General options examples

tcpdump \
        -i eno1                `# --- interface. 'any' for any.` \
        -s 0                   `# --- max packet length to capture. 0 for all.` \
        -G 60                  `# --- capture packets for this long before rolling to new file, seconds` \
        -W 1                   `# --- number of files to capture` \
        -w out.pcap            `# --- output file name` \
        udp and port 12345     `# --- capture filter`

Options

List interfaces

tcpdump -D

Read capture file

tcpdump -r out.pcap

Print packets to console

To display the packet contents as ASCII, rather than just header information, use the -A option. E.g:

tcpdump -i any -A -vv host 224.1.1.1

The example above also shows capturing multicast traffic

To display contents as hex and ASCII side by side, instead use -X

Verbosity

You can specify how much output tcpdump prints with -v (verbose), -vv (very verbose) or -vvv (very very verbose) (yes, really!)

Display time

Time since start of capture: -ttt

Wall clock time: -tttt

Specify how many packets to capture

Capture 300 packets: -c 300

Don't resolve hosts or ports

Normally tcpdump will convert tcp/80 to http, and 10.0.1.2 to BarrysPhone.

To stop resolving hostnames: -n

To stop resolving ports and hostnames: -nn

Filters

Traffic to/from a network

To/from: net 10.0.1.0/24

From: src net 10.0.1.0/24

To: dst net 10.0.1.0/24

Trafic to/from a host

To/from: host 10.0.1.1

From: src host 10.0.1.1

To: dst host 10.0.1.1

Between to addresses: host 10.0.1.1 and host 10.0.1.2

From one host to another src host 10.0.1.1 and dst host 10.0.1.2

Can also use hostnames: host and-e.co.uk

Trafic to/from a specific port

To/from: port 12345

To: src port 12345

From: dst port 12345

Trafic to/from a port range

portrange 12345-12349

A specific protocol

TCP: tcp

UDP: udp

ICMP: icmp

ARP: arp

IP: ip #TODO: Is this just v4? Or v4 and v6?

IPv6: ip6

Not modifier

Placing not before a condition filters out matching packets. For example to capture all traffic except that on port 80:

not port 80

Size

Packets larger than 200 bytes: greater 200

Combined examples

HTTP traffic from/to specific host: host 10.0.1.1 and tcp port 80

HTTP or HTTPS traffic from specific client: src host 10.0.1.1 and \(dst port 80 or dst port 443\)