dst ports x, z


tcpdump -n "dst host x.x.x.x and (dst port x or dst port z)"
Enter fullscreen mode Exit fullscreen mode




Capture ICMP , ARP


tcpdump -v icmp(or arp)
Enter fullscreen mode Exit fullscreen mode




Capture packets on interface eth0 and dump to cap.txt file


tcpdump -i eth0 -w cap.txt
Enter fullscreen mode Exit fullscreen mode




Get Packet Contents with Hex Output


tcpdump -c 1 -X icmp
Enter fullscreen mode Exit fullscreen mode




Show Traffic Related to a Specific Port


tcpdump port 3389 

tcpdump src port 1025
Enter fullscreen mode Exit fullscreen mode




Show Traffic of One Protocol


tcpdump icmp
Enter fullscreen mode Exit fullscreen mode




Find Traffic by IP


tcpdump host 1.1.1.1
Enter fullscreen mode Exit fullscreen mode




Filtering by Source and/or Destination


tcpdump src 1.1.1.1 

tcpdump dst 1.0.0.1
Enter fullscreen mode Exit fullscreen mode




Finding Packets by Network


tcpdump net 1.2.3.0/24
Enter fullscreen mode Exit fullscreen mode




Get Packet Contents with Hex Output


tcpdump -c 1 -X icmp
Enter fullscreen mode Exit fullscreen mode




Show Traffic Related to a Specific Port


tcpdump port 3389 

tcpdump src port 1025
Enter fullscreen mode Exit fullscreen mode




Show Traffic of One Protocol


tcpdump icmp
Enter fullscreen mode Exit fullscreen mode




Show only IP6 Traffic


tcpdump ip6
Enter fullscreen mode Exit fullscreen mode




Find Traffic Using Port Ranges


tcpdump portrange 21-23
Enter fullscreen mode Exit fullscreen mode




Find Traffic Based on Packet Size


 tcpdump less 32 

 tcpdump greater 64 

 tcpdump <= 128

 tcpdump => 128
Enter fullscreen mode Exit fullscreen mode




Reading / Writing Captures to a File (pcap)


tcpdump port 80 -w capture_file

tcpdump -r capture_file
Enter fullscreen mode Exit fullscreen mode




It’s All About the Combinations

Raw Output View 

tcpdump -ttnnvvS
Enter fullscreen mode Exit fullscreen mode




Here are some examples of combined commands.

From specific IP and destined for a specific Port 

tcpdump -nnvvS src 10.5.2.3 and dst port 3389
Enter fullscreen mode Exit fullscreen mode




From One Network to Another


tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16
Enter fullscreen mode Exit fullscreen mode




Non ICMP Traffic Going to a Specific IP


tcpdump dst 192.168.0.2 and src net and not icmp
Enter fullscreen mode Exit fullscreen mode




Traffic From a Host That Isn’t on a Specific Port


tcpdump -vv src mars and not dst port 22
Enter fullscreen mode Exit fullscreen mode




Isolate TCP RST flags.


tcpdump 'tcp[13] & 4!=0'

tcpdump 'tcp[tcpflags] == tcp-rst'
Enter fullscreen mode Exit fullscreen mode




Isolate TCP SYN flags.


tcpdump 'tcp[13] & 2!=0'

tcpdump 'tcp[tcpflags] == tcp-syn'
Enter fullscreen mode Exit fullscreen mode




Isolate packets that have both the SYN and ACK flags set.


tcpdump 'tcp[13]=18'
Enter fullscreen mode Exit fullscreen mode




Isolate TCP URG flags.


tcpdump 'tcp[13] & 32!=0'

tcpdump 'tcp[tcpflags] == tcp-urg'
Enter fullscreen mode Exit fullscreen mode




Isolate TCP ACK flags.


tcpdump 'tcp[13] & 16!=0'

tcpdump 'tcp[tcpflags] == tcp-ack'
Enter fullscreen mode Exit fullscreen mode




Isolate TCP PSH flags.


tcpdump 'tcp[13] & 8!=0'

tcpdump 'tcp[tcpflags] == tcp-psh'
Enter fullscreen mode Exit fullscreen mode




Isolate TCP FIN flags.


tcpdump 'tcp[13] & 1!=0'

tcpdump 'tcp[tcpflags] == tcp-fin'
Enter fullscreen mode Exit fullscreen mode




Commands that I using almost daily

Both SYN and RST Set 

tcpdump 'tcp[13] = 6'
Enter fullscreen mode Exit fullscreen mode




Find HTTP User Agents


tcpdump -vvAls0 | grep 'User-Agent:'

tcpdump -nn -A -s1500 -l | grep "User-Agent:"
Enter fullscreen mode Exit fullscreen mode




