Capture Traffic with tcpdump

You've spent weeks learning about network protocols and maybe even used ping or nslookup. But when the network misbehaves, when you need to see exactly what's being sent, or when you're investigating a security incident, you need to look at the raw packets. That's where tcpdump comes in. In this lesson, you'll learn to capture traffic with tcpdump for analysis — the command-line tool that provides a raw, unfiltered view of your network, essential for both ethical hacking and network troubleshooting.

The problem this lesson solves

Without a packet capture tool, you're flying blind. You might know that a service is slow or that a port is open, but you can't see why. Security incidents, application bugs, and network misconfigurations often hide in packet-level details — a malformed TCP handshake, an unexpected retransmission, or a secret exfiltration attempt.

Traditional network monitoring tools give you aggregate statistics, but they miss the fine grain. tcpdump is the low-level Swiss Army knife: it lets you capture traffic with tcpdump for analysis, displaying packet headers, payloads, and timing with pinpoint accuracy. Ethical hackers use it for reconnaissance, to understand target services, and to verify that exploits behave as expected. Network engineers use it to diagnose latency and packet loss. Without this skill, you'll struggle to move beyond theory into real-world network forensics.

Core concept / mental model

Think of tcpdump as a wiretap for your network interface. Just as a journalist listens in on a phone line, tcpdump listens to the network card and prints a decoded summary of every packet that comes through. You can filter what you hear, save the conversation for later, and even replay it.

• Interface: Your network card (e.g., eth0, wlan0, enp0s3). tcpdump attaches to this device in promiscuous mode to see all traffic, not just your own.
• Capture: The act of collecting packets. tcpdump runs with elevated privileges (root or sudo) because opening a raw socket requires special permissions.
• Filter: An expression that tells tcpdump which packets to keep. For example, tcp port 80 only captures web traffic.
• Output: By default, tcpdump prints a one-line summary for each packet. With the -v flag, you get more detail; with -X, you get hex and ASCII payload.
• Save & Read: Use -w to write raw packets to a file (a pcap), and -r to read it back. This is the foundation for offline analysis with tools like Wireshark.

Why filter matter

On a busy network, capturing everything can overwhelm you. Filters turn noise into signal. For example, to capture traffic with tcpdump for analysis of a specific service, you might use port 22 for SSH or host 192.168.1.10 for a single device. The -c option limits the number of packets, and -n prevents DNS reverse lookups that slow you down.

How it works step by step

1. Find your interface

First, list available network interfaces with tcpdump -D or ip link show. Each interface represents a network device. Choose the one connected to the network you want to monitor.

2. Start a basic capture

Run sudo tcpdump with the interface and an optional filter. Without a filter, tcpdump captures everything, which can be overwhelming. Always think about what you need.

3. Observe the output

Each line shows timestamp, protocol, source and destination IP/port, and flags. For TCP packets, you'll see sequence numbers and flags like [S] (SYN), [.] (ACK), and [F] (FIN). This is the raw data you'll interpret.

4. Stop the capture

Press Ctrl+C to stop. tcpdump will print a summary of packets captured and received.

5. Save and read

Use -w to write the capture to a file. Use -r to read it back or analyze later.

6. Apply filters

Filters are BPF (Berkeley Packet Filter) expressions. The syntax is powerful but simple: host, port, tcp, udp, icmp, and logical operators like and, or, not.

Hands-on walkthrough

Let's put this into action. Open a terminal with sudo access, and follow along.

Capture all traffic on your default interface

# List interfaces
sudo tcpdump -D

# Capture on eth0 (replace with your interface)
sudo tcpdump -i eth0

This captures everything until you press Ctrl+C. For a clean test, generate some traffic by pinging a public server.

sudo tcpdump -i eth0

In another terminal, run:

ping -c 3 8.8.8.8

Expected output includes ICMP packets, showing ICMP echo request and ICMP echo reply.

Capture specific traffic with a filter

To capture traffic with tcpdump for analysis of a web server:

sudo tcpdump -i eth0 -n tcp port 80

The -n flag disables name resolution, speeding up output. Now, in another terminal, run curl http://example.com.

You'll see TCP handshake (SYN, SYN-ACK, ACK), followed by HTTP GET and response. The output looks like:

14:23:45.123456 IP 192.168.1.5.54321 > 93.184.216.34.80: Flags [S], seq 123, win 64240, options [...], length 0
14:23:45.123789 IP 93.184.216.34.80 > 192.168.1.5.54321: Flags [S.], seq 456, ack 124, win 65535, options [...], length 0

Save a capture for later

sudo tcpdump -i eth0 -v -c 10 -w capture.pcap"

This saves 10 packets to capture.pcap. To read it:

tcpdump -r capture.pcap -n

You'll see the same output but offline.

Advanced: filter for TCP flags

sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'

This captures only packets with the SYN flag set — useful for spotting port scans.

Pro tip: Use -c to stop automatically after a set number of packets. It's great for quick tests without flooding your screen.

Compare options / when to choose what

Choose tcpdump when you need a quick, scriptable capture on a headless server. Use Wireshark or tshark for complex protocol dissection. For port scanning, use nmap.

Troubleshooting & edge cases

• Permission denied: tcpdump requires root. Run with sudo or add your user to the appropriate group.
• No packets show up: Check your interface name. Use -D to list. Also, wireless interfaces may need -i wlan0 and sometimes cannot capture in promiscuous mode.
• Too many packets: Narrow your filter. Use -c to limit counts or -s to set snaplen (e.g., -s 0 for full packets).
• Reading a pcap with wrong endianness: Rare, but when opening on a different architecture, use -r and let tcpdump auto-detect.
• Changed interface names: Linux now uses predictable names like enp0s3. Don't assume eth0.

What you learned & what's next

You now know how to capture traffic with tcpdump for analysis: from basic interface capture to saving pcap files, applying BPF filters, and troubleshooting common issues. You can use tcpdump for network monitoring, incident response, and security reconnaissance.

Next in the track, you'll explore more advanced traffic analysis — maybe using Wireshark for deeper inspection or scripting tcpdump for automated captures. That will take your packet analysis skills to the next level. For now, practice with real traffic on your own network.