LFCE 94 🐧 tcpdump — Fundamentals - KandZ

⏱️ Estimated read: 13 min | |

tcpdump is the command-line packet analyzer that captures the traffic on a network interface and prints a summary of each packet. It is the tool that turns the abstract network into observable data: the TCP handshake, the DNS query, the HTTP request, the ICMP error. The previous chapters covered the firewall and the VPN, which control and encrypt the traffic; this chapter covers the tool that shows what the traffic actually is. The LFCE exam expects the candidate to monitor and troubleshoot network performance, and tcpdump is the first tool that an administrator reaches for when the connectivity fails and the logs are silent.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The capture is built from two parts: the options that control the capture, and the filter expression that selects the packets. The -i option specifies the interface, the -w option writes the packets to a file, and the -c option limits the number of packets. The filter expression is written in the Berkeley Packet Filter (BPF) syntax, which is the same syntax that the kernel uses to filter the packets at the socket level . The filter can match by host, by port, by protocol, and by the packet bytes, and the and, or, and not operators combine the primitives into the precise capture condition.

Key point: Without a filter, tcpdump captures every packet on the interface, which is gigabytes of unrelated traffic. The filter expression is the mechanism that reduces the capture to the packets that matter, and it is evaluated in the kernel, so the packets that do not match are never copied to the userspace . The -nn option disables the name resolution for the addresses and the ports, which is faster and avoids the DNS queries from the capture itself. The -w option writes the raw packets to a pcap file, and the -r option reads the file back for the offline analysis .

Why tcpdump requires the filter expression

The noise problem.

A busy interface carries the traffic from every process, every connection, and every protocol. The unfiltered tcpdump -i eth0 prints the continuous stream of the summaries, and the packet the administrator needs is lost in the noise. The filter expression is the mechanism that selects the specific traffic, and the BPF syntax is the language that expresses the selection . The host, port, net, and the protocol primitives are the building blocks, and the and, or, and not operators combine them.

The privilege problem.

The packet capture requires the raw socket access, which is restricted to the root or the process with the CAP_NET_RAW capability. The sudo tcpdump is the standard invocation, and the setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump command grants the capability to the binary, which allows the non-root users to capture . The privilege is the reason the capture is often the last resort, after the logs and the configuration have been checked.

The name-resolution problem.

The default tcpdump resolves the IP addresses to the hostnames and the port numbers to the service names. The resolution requires the DNS queries, which add the latency to the capture and generate the additional traffic. The -n option disables the hostname resolution, and the -nn option disables both the hostname and the service-name resolution . The -nn form is the recommended default for the troubleshooting, because the numeric output is unambiguous and the capture is faster.

a. The capture options

The options control the interface, the output, and the file. The -i option specifies the interface, the -c option limits the count, and the -w option writes the file.

# Capture on the eth0 interface
sudo tcpdump -i eth0

# Capture the first 10 packets
sudo tcpdump -i eth0 -c 10

# Write the packets to a file
sudo tcpdump -i eth0 -w capture.pcap

# Read the packets from the file
tcpdump -r capture.pcap

# Disable the name resolution and print the numeric output
sudo tcpdump -i eth0 -nn

The -i eth0 selects the interface, and the -i any captures on all the interfaces . The -c 10 stops after the ten packets, which is useful for the quick check. The -w capture.pcap writes the raw packets to the file, and the -r capture.pcap reads them back . The -nn disables the name resolution, and the numeric output shows the 192.168.1.50.443 form instead of the hostname.https form.

The -A and -X options control the payload output. The -A prints the payload as ASCII, which is useful for the HTTP traffic, and the -X prints the payload as hex and ASCII, which is useful for the binary protocols.

# Print the payload as ASCII
sudo tcpdump -i eth0 -A port 80

# Print the payload as hex and ASCII
sudo tcpdump -i eth0 -X port 80

The -A option is the quick way to read the HTTP request and the response, and the -X option is the way to inspect the binary payload.

b. The filter primitives

The filter expression is built from the primitives that match the host, the port, the network, and the protocol.

