GO KALI FREE
BeginnerTools

Tcpdump Guide: Command-Line Packet Capture

Learn Tcpdump for command-line network packet capture and analysis with practical filters, output options, and security monitoring examples.

#tcpdump#packet capture#network analysis#packet filtering#network monitoring

Why You Need Tcpdump

You need to see network traffic in real time from the command line — Tcpdump captures packets on any interface and displays or saves them for analysis. It uses BPF filter syntax for precise traffic selection and runs in environments where a GUI is unavailable.

Prerequisites

  • Basic understanding of TCP/IP networking
  • Familiarity with the Linux command line
  • Root/administrator access for packet capture

    • Installation

    # Already installed on Kali
sudo apt install tcpdump  # Other Debian-based systems

    Basic Usage

    sudo tcpdump -i eth0
sudo tcpdump -i eth0 -c 100
sudo tcpdump -i eth0 -w capture.pcap
tcpdump -r capture.pcap

    Essential Options

    | Option | Description |

    |--------|-------------|

    | -i INTERFACE | Network interface |

    | -c COUNT | Stop after COUNT packets |

    | -w FILE | Write to file |

    | -r FILE | Read from file |

    | -n | No hostname resolution |

    | -nn | No hostname or port resolution |

    | -v | Verbose output |

    | -X | Hex and ASCII output |

    | -A | ASCII output |

    BPF Filter Expressions

    # Host filters
sudo tcpdump -i eth0 host 192.168.1.100
sudo tcpdump -i eth0 src host 10.0.0.1

# Port filters
sudo tcpdump -i eth0 port 80
sudo tcpdump -i eth0 portrange 8000-8100

# Protocol filters
sudo tcpdump -i eth0 tcp
sudo tcpdump -i eth0 udp icmp arp

# Combined
sudo tcpdump -i eth0 tcp and port 80
sudo tcpdump -i eth0 not arp and not icmp

    Reading Output

    22:15:30.123456 IP 192.168.1.100.54321 > 93.184.216.34.80: Flags [S], seq 123456789, win 65535, length 0

    Flags: [S] = SYN, [S.] = SYN-ACK, [.] = ACK, [P] = PUSH, [F] = FIN, [R] = RST.

    Common Mistakes

    Capturing on wrong interface. Not using -nn causes slow DNS resolution. Capturing without filters generates huge files.

    Best Practices

    Always use filters. Save captures first, analyze later. Use -nn for performance. Combine with Wireshark for deep analysis.

    Related Tools

  • **Wireshark/TShark**: GUI and CLI protocol analyzers
  • **Ngrep**: Grep for network packets
  • **Nmap**: Network discovery

    • Related Articles

  • [Wireshark Guide](/articles/wireshark-guide)
  • [Networking Basics](/articles/networking-basics)
  • [Nmap Beginner Tutorial](/articles/nmap-beginner-tutorial)

    • Summary

    Tcpdump is the standard command-line packet capture tool. Key techniques include BPF filters, saving to files, and understanding output format.

    Knowledge Check

  • What does `-nn` do?
  • How do you filter for HTTP traffic?
  • What do [S], [S.], [.] represent?
  • What is the difference between `-w` and `-r`?
  • Why use BPF filters on busy networks?

    • Frequently Asked Questions

    What is tcpdump?

    tcpdump is a command-line packet capture tool that uses libpcap to intercept and display network traffic. It supports BPF (Berkeley Packet Filter) syntax for precise filtering and is pre-installed on Kali Linux.

    Why do I need root to run tcpdump?

    Capturing raw network packets requires access to the network interface at the data link layer, which needs root privileges. Run `sudo tcpdump` or add capabilities with `setcap cap_net_raw+ep /usr/bin/tcpdump` for non-root capture.

    What does the -nn flag do?

    The `-nn` flag disables both hostname and port number resolution. Without it, tcpdump performs DNS lookups for every IP and resolves port numbers to service names, which slows capture significantly on busy networks.

    How do you filter HTTP traffic with tcpdump?

    Use `sudo tcpdump -i eth0 port 80` to capture HTTP traffic. For more precision, combine with protocol filters: `tcpdump -i eth0 tcp and port 80`. For HTTPS, filter port 443 instead since the HTTP layer is encrypted.

    What do the TCP flags [S], [S.], [.] mean?

    [S] is a SYN (connection start), [S.] is SYN-ACK (acknowledgment of SYN), [.] is ACK (acknowledgment), [P] is PSH (data push), [F] is FIN (connection close), and [R] is RST (connection reset). These flags reveal the TCP handshake state.

    What is the difference between -w and -r?

    The `-w` flag writes captured packets to a file in pcap format (e.g., `tcpdump -w capture.pcap`), while `-r` reads a pcap file for display or analysis (e.g., `tcpdump -r capture.pcap`). Saving to files preserves full packet data.

    Why use BPF filters on busy networks?

    Unfiltered captures on busy networks generate massive files and include irrelevant traffic. BPF filters like `host 10.0.0.5 and port 445` capture only traffic matching specific IPs, ports, or protocols, keeping capture files manageable.

    How do you capture and save packets to a file?

    Use `sudo tcpdump -i eth0 -w output.pcap -c 1000` to capture 1000 packets and save them. The pcap file can then be opened in Wireshark for detailed protocol analysis or read back with `tcpdump -r output.pcap`.

    What is the difference between tcpdump and Wireshark?

    tcpdump is a command-line tool ideal for remote servers, automated monitoring, and headless environments. Wireshark provides a graphical interface with protocol dissection, stream following, and statistics. Use tcpdump for capture, Wireshark for analysis.

    How do you capture traffic on a specific interface?

    Use `sudo tcpdump -i eth0` to capture on a specific interface. Run `tcpdump -D` to list available interfaces, or use `-i any` to capture on all interfaces simultaneously, which is useful for initial discovery.