tcpdump Basics

Ever wonder what packets are actually flying across your network when a service misbehaves? You’ve checked logs, restarted processes, maybe even blamed the network team — but the truth is in the packets. tcpdump is the classic Linux tool that lets you see every frame on an interface, filter it down to exactly what you care about, and save it for later analysis. This lesson gives you the practical tcpdump basics to capture traffic with precision, even if you've never run a packet capture before.

The Problem: Why You Need to See Packets

When applications misbehave, they rarely tell you why. A REST call times out, a database connection resets, or a webhook fires but the receiving server never responds. Logs might show the error, but they can't show the moment the TCP handshake failed or the exact bytes in the request that triggered a malformed response.

Telemetry gaps are the real enemy. You have application metrics, maybe traces, but the network layer is a black box. Without visibility into packets, you're debugging with one hand tied behind your back.

By the end of this lesson, you’ll be able to: capture traffic with tcpdump basics — from choosing the right interface to applying simple and complex filters — and save your captures for analysis or handoff to a colleague.

Core Concept: Your Network Is a Firehose

Think of every network interface as a never-ending firehose of data. Every packet — web requests, DNS lookups, background syncs, even noise from other machines on the same switch — is a drop in that stream. tcpdump is your filter and recording device: it taps into the firehose, lets you filter by protocol, host, port, or even byte-level patterns, and writes the ones you want to a file.

The mental model is simple:

• Capture — grab packets from a live interface or a saved file
• Filter — narrow down to what matters
• Inspect — decode headers and payloads in human-readable form

You're not just “sniffing” — you’re building a precise, time-stamped record of every network conversation you care about.

Key Definitions

• Interface — the network device (e.g., eth0, wlan0, lo)
• BPF — Berkeley Packet Filter, the expression language tcpdump uses
• Capture file — a binary file (usually .pcap) you can replay with tools like Wireshark

How It Works Step by Step

Using tcpdump isn’t guesswork — it’s a repeatable sequence of decisions.

1. Identify your interface — run ip link show or tcpdump -D to list all capture points.
2. Check permissions — capturing requires root or CAP_NET_RAW. Use sudo unless your user has been granted the capability.
3. Choose your filter — narrow down by host, port, or protocol. Start narrow to avoid capturing hundreds of thousands of irrelevant packets.
4. Run the capture — tcpdump starts listening immediately. Use -c to limit the number of packets, -n to avoid DNS lookups, and -i to pick the interface.
5. Save to file — use -w to write raw packets to a .pcap file, and -W or -C to rotate files for long captures.
6. Read and analyze — use tcpdump -r to inspect saved files, or export to Wireshark for deep inspection.

Filter Expressions: The Heart of Capture

The real power of tcpdump comes from Berkeley Packet Filter (BPF) expressions. They let you say “capture HTTP traffic to this web server, but only from that subnet.”

Examples:

• host 192.168.1.10 — all traffic to/from that host
• port 443 — all HTTPS traffic
• tcp and port 80 — only TCP on port 80
• src port 53 — DNS queries (source port)
• not arp — everything except ARP noise

You can combine them with and, or, and not. The filter is applied in the kernel, so it’s fast and efficient — you only capture what you asked for.

Hands-On Walkthrough: Capture Traffic with tcpdump Basics

Let’s make this real. You’ll capture live traffic on your machine, apply filters, and save a capture file.

Step 1: Find Your Interface

# List capture-capable interfaces
tcpdump -D

Sample output:

1.eth0 [Up, Running]
2.lo [Up, Running, Loopback]
3.any (Pseudo-device that captures on all interfaces)

Step 2: Capture a Few Packets to a File

# Capture 10 packets on eth0, write to file, and print summary
sudo tcpdump -i eth0 -c 10 -w http_capture.pcap

No output until the capture completes (because output is suppressed with -w). You’ll see something like:

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10 packets captured
10 packets received by filter
0 packets dropped by kernel

Now read the file back:

tcpdump -r http_capture.pcap

Sample line:

10:23:45.678901 IP 192.168.1.20.54321 > 93.184.216.34.80: Flags [S], seq 1024, win 64240, options [mss 1460], length 0

Step 3: Apply a Real Filter

Let’s capture only HTTP traffic (port 80) to a specific host, and translate addresses to names off for speed:

sudo tcpdump -i eth0 -nn -c 20 port 80

You’ll see output like:

10:25:11.123456 IP 10.0.0.5.52345 > 93.184.216.34.80: Flags [P.], seq 1:72, ack 1, win 502, length 71: HTTP: GET /index.html HTTP/1.1

You’re filtering out everything except web requests — clean and focused.

Step 4: Capture Both Directions of a Conversation

# Capture any traffic between your machine and a database server
sudo tcpdump -i eth0 -nn host 10.0.1.5 and port 5432

Now you see the TCP handshake, query, and response packets in real time.

Step 5: Save and Analyze Later

# Capture 100 packets to a file with a 5-minute timeout
sudo tcpdump -i eth0 -c 100 -w db_capture.pcap -G 300

Then open the file in Wireshark:

wireshark db_capture.pcap

Or continue with CLI:

tcpdump -r db_capture.pcap 'tcp[tcpflags] & tcp-syn != 0'

Filter the saved file for SYN packets — useful to see connection attempts.

Compare Options: tcpdump vs. Alternatives

When to choose what: Start with tcpdump for fast, scriptable captures. Move to Wireshark/tshark when you need protocol-level decoding or visual follow of a TCP stream. If you're building an automation pipeline, tshark is your friend.

Troubleshooting & Edge Cases

"You don't have permission to capture on that device"

This is the classic first hurdle. tcpdump needs root or CAP_NET_RAW. Solutions:

1. Use sudo (works immediately, but be careful).
2. Grant the capability narrowly:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Now, non-root users can capture — but change the binary path to match your system.

Everything is ARP — why?

On busy subnets, you see constant ARP broadcasts. That’s normal, but it floods your capture. Use not arp to exclude it, or focus on TCP/UDP with tcp or udp.

Capture file has zero packets

If you used -w and got no data, likely your filter was too narrow or the interface was down. Use -v to see live errors, and test with -c 1 to see if anything matches.

DNS lookups slow everything down

-nn converts addresses and ports to numbers and avoids reverse DNS. Use it when sending filters will make captures sticky.

Promiscuous mode isn’t working

You may need to enable it manually with -p off or check your network adapter. In modern Linux, it’s usually on by default for root.

What You Learned & What's Next

Now you can capture traffic with tcpdump basics: choose an interface, apply BPF filters, save to a .pcap file, and decode the results with tcpdump or Wireshark. You also know how to avoid common pitfalls like permission errors, DNS lag, and ARP noise.

In the next lesson, you'll learn how to analyze those captures using tshark to extract fields, follow TCP streams, and generate statistics. You’ll turn raw packets into actionable telemetry — right on the path to mastering Linux networking and telemetry.