GO KALI FREE

tcpdump

Sniffing & Spoofing

Intermediatelow risk

tcpdump is a powerful, lightweight command-line packet analyzer that allows users to capture, parse, and filter TCP/IP and other packets transmitted or received over a network.

Installation

sudo apt install tcpdump

Basic Syntax

tcpdump [options] [expression]

Quick Facts

Full Name
tcpdump
License
BSD
Written In
C
Platforms
Linux, macOS, BSD, Windows
Category
Packet Analysis
Filter Type
BPF (Berkeley Packet Filter)
First Release
1997
Developer
The Tcpdump Group

Tool Overview

tcpdump is the most widely used command-line packet analyzer on Unix and Linux systems. It captures packets from network interfaces in real-time, displaying packet headers and optionally payload data according to BPF (Berkeley Packet Filter) expressions.

Developed by the Tcpdump Group, tcpdump has been the standard CLI tool for network troubleshooting and security analysis since 1997. Its minimal resource footprint makes it ideal for remote captures, embedded systems, and scripting integration.

tcpdump's BPF filter language is powerful and expressive, allowing precise traffic selection based on protocol, host, port, packet size, and even specific header field values. Captured packets can be saved as PCAP files for offline analysis with tools like Wireshark.

Common Commands

sudo tcpdump -i eth0Interface capture - Listen live to all packets traveling over the eth0 interface
sudo tcpdump -i eth0 -w capture.pcapWrite to file - Save intercepted traffic data in raw PCAP format for external analysis
sudo tcpdump -r capture.pcapRead capture - Open and parse a previously recorded network capture file locally
sudo tcpdump -i eth0 port 80Port filter - Isolate and capture incoming/outgoing HTTP web traffic data exclusively
sudo tcpdump -i eth0 host 192.168.1.100Host filter - Target and log traffic originating from or directing to a specific IP address
sudo tcpdump -i eth0 -AASCII representation - Output packet payloads explicitly in a human-readable text format
sudo tcpdump -i eth0 -XXHex & ASCII - Render packet details showcasing both Hexadecimal and ASCII translation grids
sudo tcpdump -i eth0 src 192.168.1.50 and dst port 22Complex logic - Filter for traffic explicitly matching both source IP and destination port criteria
sudo tcpdump -i eth0 -c 100Count limit - Automatically terminate packet collection after capturing exactly 100 frames
sudo tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'Advanced flags - Intercept only raw connection setup (SYN) initialization packets
sudo tcpdump -i any -n -s 0All interfaces - Capture full-length packets across every interface
sudo tcpdump -i eth0 -G 3600 -w 'trace-%H%M.pcap'Time rotation - Start a new capture file every hour
sudo tcpdump -i eth0 -vvv -eVerbose + link - Show full detail including Ethernet MAC headers
sudo tcpdump -i eth0 'udp port 53'DNS capture - Isolate DNS query and response traffic
sudo tcpdump -i eth0 'icmp'ICMP only - Capture ping and other ICMP control messages

Step-by-Step Guide

  1. 1Verify the name of the network adapter you want to listen on
  2. 2Decide if you want to see the output live or save it for later
  3. 3Utilize specific filters to ignore irrelevant background noise
  4. 4Run the application with administrative permissions
  5. 5Interrupt the program to conclude the capture and assess the volume

Warnings

Use Cases

Real-Time Traffic Monitoring

Monitor live network traffic with custom BPF filters for specific protocols or hosts.

Network Troubleshooting

Diagnose connectivity issues by examining packet exchanges between hosts.

Security Forensics

Capture and save network traffic as evidence for security incident investigations.

Protocol Analysis

Examine protocol behavior at the packet level to understand implementation details.

PCAP Creation

Save captured packets to PCAP files for offline analysis with Wireshark or other tools.

Bandwidth Monitoring

Analyze traffic volumes and patterns to identify bandwidth usage and anomalies.

Related Tools

Wireshark

Sniffing & Spoofing

GUI-based network protocol analyzer with protocol dissection, coloring, and interactive analysis.

TShark

Sniffing & Spoofing

CLI version of Wireshark with same protocol dissection but terminal-based output.

Bettercap

Sniffing & Spoofing

Network attack and monitoring framework with built-in packet sniffing.

Ettercap

Sniffing & Spoofing

MITM framework with ARP spoofing, DNS spoofing, and content filtering.

ngrep

Sniffing & Spoofing

Network grep utility that applies regular expressions to packet payloads.

Frequently Asked Questions

What is tcpdump used for?

tcpdump is a command-line packet analyzer for capturing and displaying network traffic in real-time or from saved PCAP files. It is used for network troubleshooting, security analysis, protocol debugging, and traffic monitoring.

How is tcpdump different from Wireshark?

tcpdump is a CLI tool with minimal overhead, ideal for remote captures and scripting. Wireshark provides a GUI with protocol dissection, color coding, and interactive analysis. They complement each other — capture with tcpdump, analyze with Wireshark.

Do I need root to use tcpdump?

Yes, tcpdump requires root or sudo privileges to capture packets from network interfaces. However, saved PCAP files can be read without privileges.

Can tcpdump capture all network traffic?

tcpdump captures packets visible to the network interface. On switched networks, it only sees broadcast traffic and traffic addressed to your MAC address unless you use ARP spoofing or port mirroring.

What are BPF filters in tcpdump?

BPF (Berkeley Packet Filter) expressions let you specify which packets to capture based on host, port, protocol, or packet properties. For example, 'port 80' captures only HTTP traffic.

How do I save captured packets to a file?

Use the -w flag: tcpdump -i eth0 -w capture.pcap saves all packets to a PCAP file. Use -C to rotate files by size and -W to limit the number of rotated files.

Can I analyze a saved PCAP file with tcpdump?

Yes, use tcpdump -r filename.pcap to read and display packets from a saved file. You can combine -r with BPF filters to analyze specific traffic within the capture.

Is tcpdump useful for network debugging?

Yes, tcpdump is invaluable for diagnosing connectivity issues, verifying DNS resolution, checking TCP handshake behavior, and troubleshooting application-level protocol problems at the packet level.

How does tcpdump analyze protocols?

tcpdump decodes packet headers based on protocol type, displaying source/destination IPs, ports, flags, and sequence numbers. Use -A for ASCII payload or -X for hex and ASCII output.

Can tcpdump capture traffic on a remote machine?

Yes, run tcpdump over SSH: ssh user@remote 'tcpdump -i eth0 -w -' | wireshark -k -i -. This captures traffic on a remote server and streams it to your local Wireshark for analysis.

Tags

#sniffing-spoofing#packet-analysis#network-traffic

Output Explanation

Prints a chronological list of packet summaries, detailing the source, destination, protocol, and optionally the internal data payload.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.