By using egrep and multiple matches we can get the User Agent and the Host (or any other header) from the request.


tcpdump -nn -A -s1500 -l | egrep -i 'User-Agent:|Host:'
Enter fullscreen mode Exit fullscreen mode




Capture only HTTP GET and POST packets only packets that match GET.


tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'
Enter fullscreen mode Exit fullscreen mode




Extract HTTP Request URL's


tcpdump -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"
Enter fullscreen mode Exit fullscreen mode




Extract HTTP Passwords in POST Requests


tcpdump -s 0 -A -n -l | egrep -i "POST /|pwd=|passwd=|password=|Host:"
Enter fullscreen mode Exit fullscreen mode




Capture Cookies from Server and from Client


tcpdump -nn -A -s0 -l | egrep -i 'Set-Cookie|Host:|Cookie:'
Enter fullscreen mode Exit fullscreen mode




Capture all ICMP packets


tcpdump -n icmp
Enter fullscreen mode Exit fullscreen mode




Show ICMP Packets that are not ECHO/REPLY (standard ping)


tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
Enter fullscreen mode Exit fullscreen mode




Capture SMTP / POP3 Email


tcpdump -nn -l port 25 | grep -i 'MAIL FROM|RCPT TO'
Enter fullscreen mode Exit fullscreen mode




Troubleshooting NTP Query and Response


tcpdump dst port 123
Enter fullscreen mode Exit fullscreen mode




Capture FTP Credentials and Commands


tcpdump -nn -v port ftp or ftp-data
Enter fullscreen mode Exit fullscreen mode




Rotate Capture Files


tcpdump  -w /tmp/capture-%H.pcap -G 3600 -C 200
Enter fullscreen mode Exit fullscreen mode




Capture IPv6 Traffic


tcpdump -nn ip6 proto 6
Enter fullscreen mode Exit fullscreen mode




IPv6 with UDP and reading from a previously saved capture file.


tcpdump -nr ipv6-test.pcap ip6 proto 17
Enter fullscreen mode Exit fullscreen mode




Detect Port Scan in Network Traffic


tcpdump -nn
Enter fullscreen mode Exit fullscreen mode




USAGE EXAMPLE

Example Filter Showing Nmap NSE Script Testing

  • On Target:

    nmap -p 80 --script=http-enum.nse targetip

  • On Server:

    tcpdump -nn port 80 | grep "GET /"

       GET /w3perl/ HTTP/1.1
   GET /w-agora/ HTTP/1.1
   GET /way-board/ HTTP/1.1
   GET /web800fo/ HTTP/1.1
   GET /webaccess/ HTTP/1.1
   GET /webadmin/ HTTP/1.1
   GET /webAdmin/ HTTP/1.1

Capture Start and End Packets of every non-local host 

tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
Enter fullscreen mode Exit fullscreen mode




Capture DNS Request and Response

Filtering DNS with Tcpdump

tcpdump -i wlp58s0 -s0 port 53
Enter fullscreen mode Exit fullscreen mode




Capture HTTP data packets


tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
Enter fullscreen mode Exit fullscreen mode




Top Hosts by Packets


tcpdump -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20
Enter fullscreen mode Exit fullscreen mode




Capture all the plaintext passwords


tcpdump port http or port ftp or port smtp or port imap or port pop3 or port telnet -l -A | egrep -i -B5 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user '


tcpdump port http or port ftp or port smtp or port imap or port pop3 or port telnet -lA | egrep -i -B5 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd= |password=|pass:|user:|username:|password:|login:|pass |user '
Enter fullscreen mode Exit fullscreen mode




DHCP Example


tcpdump -v -n port 67 or 68
Enter fullscreen mode Exit fullscreen mode




Cleartext GET Requests


tcpdump -vvAls0 | grep 'GET'
Enter fullscreen mode Exit fullscreen mode




Find HTTP Host Headers


tcpdump -vvAls0 | grep 'Host:'
Enter fullscreen mode Exit fullscreen mode




Find HTTP Cookies


tcpdump -vvAls0 | grep 'Set-Cookie|Host:|Cookie:'
Enter fullscreen mode Exit fullscreen mode




Find SSH Connections


tcpdump 'tcp[(tcp[12]>>2):4] = 0x5353482D'
Enter fullscreen mode Exit fullscreen mode




