tcpdump Cheatsheet
Quick reference for tcpdump commands covering packet capture, host/port/protocol filters, output options, advanced filters, and BPF syntax
59 commands
tcpdumpStart capture on default interface
sudo tcpdumptcpdump -i {iface}Capture on specific interface
sudo tcpdump -i eth0tcpdump -i anyCapture on all interfaces
sudo tcpdump -i anytcpdump -c {n}Capture n packets then stop
sudo tcpdump -c 100tcpdump -DList available interfaces
sudo tcpdump -Dtcpdump -s {size}Set snapshot length in bytes
sudo tcpdump -s 0tcpdump -s 0Capture full packet
sudo tcpdump -s 0tcpdump -qQuiet output (less protocol info)
sudo tcpdump -qtcpdump -ePrint link-level header
sudo tcpdump -etcpdump host {ip}Capture traffic to/from host
sudo tcpdump host 192.168.1.1tcpdump src host {ip}Filter by source host
sudo tcpdump src host 10.0.0.1tcpdump dst host {ip}Filter by destination host
sudo tcpdump dst host 10.0.0.2tcpdump net {cidr}Filter by network range
sudo tcpdump net 192.168.1.0/24tcpdump src net {cidr}Filter by source network
sudo tcpdump src net 10.0.0.0/8tcpdump dst net {cidr}Filter by destination network
sudo tcpdump dst net 172.16.0.0/12tcpdump host A and host BTraffic between two hosts
sudo tcpdump host 10.0.0.1 and host 10.0.0.2tcpdump not host {ip}Exclude specific host
sudo tcpdump not host 192.168.1.1tcpdump port {n}Capture traffic on specific port
sudo tcpdump port 80tcpdump src port {n}Filter by source port
sudo tcpdump src port 443tcpdump dst port {n}Filter by destination port
sudo tcpdump dst port 3306tcpdump portrange {a}-{b}Filter by port range
sudo tcpdump portrange 8000-9000tcpdump port 80 or port 443Filter multiple ports (OR)
sudo tcpdump port 80 or port 443tcpdump not port 22Exclude specific port
sudo tcpdump not port 22tcpdump host {ip} and port {n}Combined host and port filter
sudo tcpdump host 10.0.0.1 and port 80tcpdump tcpCapture TCP packets only
sudo tcpdump tcptcpdump udpCapture UDP packets only
sudo tcpdump udptcpdump icmpCapture ICMP packets only
sudo tcpdump icmptcpdump arpCapture ARP packets only
sudo tcpdump arptcpdump ip6Capture IPv6 packets only
sudo tcpdump ip6tcpdump vlanCapture VLAN tagged packets
sudo tcpdump vlantcpdump 'tcp[tcpflags] & tcp-syn != 0'TCP packets with SYN flag
sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0'tcpdump 'tcp[tcpflags] & tcp-rst != 0'TCP packets with RST flag
sudo tcpdump 'tcp[tcpflags] & tcp-rst != 0'tcpdump -w {file}Write capture to pcap file
sudo tcpdump -w capture.pcaptcpdump -r {file}Read from pcap file
tcpdump -r capture.pcaptcpdump -nDon't resolve hostnames
sudo tcpdump -ntcpdump -nnDon't resolve hostnames or port names
sudo tcpdump -nntcpdump -tDon't print timestamp
sudo tcpdump -ttcpdump -ttPrint Unix timestamp
sudo tcpdump -tttcpdump -tttPrint delta between packets
sudo tcpdump -ttttcpdump -vVerbose output
sudo tcpdump -vtcpdump -vvMore verbose output
sudo tcpdump -vvtcpdump -XPrint packet data in hex and ASCII
sudo tcpdump -Xtcpdump -APrint packet data in ASCII
sudo tcpdump -Atcpdump -C {size}Rotate file at size (MB)
sudo tcpdump -w out.pcap -C 100tcpdump -W {count}Limit number of rotated files
sudo tcpdump -w out.pcap -C 100 -W 10tcpdump -G {sec}Rotate file every n seconds
sudo tcpdump -w out_%H%M.pcap -G 3600tcpdump -Z {user}Drop privileges to specified user
sudo tcpdump -Z tcpdumptcpdump -lLine-buffered mode (for piping)
sudo tcpdump -l | tee output.txttcpdump -KSkip checksum verification
sudo tcpdump -Ktcpdump -SPrint absolute TCP sequence numbers
sudo tcpdump -Sand / &&Logical AND
sudo tcpdump tcp and port 80or / ||Logical OR
sudo tcpdump port 80 or port 443not / !Logical NOT
sudo tcpdump not arpgreater {n}Packets greater than n bytes
sudo tcpdump greater 1000less {n}Packets less than n bytes
sudo tcpdump less 100tcp[13] == 2SYN packets only (TCP flag offset)
sudo tcpdump 'tcp[13] == 2'tcp[13] == 18SYN-ACK packets only
sudo tcpdump 'tcp[13] == 18'tcp[13] & 4 != 0Packets with RST flag set
sudo tcpdump 'tcp[13] & 4 != 0'ip[6:2] & 0x1fff != 0Fragmented packets
sudo tcpdump 'ip[6:2] & 0x1fff != 0'