tcpdump Cheatsheet
Basics and Interfaces
Use this tcpdump reference while you build software engineering projects, review code, or refresh the syntax you reach for most.
Minimal invocation
tcpdump needs raw packet access, so it runs as root or with
CAP_NET_RAW on Linux. Everything after the option flags is the filter
expression.
sudo tcpdump -i eth0 -nn sudo tcpdump -i eth0 -nn port 443 sudo tcpdump -nn -r capture.pcap 'tcp port 80'
General form:
tcpdump [options] [filter expression]
With no -i, tcpdump picks the lowest-numbered configured non-loopback
interface. That is rarely what you want on a multi-homed box, so name the
interface explicitly.
Listing interfaces
tcpdump -D # or --list-interfaces tcpdump -L -i eth0 # link-layer types this interface can capture
| Interface name | Meaning |
|---|---|
eth0, en0, wlan0 | A real NIC |
lo / lo0 | Loopback, catches traffic to 127.0.0.1 |
any | Linux only, all interfaces at once, never promiscuous |
pktap,lo0,en0 | macOS only, several interfaces in one capture |
all | macOS only, every interface including loopback and tunnels |
Loopback traffic does not appear on a physical interface. If you are debugging a service on
localhost, capture onlo.
Capture without root
Preferred on Linux over running the whole thing as root:
sudo setcap cap_net_raw,cap_net_admin=eip $(which tcpdump) sudo usermod -aG pcap "$USER" # Debian ships a pcap group
Or let tcpdump drop privileges itself after opening the socket:
sudo tcpdump -i eth0 -Z nobody -w /tmp/out.pcap
-Z user is the drop-privileges flag. Use it whenever you write a file as
root, otherwise the pcap ends up owned by root.
Promiscuous mode and what you actually see
By default tcpdump puts the interface in promiscuous mode, which asks the NIC for frames not addressed to it.
| Flag | Effect |
|---|---|
| (default) | Promiscuous mode on |
-p | Do not put the interface in promiscuous mode |
-I | Monitor mode, 802.11 radio frames including other networks |
Promiscuous mode does not defeat a switch. On a switched network you only receive your own traffic plus broadcast and multicast, unless you have a SPAN/mirror port or a tap. On Wi-Fi you need monitor mode, and on most drivers that means dropping off the network.
Stopping cleanly
| Signal / flag | Effect |
|---|---|
Ctrl-C (SIGINT) | Stop and print the packet counts |
-c 100 | Exit after 100 packets |
-c 50,100 | Skip 50, then process 100 |
SIGUSR1 / Ctrl-T | Print counts so far and keep capturing |
SIGUSR2 | Force-flush the buffer to the -w file |
--count | With -r, only print the matching packet count |
The summary line matters when you are diagnosing loss:
1000 packets captured 1420 packets received by filter 120 packets dropped by kernel
dropped by kernel above zero means you are losing packets, not that
the network is. Raise the buffer with -B 4096 (KiB) or cut -s and the
filter width.
Common first-run gotchas
- Ports resolve to names by default. -n stops host lookups, -nn
also stops port and protocol name lookups. Use -nn always, DNS lookups
on every packet stall the output.
- Your own SSH session floods the capture. Exclude it:
not port 22, or better not (host 203.0.113.9 and port 22).
- Output is block-buffered through a pipe. tcpdump ... | grep foo
looks dead. Add -l (line buffered) or -U (packet buffered).
- tcpdump: <interface>: You don't have permission means no root and
no capability, not a bad interface name.
- Truncated output like [|tcp] means the snaplen cut the packet. Do
not lower -s unless you need to.