tcpdump

tcpdump is the venerable command-line packet analyzer for Unix-like systems, built on libpcap (the same capture library wireshark-class tools use). It captures traffic off a live interface or reads from pcap files, and its real power is the BPF (Berkeley Packet Filter) expression syntax — a compiled filter language that discards unwanted packets in the kernel before userspace ever sees them.

Quick recipes

# Watch a specific port, ASCII payload dump
sudo tcpdump port 80 -A
 
# Classic triage: no DNS resolution (-n), no port names (-nn), on a specific interface
sudo tcpdump -i eth0 -nn host 10.0.0.5
 
# Write a pcap for offline analysis
sudo tcpdump -i any -nn -w capture.pcap 'tcp port 443'
 
# Read it back with a filter
tcpdump -nn -r capture.pcap 'icmp'

Key flags:

Flag	Effect
-i IFACE	Capture interface (any for all)
-n / -nn	No name resolution (hosts) / no host or port resolution
-A	Print packet payloads in ASCII
-X	Print payloads in hex and ASCII
-c N	Stop after N packets
-w FILE / -r FILE	Write / read pcap files
-s SNAPLEN	Bytes captured per packet (-s 0 = full packet)
-v / -vv / -vvv	Increasing decode verbosity

BPF filter highlights

Expressions combine primitives with and / or / not:

• host, net, port, portrange — endpoint matching (optional src/dst qualifiers)
• tcp, udp, icmp, arp — protocol matching
• tcp[tcpflags] & tcp-syn != 0 — header-bit surgery (SYN-only captures)
• greater 1000, less 64 — packet-size matching

tcpdump port $PORT -A is the quick-and-dirty way to eyeball what a service is actually saying; for protocol-aware dissection and follow-the-stream workflows, export to pcap and open in wireshark — tcpdump captures, Wireshark interprets.

Operational notes

• On a compromised host, a short tcpdump -i any -nn -c 500 pass reveals what the box is really talking to — complements socket-level views from ss / netstat, which show endpoints but not payload or timing.
• Capturing requires root (or the CAP_NET_RAW capability); see linux-file-capabilities.
• BPF filtering happens in-kernel, so a tight filter both reduces noise and lowers the chance of dropping packets under load.

Sources

• tcpdump(1) — tcpdump.org man page

Related

• ss — socket-level view of the same traffic
• icmp — what those type/code pairs in the output mean
• nmap — packet capture confirms how scans appear on the wire