Thetcpdumpcommand can be used to capture network traffic on a Linux system. It’s a versatile command line utility that network administrators often rely on for troubleshooting.What you’ll come to find is that the amount of networking traffic captured on an interface can be easily overwhelming.tcmpdumpmakes our job a little easier by allowing us to isolate only the traffic we’re interested in. Of course, in order to do this, you need to be familiar with the various flags and settings that go along with the command.In this guide, you’ll see how to usetcpdumpthrough examples and explanations. Follow along on your own system if you want to learn to capture network traffic and master thetcpdumpcommand.In this tutorial you will learn:How to install tcpdump on major linux distrostcpdump command examplesHow to filter tcpdump traffic by port, protocol, source, and destinationHow to write tcpdump captures to fileHow to interpret tcpdump command outputUsing tcpdump command to capture network traffic on LinuxSoftware Requirements and Linux Command Line ConventionsCategoryRequirements, Conventions or Software Version UsedSystemAny Linux distroSoftwaretcpdumpOtherPrivileged access to your Linux system as root or via thesudocommand.Conventions#– requires given linux commands to be executed with root privileges either directly as a root user or by use ofsudocommand$– requires given linux commands to be executed as a regular non-privileged userInstall tcpdump on major Linux distrosThere’s a good chance that your Linux distro already hastcpdumpinstalled by default, especially if you’re running a distro geared towards servers. Just in case it’s not already installed, you can use the appropriate command below to install it through your system’s package manager.To install tcpdump on Ubuntu, Debian, and Linux Mint:$ sudo apt install tcpdumpTo install tcpdump on CentOS, Fedora, AlmaLinux, and Red Hat:$ sudo dnf install tcpdumpTo install tcpdump on Arch Linux and Manjaro:$ sudo pacman -S tcpdumptcpdump command examplesNOTEAll of yourtcpdumpcommands must be executed with the root user account or withsudo. The utility requires administrator privileges in order to run.The most simple form of the command is to use the utility with no extra options, like this:# tcpdumpIf you don’t specify which network interface you’d like to capture traffic from, like in the above command, thentcpdumpwill choose an interface for you.It will continue “dumping” the captured traffic to your terminal until you interrupt the command. The easiest way to do this is withCtrl c.If you have more than one network interface, then it’ll be best to specify which interface you’re trying to capture traffic on, sincetcpdumpmay not choose the one you want by default. Use the-Doption to print a list of network interfaces thattcpdumpcan use.# tcpdump -D 1.enp0s3 [Up, Running] 2.lo [Up, Running, Loopback] 3.any (Pseudo-device that captures on all interfaces) [Up, Running] 4.bluetooth-monitor (Bluetooth Linux Monitor) [none] 5.nflog (Linux netfilter log (NFLOG) interface) [none] 6.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]We have a few different interfaces that we can use. Alternatively, we have theanyoption available that will let us capture traffic on all network interfaces simultaneously. If we want to capture network traffic on theenp0s3interface, we would use the following command syntax.# tcpdump -i enp0s3You can use the-voption to increase the verbosity of the output, or-vvand-vvvto increase it even further.# tcpdump -i enp0s3 -vvIf you don’t wanttcpdumpto endlessly output data to your terminal, you can use the-coption to specify how many packets you’d like the utility to capture.tcpdumpwill quit executing the command after the threshold has been reached, rather than waiting for you to interrupt. The following command will allow us to capture only the first 15 packets.# tcpdump -c 15If you don’t wanttcpdumpto perform DNS resolution on the network addresses in the output, you can use the-noption in your command. This will display all network addresses as IP addresses, rather than resolving them to domain names.# tcpdump -nIf you would rather save the network traffic output to file, instead of having it listed on your screen, you can always redirect thetcpdumpoutput with the usualandoperators.# tcpdump traffic.txtAnother option is to write the network capture to file. These files usually have the.pcapfile extension, and can’t be read by an ordinary text editor.# tcpdump -n -w traffic.pcapTo open the file for later analysis, use the-roption and the name of your file.# tcpdump -r traffic.pcapInterpret tcpdump command outputEach packet thattcpdumpcaptures is written as an individual line. One of those lines will look something like this:14:21:46.134249 IP 10.0.2.15.54000 104.16.168.35.443: Flags [.], ack 2915, win 63000, length 0Here’s how to interpret that line of data:14:21:46.134249– Timestamp of when the packet was captured.IP 10.0.2.15.54000– IP and port number of the source host.104.16.168.35.443– IP and port number of the destination host.Flags [.]– TCP flags (SYN, ACK, PSH, etc).[.]means ACK.ack 2915– The acknowledgment number.win 63000– The window number (bytes in receiving buffer).length 0– The length of the payload data.Filter tcpdump trafficOne of the best features oftcpdumpis that we can filter out exactly the traffic we want to see. Without filtering out traffic by adapter (as seen above), port number, and packet protocol, the amount of captured traffic can quickly become overwhelming and nearly impossible to sift through.Despite the nametcpdump, we can use the tool to filter out all kinds of traffic, not just TCP. For example, use the following syntax to filter out traffic that uses UDP.# tcpdump -n udpOr the following example that filters out ICMP:# tcpdump -n icmpYou can also use the corresponding protocol number to filter out a specific protocol. For example, ICMP is protocol number 1, so the following syntax will do the same as the previous example.# tcpdump -n proto 1To see a full list of networking protocols and their corresponding numbers, check out the list of IP protocol numbers on Wikipedia.To filter traffic with a specific destination or source IP address, we can use thehostqualifer with the-noption. For example, to filter traffic related to the host at IP address10.10.150.20:# tcpdump -n host 10.10.150.20Alternatively, use thenetqualifer if you want to filter out traffic to or from an entire network. For example, the following command will filter traffic related to the192.168.1.0/24network.# tcpdump -n net 192.168.1Use theportandportrangequalifiers to filter out packets related to a specific port or port range, respectively. For example, the following command will filter our traffic related to port 80 (HTTP).# tcpdump -n port 80Or, to filter traffic from ports 20-30, the following command would be used.# tcpdump -n portrange 20-30Add thedst,src,src and dst, andsrc or dstqualifiers if you want to filter based on the source and/or destination address or port of the packets. For example, the following command will filter out packets that have a source IP address of10.10.150.20.# tcpdump -n src host 10.10.150.20Or in this example, we filter out packets that are destined for the SSH port (port 22).# tcpdump -n dst port 22Combining filtersWe can combine these various filters covered above by using theand(),or(||), andnot(!) operators in ourtcpdumpcommand.For example, the following command will capture traffic that’s destined for10.10.150.20on port 80 (HTTP).# tcpdump -n dst host 10.10.150.20 and tcp port 80Or create even more granular filters by further combining rules inside parentheses. For example, this command will do the same as the previous, but also capture port 443 (HTTPS).# tcpdump -n dst host 10.10.150.20 and (tcp port 80 or tcp port 443)Closing ThoughtsIn this guide, we saw how to use thetcpdumpcommand line utility to capture network traffic on a Linux system. As we’ve seen in this tutorial, the command can get rather complex and accept very granular input, which allows us to filter out the exact traffic we want to see.