LFCE 95 🐧 tcpdump — Filters and Advanced Use - KandZ

⏱️ Estimated read: 13 min | |

The previous chapter covered the fundamentals: the options, the basic filter primitives, and the output formats. This chapter covers the filters and techniques that turn tcpdump from a packet printer into a diagnostic instrument. The BPF filter language can match the specific fields inside the packet—the TCP flags, the ICMP type, the packet length, the byte offsets—and the advanced options control the capture rotation, the timestamps, the link-layer headers, and the output verbosity. The LFCE exam expects the candidate to monitor and troubleshoot network performance, and the advanced filters are the mechanism that isolates the specific failure, such as the connection attempt that never completes or the ICMP unreachable that follows.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The filter syntax is the same BPF that the kernel uses, and it is evaluated before the packet is copied to the userspace. The tcp[tcpflags] expression reads the TCP flags byte, and the & operator masks the bits that are relevant. The icmp[icmptype] expression reads the ICMP type byte, and the greater and less primitives match the packet length. The -e option prints the link-layer header, and the -tttt option prints the human-readable timestamp. The -C and -G options rotate the capture files, and the -Z option drops the root privileges after the capture starts.

Key point: The BPF filter is evaluated in the kernel, and the and, or, and not operators combine the primitives. The tcp[tcpflags] & tcp-syn != 0 expression matches the packets with the SYN flag set, and the tcp[tcpflags] & (tcp-rst|tcp-fin) != 0 expression matches the connection termination. The -s 0 option captures the full packet, and the default snaplen of 262,144 bytes is usually sufficient. The -Z tcpdump option drops the root privileges after the capture starts, which is the security best practice.

Why advanced filters require understanding the BPF syntax

The byte-offset problem.

The BPF syntax allows the filter to read the specific bytes in the packet, such as the TCP flags and the ICMP type. The tcp[tcpflags] is a named offset for the flags byte, and the icmp[icmptype] is a named offset for the ICMP type . The & operator masks the bits, and the != 0 comparison checks whether any of the masked bits are set. The tcp[tcpflags] & tcp-syn != 0 matches the SYN packets, and the tcp[tcpflags] & (tcp-rst|tcp-fin) != 0 matches the RST or FIN packets.

The shell-quoting problem.

The filter expression contains the parentheses, the brackets, and the & operator, which the shell interprets as its own syntax. The tcpdump 'tcp[tcpflags] & tcp-syn != 0' form quotes the entire expression, and the shell passes it to tcpdump as a single argument . The unquoted form tcpdump tcp[tcpflags] & tcp-syn != 0 is interpreted by the shell, and the filter is not what the administrator intended. The quotes are mandatory for the compound expressions.

The privilege-drop problem.

The tcpdump runs as root to open the capture device, but it does not need the root privileges after the device is open. The -Z tcpdump option drops the privileges to the tcpdump user after the capture starts, which limits the damage if the tcpdump binary is compromised . The option is enabled by default in the recent versions, and the -Z root disables it. The privilege drop is the security best practice for the production captures.

a. The TCP flags and the ICMP type filters

The TCP flags filter matches the specific connection events, and the ICMP type filter matches the specific ICMP messages.

