tcpdump

Overview

The tcpdump command is a packet analyzer that captures and displays the contents of network packets on a network interface.

Syntax

tcpdump [options] [expression]

Common Options

Option	Description
`-i interface`	Interface
`-n`	Don’t resolve
`-nn`	Don’t resolve (more)
`-v`	Verbose output
`-vv`	More verbose
`-c count`	Packet count
`-w file`	Write to file
`-r file`	Read from file
`-A`	ASCII output
`-X`	Hex and ASCII
`-s snaplen`	Packet length
`-q`	Quick output
`-t`	No timestamps

Expression Primitives

Type	Example
Type	host, net, port
Dir	src, dst
Proto	tcp, udp, icmp
Operators	and, or, not

Key Use Cases

Network debugging
Traffic analysis
Security monitoring
Protocol inspection
Performance tuning

Examples with Explanations

Example 1: Basic Capture

tcpdump -i eth0

Capture on interface

Example 2: Write to File

tcpdump -w capture.pcap

Save capture to file

Example 3: Filter Traffic

tcpdump port 80

Capture HTTP traffic

Common Usage Patterns

Host traffic:
```
tcpdump host 192.168.1.1
```
Port traffic:
```
tcpdump port 443
```
Protocol:
```
tcpdump tcp
```

Output Fields

Timestamp
Protocol
Source address
Destination address
Flags and data

Additional Resources

Best Practices

Use snaplen
Filter traffic
Write to file
Check permissions
Monitor impact

Security Considerations

Root access
Data exposure
Network impact
Storage space
Sensitive data

Troubleshooting

Permission denied
Interface issues
Filter syntax
File size
Performance impact

Filter Examples

TCP flags:
```
tcpdump 'tcp[tcpflags] & tcp-syn != 0'
```
IP range:
```
tcpdump net 192.168.1.0/24
```
Port range:
```
tcpdump portrange 21-23
```