SEC: tcpdump — Command-Line Packet Capture and Analysis | Amr Tarek

What is tcpdump?

tcpdump is a command-line packet analyzer for Unix-like systems, built on the libpcap library. Written in C and C++, it was released in the late 1980s or early 1990s and remains one of the most stable, fast, and widely used network capture tools available.

The libpcap library is the foundation for many other networking tools including Wireshark (which uses it under the hood). tcpdump was also ported to Windows as WinPcap and later Npcap.

Key strengths of tcpdump:

Extremely fast and lightweight
Available on virtually every Unix and Linux system by default
Highly scriptable and automatable
Outputs to standard .pcap files readable by Wireshark

Basic Syntax and Interface Selection

# Basic capture on a specific interface
tcpdump -i eth0

# Capture on all interfaces
tcpdump -i any

# Limit capture to a specific number of packets
tcpdump -i eth0 -c 100

# Avoid resolving hostnames (faster, avoids DNS lookups)
tcpdump -n -i eth0

# Avoid resolving both hostnames AND port names
tcpdump -nn -i eth0

Saving and Reading Capture Files

# Save captured packets to a .pcap file
tcpdump -i eth0 -w capture.pcap

# Read and analyze a saved .pcap file
tcpdump -r capture.pcap

# Combine: capture 500 packets and save
tcpdump -i eth0 -c 500 -w output.pcap

Verbosity and Detail Levels

# Additional detail (TTL, ID, length, options)
tcpdump -v -i eth0

# More detail
tcpdump -vv -i eth0

# Maximum detail
tcpdump -vvv -i eth0

Filtering Traffic

tcpdump's filtering system is one of its most powerful features. Filters are specified after the options and are evaluated against every captured packet.

Filtering by Host

# Filter by source host IP
tcpdump src host 192.168.1.10

# Filter by source host by name
tcpdump src host webserver.example.com

# Filter by destination host IP
tcpdump dst host 192.168.1.1

# Filter traffic to/from a specific host (either direction)
tcpdump host 192.168.1.10

Filtering by Port

# Any traffic on port 80
tcpdump port 80

# Traffic from a specific source port
tcpdump src port 443

# Traffic to a specific destination port
tcpdump dst port 22

Filtering by Protocol

# Capture only TCP traffic
tcpdump tcp

# Capture only UDP traffic
tcpdump udp

# Capture only ICMP (ping) traffic
tcpdump icmp

# Capture only IPv6
tcpdump ip6

# Capture ARP
tcpdump arp

Filtering by Packet Size

# Packets longer than 1000 bytes
tcpdump greater 1000

# Packets shorter than 64 bytes
tcpdump less 64

Logic Operators

Filters can be combined using boolean operators:

# AND: capture TCP traffic to/from 192.168.1.1
tcpdump host 192.168.1.1 and tcp

# OR: capture UDP or ICMP traffic
tcpdump udp or icmp

# NOT: capture everything except TCP
tcpdump not tcp

# Complex combination: HTTP traffic from a specific host
tcpdump src host 10.0.0.5 and dst port 80

# Capture SSH and HTTPS
tcpdump port 22 or port 443

Binary Operations on Packet Headers

tcpdump allows filtering based on specific bytes within protocol headers using the syntax proto[expr:size]:

proto — the protocol layer (arp, ether, icmp, ip, ip6, tcp, udp)
expr — byte offset from the start of the header (0 = first byte)
size — number of bytes to inspect (1, 2, or 4)

# Capture multicast Ethernet frames
# (First byte of Ethernet header AND 1 != 0)
tcpdump 'ether[0] & 1 != 0'

# Capture IP packets with options set
# (First byte of IP header AND 0xf != 5)
tcpdump 'ip[0] & 0xf != 5'

TCP Flag Filtering

Filtering by TCP flags is essential for detecting specific attack patterns like SYN floods:

# Capture packets with ONLY the SYN flag set
tcpdump "tcp[tcpflags] == tcp-syn"

# Capture packets with AT LEAST the SYN flag set
tcpdump "tcp[tcpflags] & tcp-syn != 0"

# Capture packets with SYN or ACK flags set
tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

# Capture FIN packets (connection teardown)
tcpdump "tcp[tcpflags] & tcp-fin != 0"

# Capture RST packets (connection reset)
tcpdump "tcp[tcpflags] & tcp-rst != 0"

Available TCP flags:

Flag	Name
`tcp-syn`	Synchronize — connection initiation
`tcp-ack`	Acknowledge — data receipt confirmation
`tcp-fin`	Finish — graceful connection close
`tcp-rst`	Reset — abrupt connection termination
`tcp-push`	Push — immediate data delivery

Display Options

tcpdump offers multiple output formats for different analysis needs:

# Quick/brief output
tcpdump -q -i eth0

# Print link-layer (Ethernet) header
tcpdump -e -i eth0

# Show packet data in ASCII
tcpdump -A -i eth0

# Show packet data in hexadecimal
tcpdump -xx -i eth0

# Show headers and data in both hex and ASCII
tcpdump -X -i eth0

Practical Security Use Cases

Detect SYN Flood Attack

# Monitor for high rate of SYN packets without ACK responses
tcpdump -nn "tcp[tcpflags] == tcp-syn" -i eth0

Capture Credentials on Cleartext Protocols

# Capture Telnet traffic (port 23) and show ASCII
tcpdump -A dst port 23

# Capture HTTP POST data (may contain credentials)
tcpdump -A "tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)"

Monitor DNS Queries

# Watch all DNS requests
tcpdump -nn udp port 53

# Watch for specific domain queries
tcpdump -nn "udp port 53 and dst host 8.8.8.8"

Capture SSH Traffic (for flow analysis)

# SSH connection attempts
tcpdump -nn "tcp port 22 and tcp[tcpflags] & tcp-syn != 0"

Summary: Key Flags Reference

Option	Description
`-i <interface>`	Specify network interface (`-i any` for all)
`-w <file>`	Write packets to .pcap file
`-r <file>`	Read from .pcap file
`-c <count>`	Stop after capturing N packets
`-n`	Don't resolve hostnames
`-nn`	Don't resolve hostnames or port names
`-v / -vv / -vvv`	Verbosity levels
`-q`	Brief (quiet) output
`-e`	Show link-layer headers
`-A`	Show packet data in ASCII
`-xx`	Show packet data in hex
`-X`	Show headers and data in hex + ASCII