# SYN packets (connection attempts)
sudo tcpdump -nn 'tcp[tcpflags] & tcp-syn != 0'

# SYN-ACK packets (the server's response)
sudo tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)'

# RST packets (connection reset)
sudo tcpdump -nn 'tcp[tcpflags] & tcp-rst != 0'

# FIN packets (connection close)
sudo tcpdump -nn 'tcp[tcpflags] & tcp-fin != 0'

# RST or FIN (connection termination)
sudo tcpdump -nn 'tcp[tcpflags] & (tcp-rst|tcp-fin) != 0'

# ICMP echo requests (pings)
sudo tcpdump -nn 'icmp[icmptype] = icmp-echo'

# ICMP destination unreachable
sudo tcpdump -nn 'icmp[icmptype] = icmp-unreach'

The tcp[tcpflags] & tcp-syn != 0 matches the SYN packets, which are the connection attempts . The tcp[tcpflags] & (tcp-syn|tcp-ack) == (tcp-syn|tcp-ack) matches the SYN-ACK packets, which are the server’s responses. The tcp[tcpflags] & (tcp-rst|tcp-fin) != 0 matches the connection terminations, and the icmp[icmptype] = icmp-echo matches the ping requests . The icmp-unreach matches the ICMP destination unreachable messages, which are the router’s or the host’s reports that the destination is not reachable.

The TCP flags filter can also exclude the specific flags.

# HTTP packets that contain data (not SYN, FIN, or ACK-only)
sudo tcpdump -nn 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

The ip[2:2] reads the IP total length, the ip[0]&0xf extracts the IP header length, and the tcp[12]&0xf0 extracts the TCP data offset. The expression computes the payload length and checks whether it is non-zero . The filter isolates the HTTP packets that carry data, excluding the SYN, FIN, and ACK-only packets.

b. The packet length and the byte-offset filters

The greater and less primitives match the packet length, and the ip[2:2] reads the IP total length.

# Packets 1000 bytes or larger
sudo tcpdump -nn 'greater 1000'

# Packets 100 bytes or smaller
sudo tcpdump -nn 'less 100'

# IP packets longer than 576 bytes
sudo tcpdump -nn 'ip[2:2] > 576'

# IP broadcast or multicast packets not sent via Ethernet broadcast
sudo tcpdump -nn 'ether[0] & 1 = 0 and ip[16] >= 224'

The greater 1000 matches the packets of 1000 bytes or more, and the less 100 matches the packets of 100 bytes or less . The ip[2:2] > 576 reads the IP total length and matches the packets longer than 576 bytes. The ether[0] & 1 = 0 checks the Ethernet destination address’s first byte, and the ip[16] >= 224 checks the IP destination address’s first byte for the multicast range . The filter isolates the broadcast or multicast packets that were not sent via the Ethernet broadcast.

The MAC address filter matches the specific host on the local link.

# Traffic to or from a MAC address
sudo tcpdump -nn 'ether host 00:1A:2B:3C:4D:5E'

# Traffic on a specific VLAN
sudo tcpdump -nn 'vlan 100'

The ether host matches the MAC address, and the vlan 100 matches the VLAN tag . The MAC address filter is useful when the IP address is not yet assigned, such as during the DHCP exchange.

c. The capture rotation and the output options

The -C and -G options rotate the capture files, and the -Z option drops the privileges.

# Rotate the capture files every 10 MB
sudo tcpdump -i eth0 -nn -w capture.pcap -C 10

# Rotate the capture files every 60 seconds
sudo tcpdump -i eth0 -nn -w capture.pcap -G 60

# Limit the number of rotated files
sudo tcpdump -i eth0 -nn -w capture.pcap -C 10 -W 5

# Drop the privileges after the capture starts
sudo tcpdump -i eth0 -nn -Z tcpdump

The -C 10 rotates the file when it reaches 10 MB, and the -G 60 rotates it every 60 seconds . The -W 5 limits the number of the rotated files to five, and the oldest file is overwritten when the limit is reached . The -Z tcpdump drops the privileges to the tcpdump user, which is the security best practice.

The -e option prints the link-layer header, and the -tttt option prints the human-readable timestamp.

# Print the link-layer header
sudo tcpdump -i eth0 -nn -e

# Print the human-readable timestamp
sudo tcpdump -i eth0 -nn -tttt

# Print the absolute TCP sequence numbers
sudo tcpdump -i eth0 -nn -S

The -e prints the source and destination MAC addresses and the EtherType, and the -tttt prints the timestamp as 2025-01-15 10:30:45.123456 . The -S prints the absolute sequence numbers instead of the relative ones, which is useful for the TCP analysis.