# Match the traffic to or from a host
sudo tcpdump -nn host 192.168.1.50

# Match the traffic from a host
sudo tcpdump -nn src 192.168.1.50

# Match the traffic to a host
sudo tcpdump -nn dst 8.8.8.8

# Match the traffic on a port
sudo tcpdump -nn port 80

# Match the traffic to a port
sudo tcpdump -nn dst port 443

# Match the traffic from a port
sudo tcpdump -nn src port 22

# Match a port range
sudo tcpdump -nn portrange 8000-9000

# Match a subnet
sudo tcpdump -nn net 192.168.1.0/24

# Match a protocol
sudo tcpdump -nn tcp
sudo tcpdump -nn udp
sudo tcpdump -nn icmp
sudo tcpdump -nn arp

The host primitive matches the source and the destination, and the src and dst restrict the match to one direction . The port primitive matches the source and the destination, and the portrange matches the range. The net primitive matches the subnet, and the protocol primitives match the specific protocol.

The and, or, and not operators combine the primitives.

# TCP traffic on port 80 or 443
sudo tcpdump -nn 'tcp and (port 80 or port 443)'

# Traffic from a host on port 22
sudo tcpdump -nn 'src 192.168.1.50 and port 22'

# All traffic except SSH
sudo tcpdump -nn 'not port 22'

# HTTP/HTTPS between two hosts
sudo tcpdump -nn 'host 192.168.1.100 and host 10.0.0.50 and (port 80 or port 443)'

The parentheses group the conditions, and the quotes prevent the shell from interpreting the and, or, and not as the shell operators. The not port 22 excludes the SSH traffic, which is useful when the capture is run over the SSH session.

c. The advanced filters and the TCP flags

The BPF syntax can match the specific fields in the packet, such as the TCP flags, the packet length, and the ICMP type.

# TCP SYN packets (connection attempts)
sudo tcpdump -nn 'tcp[tcpflags] & tcp-syn != 0'

# TCP RST or FIN packets (connection termination)
sudo tcpdump -nn 'tcp[tcpflags] & (tcp-rst|tcp-fin) != 0'

# ICMP echo requests (pings)
sudo tcpdump -nn 'icmp[icmptype] = icmp-echo'

# Packets 1000 bytes or larger
sudo tcpdump -nn 'greater 1000'

# Packets 100 bytes or smaller
sudo tcpdump -nn 'less 100'

# HTTP packets that contain data (not SYN, FIN, or ACK-only)
sudo tcpdump -nn 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

The tcp[tcpflags] & tcp-syn != 0 matches the packets with the SYN flag set, which are the connection attempts . The icmp[icmptype] = icmp-echo matches the ping requests. The greater 1000 and less 100 match the packet length, and the HTTP data filter excludes the SYN, FIN, and ACK-only packets . The advanced filters are the mechanism that isolates the specific events, such as the connection attempts, the pings, and the large transfers.

Complete Example Session

# ============================================
# PART 1: LIST THE INTERFACES
# ============================================
sudo tcpdump -D
# Output lists the available interfaces

# ============================================
# PART 2: CAPTURE THE HTTP TRAFFIC
# ============================================
sudo tcpdump -i eth0 -nn -A port 80
# Output shows the HTTP request and response in ASCII

# ============================================
# PART 3: CAPTURE THE DNS QUERIES
# ============================================
sudo tcpdump -i eth0 -nn port 53
# Output shows the DNS queries and responses

# ============================================
# PART 4: CAPTURE THE SSH CONNECTIONS
# ============================================
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0 and dst port 22'
# Output shows the SSH connection attempts

# ============================================
# PART 5: CAPTURE THE ICMP PINGS
# ============================================
sudo tcpdump -i eth0 -nn 'icmp[icmptype] = icmp-echo'
# Output shows the ping requests

# ============================================
# PART 6: WRITE THE CAPTURE TO A FILE
# ============================================
sudo tcpdump -i eth0 -nn -w /tmp/capture.pcap -c 100
# The packets are written to the file

# ============================================
# PART 7: READ THE CAPTURE FROM THE FILE
# ============================================
tcpdump -nn -r /tmp/capture.pcap
# Output shows the packets from the file