Find DNS Traffic


tcpdump -vvAs0 port 53
Enter fullscreen mode Exit fullscreen mode




Find FTP Traffic


tcpdump -vvAs0 port ftp or ftp-data
Enter fullscreen mode Exit fullscreen mode




Find NTP Traffic


tcpdump -vvAs0 port 123
Enter fullscreen mode Exit fullscreen mode




Capture SMTP / POP3 Email


tcpdump -nn -l port 25 | grep -i 'MAIL FROM|RCPT TO'
Enter fullscreen mode Exit fullscreen mode




Line Buffered Mode


tcpdump -i eth0 -s0 -l port 80 | grep 'Server:'
Enter fullscreen mode Exit fullscreen mode




Find traffic with evil bit


tcpdump 'ip[6] & 128 != 0'
Enter fullscreen mode Exit fullscreen mode




Filter on protocol (ICMP) and protocol-specific fields (ICMP type)

Tcpdump: Filter Packets with Tcp Flags

tcpdump -n icmp and 'icmp[0] != 8 and icmp[0] != 0'

Same command can be used with predefined header field offset (icmptype) and ICMP type field values (icmp-echo and icmp-echoreply): 

tcpdump -n icmp and icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply
Enter fullscreen mode Exit fullscreen mode




Filter on TOS field


tcpdump -v -n ip and ip[1]!=0
Enter fullscreen mode Exit fullscreen mode




Filter on TTL field


tcpdump -v ip and 'ip[8]<2'
Enter fullscreen mode Exit fullscreen mode




Filter on TCP flags (SYN/ACK)


tcpdump -n tcp and port 80 and 'tcp[tcpflags] & tcp-syn == tcp-syn'
Enter fullscreen mode Exit fullscreen mode




In the example above, all packets with TCP SYN flag set are captured. Other flags (ACK, for example) might be set also. Packets which have only TCP SYN flags set, can be captured


tcpdump tcp and port 80 and 'tcp[tcpflags] == tcp-syn'
Enter fullscreen mode Exit fullscreen mode




Catch TCP SYN/ACK packets (typically, responses from servers):


tcpdump -n tcp and 'tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)'

tcpdump -n tcp and 'tcp[tcpflags] & tcp-syn == tcp-syn' and 'tcp[tcpflags] & tcp-ack == tcp-ack'
Enter fullscreen mode Exit fullscreen mode




Catch ARP packets


tcpdump -vv -e -nn ether proto 0x0806
Enter fullscreen mode Exit fullscreen mode




Filter on IP packet length


tcpdump -l icmp and '(ip[2:2]>50)' -w - |tcpdump -r - -v ip and '(ip[2:2]<60)'
Enter fullscreen mode Exit fullscreen mode




Remark: due to some bug in tcpdump, the following command doesn't catch packets as expected:


tcpdump -v -n icmp and '(ip[2:2]>50)' and '(ip[2:2]<60)'
Enter fullscreen mode Exit fullscreen mode




Filter on encapsulated content (ICMP within PPPoE)


tcpdump -v -n icmp
Enter fullscreen mode Exit fullscreen mode




Queiter


tcpdump -q -i eth0

tcpdump -t -i eth0

tcpdump -A -n -q -i eth0 'port 80'

tcpdump -A -n -q -t -i eth0 'port 80'
Enter fullscreen mode Exit fullscreen mode




Print only useful packets from the HTTP traffic


tcpdump -A -s 0 -q -t -i eth0 'port 80 and ( ((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12:2]&0xf0)>>2)) != 0)'
Enter fullscreen mode Exit fullscreen mode




Dump SIP Traffic


tcpdump -nq -s 0 -A -vvv port 5060 and host 1.2.3.4
Enter fullscreen mode Exit fullscreen mode




Checking packet content


tcpdump -i any -c10 -nn -A port 80
Enter fullscreen mode Exit fullscreen mode




Checking packet content


sudo tcpdump -i any -c10 -nn -A port 80
Enter fullscreen mode Exit fullscreen mode




References & Awesome wikis

Capture ICMP Packets With Tcpdump

Debugging SSH Packets with Tcpdump

Using Tcpdump to Filter DNS Packets

Learn tcpdump Quick Guide

Filtering DNS with Tcpdump

Filtering CDP LLDP packets with Tcpdump

Tcpdump Cheat Sheet (Basic Advanced Examples)

tcp flags

END!

Top comments (0)

Read next

cartatravis profile image

Revolutionizing E-commerce: The Impact of Payment Gateways

Travis -

kevintse756 profile image

AI is Shaking Up the TV and Broadcasting World - In a Big Way

kevintse756 -

rutamstwt profile image

LLM Red Teaming: Assessment of an LLM-based Chatbot

Rutam Bhagat -

ntptechstore profile image

Logitech Signature M650 L Full Size Wireless Mouse

NTPtechstore -