The -v option increases the verbosity, and the -vv and -vvv add more detail.

# Verbose output with the TTL and the checksum
sudo tcpdump -i eth0 -nn -v

# More verbose output
sudo tcpdump -i eth0 -nn -vv

The -v prints the TTL, the identification, the total length, and the options, and it verifies the IP and ICMP header checksums . The -vv adds the NFS reply fields and the SMB decoding, and the -vvv adds the Telnet options.

Complete Example Session

# ============================================
# PART 1: CAPTURE THE SYN PACKETS
# ============================================
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0'

# ============================================
# PART 2: CAPTURE THE RST PACKETS
# ============================================
sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-rst != 0'

# ============================================
# PART 3: CAPTURE THE ICMP UNREACHABLE
# ============================================
sudo tcpdump -i eth0 -nn 'icmp[icmptype] = icmp-unreach'

# ============================================
# PART 4: CAPTURE THE LARGE PACKETS
# ============================================
sudo tcpdump -i eth0 -nn 'greater 1000'

# ============================================
# PART 5: CAPTURE THE HTTP DATA PACKETS
# ============================================
sudo tcpdump -i eth0 -nn 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# ============================================
# PART 6: CAPTURE WITH THE LINK-LAYER HEADER
# ============================================
sudo tcpdump -i eth0 -nn -e

# ============================================
# PART 7: CAPTURE WITH THE HUMAN-READABLE TIMESTAMP
# ============================================
sudo tcpdump -i eth0 -nn -tttt

# ============================================
# PART 8: ROTATE THE CAPTURE FILES
# ============================================
sudo tcpdump -i eth0 -nn -w capture.pcap -C 10 -W 5

# ============================================
# PART 9: DROP THE PRIVILEGES
# ============================================
sudo tcpdump -i eth0 -nn -Z tcpdump

# ============================================
# PART 10: CAPTURE THE MAC ADDRESS TRAFFIC
# ============================================
sudo tcpdump -i eth0 -nn 'ether host 00:1A:2B:3C:4D:5E'

The ten parts demonstrate the advanced tcpdump surface: the SYN packets, the RST packets, the ICMP unreachable, the large packets, the HTTP data packets, the link-layer header, the human-readable timestamp, the file rotation, the privilege drop, and the MAC address filter. The critical filter is Part 5: the payload-length expression isolates the HTTP packets that carry data, which is the mechanism for the application-layer analysis.

Quick Reference

TCP Flags Filters

Filter	Matches
`tcp[tcpflags] & tcp-syn != 0`	SYN packets
`tcp[tcpflags] & (tcp-syn\|tcp-ack) == (tcp-syn\|tcp-ack)`	SYN-ACK packets
`tcp[tcpflags] & tcp-rst != 0`	RST packets
`tcp[tcpflags] & tcp-fin != 0`	FIN packets
`tcp[tcpflags] & (tcp-rst\|tcp-fin) != 0`	RST or FIN

ICMP Filters

Filter	Matches
`icmp[icmptype] = icmp-echo`	Ping requests
`icmp[icmptype] = icmp-unreach`	Destination unreachable
`icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply`	Not ping

Packet Length Filters

Filter	Matches
`greater 1000`	Packets ≥ 1000 bytes
`less 100`	Packets ≤ 100 bytes
`ip[2:2] > 576`	IP packets > 576 bytes

Output Options

Option	Purpose
`-e`	Print the link-layer header
`-tttt`	Human-readable timestamp
`-S`	Absolute TCP sequence numbers
`-v` / `-vv` / `-vvv`	Verbosity levels
`-C <MB>`	Rotate the file at the size
`-G <sec>`	Rotate the file at the interval
`-W <n>`	Limit the rotated files
`-Z <user>`	Drop the privileges

Best Practices

✅ Do This:

# Quote the compound filter
sudo tcpdump -nn 'tcp[tcpflags] & tcp-syn != 0'                # ✅

# Use the payload-length expression for the HTTP data
sudo tcpdump -nn 'tcp port 80 and (((ip[2:2] - ...)) != 0)'    # ✅

# Rotate the capture files for the long captures
sudo tcpdump -w capture.pcap -C 10 -W 5                        # ✅

# Drop the privileges after the capture starts
sudo tcpdump -Z tcpdump                                        # ✅

# Use -e for the MAC address analysis
sudo tcpdump -e                                                # ✅

# Use -tttt for the human-readable timestamps
sudo tcpdump -tttt                                             # ✅

❌ Don’t Do This:

# Forget the quotes around the compound filter
sudo tcpdump tcp[tcpflags] & tcp-syn != 0    # Shell interprets  # ❌

# Use the unfiltered capture on the busy interface
sudo tcpdump -i eth0    # Overwhelming output                 # ❌

# Run tcpdump as root without the privilege drop
sudo tcpdump -Z root    # No privilege drop                    # ❌

# Capture the full packet on the high-traffic link
# The default snaplen is usually sufficient                     # ❌

# Use the relative sequence numbers for the TCP analysis
# Use -S for the absolute numbers                               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Filter syntax error	Unquoted parentheses and brackets	Quote the entire expression
Capture misses the payload	Default snaplen too small	Use `-s 0` for the full packet
The file grows unbounded	No rotation	Use `-C` and `-W`
The MAC address is not shown	No `-e`	Add `-e`
The timestamp is not readable	Default is the relative time	Use `-tttt`

Real-World Examples

1. SYN packets

sudo tcpdump -nn 'tcp[tcpflags] & tcp-syn != 0'

2. RST packets

sudo tcpdump -nn 'tcp[tcpflags] & tcp-rst != 0'

3. ICMP unreachable

sudo tcpdump -nn 'icmp[icmptype] = icmp-unreach'

4. Large packets

sudo tcpdump -nn 'greater 1000'

5. HTTP data packets

sudo tcpdump -nn 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

6. Link-layer header

sudo tcpdump -nn -e

7. Human-readable timestamp

sudo tcpdump -nn -tttt

8. File rotation

sudo tcpdump -w capture.pcap -C 10 -W 5

9. Privilege drop

sudo tcpdump -Z tcpdump

10. MAC address filter

sudo tcpdump -nn 'ether host 00:1A:2B:3C:4D:5E'

Visual

The BPF Byte Offsets

┌──────────────────────────────────────────────────────────────┐
│  THE FILTER READS THE SPECIFIC BYTES IN THE PACKET            │
│                                                              │
│  Ethernet header                                             │
│  ├── Destination MAC (6 bytes)                               │
│  ├── Source MAC (6 bytes)                                    │
│  └── EtherType (2 bytes)                                     │
│                                                              │
│  IP header                                                   │
│  ├── Version/IHL (1 byte)    ← ip[0]                         │
│  ├── ...                                                     │
│  ├── Total Length (2 bytes)  ← ip[2:2]                       │
│  └── ...                                                     │
│                                                              │
│  TCP header                                                  │
│  ├── ...                                                     │
│  ├── Flags (1 byte)          ← tcp[tcpflags]                 │
│  └── Data Offset (4 bits)    ← tcp[12]&0xf0                  │
│                                                              │
│  The expressions read these offsets and compare the values.   │
└──────────────────────────────────────────────────────────────┘

The TCP Flags

┌──────────────────────────────────────────────────────────────┐
│  THE FLAGS BYTE IS A BITMASK                                 │
│                                                              │
│  ┌─────┬─────┬─────┬─────┬─────┬─────┬─────┬─────┐           │
│  │ CWR │ ECE │ URG │ ACK │ PSH │ RST │ SYN │ FIN │           │
│  └─────┴─────┴─────┴─────┴─────┴─────┴─────┴─────┘           │
│                                                              │
│  tcp-syn = 0x02                                              │
│  tcp-ack = 0x10                                              │
│  tcp-rst = 0x04                                              │
│  tcp-fin = 0x01                                              │
│                                                              │
│  tcp[tcpflags] & tcp-syn != 0 → the SYN bit is set           │
│  tcp[tcpflags] & (tcp-rst|tcp-fin) != 0 → RST or FIN set     │
└──────────────────────────────────────────────────────────────┘