# ============================================
# PART 8: FILTER THE CAPTURE BY HOST
# ============================================
tcpdump -nn -r /tmp/capture.pcap 'host 192.168.1.50'
# Output shows only the packets for that host

# ============================================
# PART 9: EXCLUDE THE SSH TRAFFIC
# ============================================
sudo tcpdump -i eth0 -nn 'not port 22'
# The capture does not include the SSH session

# ============================================
# PART 10: CAPTURE THE LARGE PACKETS
# ============================================
sudo tcpdump -i eth0 -nn 'greater 1000'
# Output shows the packets 1000 bytes or larger

The ten parts demonstrate the tcpdump surface: the interface list, the HTTP capture, the DNS capture, the SSH connection attempts, the ICMP pings, the file write, the file read, the host filter, the SSH exclusion, and the large packets. The critical verification is Part 2: the -A option prints the HTTP payload, which is the mechanism that shows what the client requested and what the server returned.

Quick Reference

Capture Options

Option	Purpose
`-i <if>`	Interface (`any` for all)
`-c <n>`	Stop after n packets
`-w <file>`	Write to a pcap file
`-r <file>`	Read from a pcap file
`-nn`	Disable the name resolution
`-A`	Print the payload as ASCII
`-X`	Print the payload as hex and ASCII
`-v`	Verbose output

Filter Primitives

Primitive	Matches
`host <ip>`	Source or destination
`src <ip>`	Source
`dst <ip>`	Destination
`port <n>`	Source or destination port
`portrange <a-b>`	Port range
`net <cidr>`	Subnet
`tcp` / `udp` / `icmp` / `arp`	Protocol

Operators

Operator	Purpose
`and`	Both conditions
`or`	Either condition
`not`	Negation
`( )`	Grouping

Advanced Filters

Filter	Matches
`tcp[tcpflags] & tcp-syn != 0`	SYN packets
`tcp[tcpflags] & (tcp-rst\|tcp-fin) != 0`	RST or FIN
`icmp[icmptype] = icmp-echo`	Ping requests
`greater 1000`	Packets ≥ 1000 bytes
`less 100`	Packets ≤ 100 bytes

Best Practices

✅ Do This:

# Use -nn for the numeric output
sudo tcpdump -i eth0 -nn                                      # ✅

# Use the filter to reduce the noise
sudo tcpdump -i eth0 -nn port 80                              # ✅

# Write to a file for the offline analysis
sudo tcpdump -i eth0 -nn -w capture.pcap                      # ✅

# Use -A for the HTTP payload
sudo tcpdump -i eth0 -nn -A port 80                           # ✅

# Exclude the SSH traffic when the capture runs over SSH
sudo tcpdump -i eth0 -nn 'not port 22'                        # ✅

# Use the quotes around the compound filter
sudo tcpdump -i eth0 -nn 'tcp and (port 80 or port 443)'      # ✅

❌ Don’t Do This:

# Capture without a filter on a busy interface
sudo tcpdump -i eth0    # Overwhelming output                 # ❌

# Forget the quotes around the compound filter
sudo tcpdump -i eth0 tcp and port 80    # Shell interprets and # ❌

# Use the name resolution when the DNS is the problem
sudo tcpdump -i eth0    # Adds the DNS queries to the capture # ❌

# Write to the file without -nn
sudo tcpdump -i eth0 -w capture.pcap    # Slower capture       # ❌

# Use tcpdump when the pcap file is enough
# Use -r for the saved capture                                  # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Output is overwhelming	No filter	Add the filter expression
Shell interprets the filter	No quotes	Quote the compound filter
Capture is slow	Name resolution enabled	Use `-nn`
Cannot capture	No root or capability	`sudo` or `setcap`
The packet is truncated	Default snaplen	Use `-s 0` for the full packet

Real-World Examples

1. List the interfaces

sudo tcpdump -D

2. Capture the HTTP traffic

sudo tcpdump -i eth0 -nn -A port 80

3. Capture the DNS queries

sudo tcpdump -i eth0 -nn port 53

4. Capture the SYN packets

sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0'

5. Capture the pings

sudo tcpdump -i eth0 -nn 'icmp[icmptype] = icmp-echo'