The Capture Rotation

┌──────────────────────────────────────────────────────────────┐
│  -C AND -G ROTATE THE CAPTURE FILES                          │
│                                                              │
│  tcpdump -w capture.pcap -C 10 -W 5                          │
│       │                                                      │
│       ├── capture.pcap0  (10 MB)                             │
│       ├── capture.pcap1  (10 MB)                             │
│       ├── capture.pcap2  (10 MB)                             │
│       ├── capture.pcap3  (10 MB)                             │
│       └── capture.pcap4  (10 MB)                             │
│                                                              │
│  When the fifth file is full, the first is overwritten.      │
│  -G rotates by the time interval instead of the size.        │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
SYN filter	`tcp[tcpflags] & tcp-syn != 0`
RST filter	`tcp[tcpflags] & tcp-rst != 0`
FIN filter	`tcp[tcpflags] & tcp-fin != 0`
SYN-ACK filter	`tcp[tcpflags] & (tcp-syn\|tcp-ack) == (tcp-syn\|tcp-ack)`
ICMP echo	`icmp[icmptype] = icmp-echo`
ICMP unreachable	`icmp[icmptype] = icmp-unreach`
Large packets	`greater 1000`
IP length	`ip[2:2] > 576`
Link-layer header	`-e`
Human timestamp	`-tttt`
File rotation	`-C` and `-W`
Privilege drop	`-Z tcpdump`

Key takeaways:

The BPF filter can read the specific packet bytes. The tcp[tcpflags] reads the TCP flags byte, and the icmp[icmptype] reads the ICMP type byte. The & operator masks the bits, and the != 0 comparison checks whether the masked bits are set . The byte offsets are the mechanism that isolates the specific protocol events.
The compound filters must be quoted. The parentheses, brackets, and & are the shell metacharacters, and the unquoted expression is interpreted by the shell instead of being passed to tcpdump. The single quotes around the entire expression are mandatory .
The TCP flags filters isolate the connection events. The tcp[tcpflags] & tcp-syn != 0 matches the connection attempts, and the tcp[tcpflags] & (tcp-rst|tcp-fin) != 0 matches the connection terminations. The flags are the mechanism for the connection-level troubleshooting .
The payload-length expression isolates the HTTP data packets. The ip[2:2] and tcp[12]&0xf0 expressions compute the payload length, and the != 0 comparison excludes the SYN, FIN, and ACK-only packets. The filter is the mechanism for the application-layer analysis .
The -C and -W options rotate the capture files. The -C 10 rotates at 10 MB, and the -W 5 limits the number of the files to five. The rotation is the mechanism for the long captures that would otherwise fill the disk .
The -Z tcpdump option drops the privileges. The tcpdump runs as root to open the device, and it drops to the tcpdump user after the capture starts. The privilege drop is the security best practice for the production captures .
The -e and -tttt options control the output. The -e prints the link-layer header, and the -tttt prints the human-readable timestamp. The two options are the mechanism for the MAC address analysis and the log correlation .

Remember: tcpdump’s advanced filters are the BPF expressions that read the specific packet bytes. The tcp[tcpflags] and icmp[icmptype] are the named offsets, and the & and != are the operators. The compound filters must be quoted, and the -e and -tttt control the output. The -C and -W rotate the files, and the -Z drops the privileges. The result is a tool that can isolate the specific failure—the connection attempt, the reset, the unreachable, the large transfer—from the stream of the unrelated packets.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!