6. Write to a file

sudo tcpdump -i eth0 -nn -w capture.pcap

7. Read from a file

tcpdump -nn -r capture.pcap

8. Filter by host

tcpdump -nn -r capture.pcap 'host 192.168.1.50'

9. Exclude SSH

sudo tcpdump -i eth0 -nn 'not port 22'

10. Capture the large packets

sudo tcpdump -i eth0 -nn 'greater 1000'

Visual

The Capture and the Filter

┌──────────────────────────────────────────────────────────────┐
│  THE FILTER RUNS IN THE KERNEL                               │
│                                                              │
│  Interface → kernel BPF filter → matching packets → tcpdump  │
│                                      │                       │
│                                      ▼                       │
│                              the summary is printed           │
│                                                              │
│  The packets that do not match are never copied to the       │
│  userspace, which is why the filter reduces the overhead.    │
└──────────────────────────────────────────────────────────────┘

The TCP Handshake in the Output

┌──────────────────────────────────────────────────────────────┐
│  THE TCP HANDSHAKE IS VISIBLE IN THE FLAGS                   │
│                                                              │
│  1. SYN:     Flags [S]                                       │
│  2. SYN-ACK: Flags [S.]                                      │
│  3. ACK:     Flags [.]                                       │
│                                                              │
│  The connection attempts are the SYN packets:                │
│  tcp[tcpflags] & tcp-syn != 0                                │
└──────────────────────────────────────────────────────────────┘

The File Write and Read

┌──────────────────────────────────────────────────────────────┐
│  CAPTURE TO A FILE, ANALYZE OFFLINE                          │
│                                                              │
│  tcpdump -w capture.pcap                                     │
│       │                                                      │
│       ▼                                                      │
│  the raw packets are written to the file                     │
│       │                                                      │
│       ▼                                                      │
│  tcpdump -r capture.pcap                                     │
│       │                                                      │
│       ▼                                                      │
│  the packets are analyzed without the live capture           │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Interface	`-i <if>` or `-i any`
Packet limit	`-c <n>`
Write	`-w <file>`
Read	`-r <file>`
Numeric output	`-nn`
Payload output	`-A` (ASCII), `-X` (hex)
Host filter	`host <ip>`, `src`, `dst`
Port filter	`port <n>`, `portrange`
Protocol filter	`tcp`, `udp`, `icmp`, `arp`
Combine	`and`, `or`, `not`
TCP flags	`tcp[tcpflags] & tcp-syn != 0`

Key takeaways:

The filter expression is the mechanism that reduces the capture to the packets that matter. Without it, the tcpdump captures every packet on the interface, and the output is overwhelming. The BPF syntax matches the host, the port, the network, the protocol, and the packet bytes, and the and, or, and not operators combine the primitives .
The filter runs in the kernel. The packets that do not match are never copied to the userspace, which is why the filtered capture is faster and lighter than the unfiltered one. The filter is the first optimization that the administrator should apply.
The -nn option disables the name resolution. The default tcpdump resolves the IP addresses and the port numbers, which adds the DNS queries to the capture and the latency to the output. The numeric output is unambiguous and faster.
The -w and -r options are the file write and read. The -w capture.pcap writes the raw packets to the file, and the -r capture.pcap reads them back. The file is the mechanism for the offline analysis and for the sharing the capture with the other tools, such as Wireshark .
The -A option prints the payload as ASCII. It is the quick way to read the HTTP request and the response, and the -X option is the way to inspect the binary payload as hex and ASCII .
The TCP flags filter isolates the connection events. The tcp[tcpflags] & tcp-syn != 0 matches the connection attempts, and the tcp[tcpflags] & (tcp-rst|tcp-fin) != 0 matches the connection terminations. The flags are the mechanism for the connection-level troubleshooting .

Remember: tcpdump is the packet analyzer. The -i selects the interface, the -nn disables the name resolution, and the -w writes the file. The filter expression selects the packets, and the BPF syntax matches the host, the port, the network, the protocol, and the packet bytes. The -A prints the payload as ASCII, and the TCP flags filter isolates the connection events. The result is a tool that turns the abstract network into the observable stream, and the filter is the mechanism that makes the stream readable.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!