BPF Filter Syntax

Grammar: qualifier, direction, type

A BPF (pcap-filter) primitive is built from three kinds of qualifier plus an ID. Omit a qualifier and pcap fills in a default.

[dir] [proto] type id

So these are equivalent:

tcpdump host 10.0.0.5
tcpdump 'src or dst host 10.0.0.5'

And a bare number is a host, not a port. tcpdump 80 looks for the host 0.0.0.80. Always write port 80.

Operators

Precedence traps:

# WRONG: not applies only to the first primitive
tcpdump not host 10.0.0.1 and port 22

# RIGHT: group what you are negating
tcpdump 'not (host 10.0.0.1 and port 22)'

Always single-quote the whole expression. (, ), |, !, and \ are all shell metacharacters, and \tcp in ip proto \tcp needs the backslash to reach pcap intact.

Filters vs Wireshark display filters

These are two different languages. tcpdump takes capture filters (BPF, kernel-side, decides what gets recorded). Wireshark's main filter bar takes display filters (userspace, decides what gets shown). They share almost no syntax.

Two asymmetries to internalize:

- BPF is stateless and per-packet. It cannot express "retransmission", "response time", or "this stream". Display filters can, because Wireshark has already dissected and tracked the conversation. - ip.addr != x in Wireshark is a trap, because it is true whenever either address field differs. Write !(ip.addr == x). tcpdump's not host x has no such problem.

Wireshark accepts BPF in the capture options dialog (Capture ▸ Options ▸ Capture filter), and tshark -f is BPF while tshark -Y is a display filter. So both languages exist in both tools, in different slots.

Testing a filter without capturing

-d compiles the expression, prints the BPF program, and exits. It is the fastest syntax check there is, and it needs no packets.

# Syntax check against a file, no privileges needed
tcpdump -r capture.pcap -d 'tcp[tcpflags] & tcp-syn != 0'

# Without -r or -i, name the link type so it can compile
tcpdump -y EN10MB -d 'host 10.0.0.1 and tcp port 443'

If it prints instructions, the filter parses. If it prints syntax error, fix it before you waste a capture window.

Filter files

Long filters belong in a file, which also sidesteps shell quoting.

cat > /tmp/f.bpf <<'EOF'
tcp port 443 and
not (host 203.0.113.9 and port 22)
EOF

sudo tcpdump -i eth0 -nn -F /tmp/f.bpf

-F file replaces any expression on the command line rather than combining with it, so do not pass both. Comments in the file start with #, and newlines act as whitespace.

Performance notes

The kernel runs the filter, so a tight filter is the single biggest win when you are capturing on a busy link.

- Put the cheapest, most selective primitive first. host x and tcp port 443 beats the reverse on a link where that host is rare. - port 443 expands to a check on TCP, UDP, SCTP and both IP versions, plus a fragment-offset test. tcp port 443 is meaningfully cheaper. - Name resolution in a filter happens once at compile time, so host example.com is fine, but it may expand to several addresses. - vlan is positional, not a predicate. vlan and tcp port 80 shifts all later offsets by 4 bytes, so tcp port 80 and vlan does not work. Put vlan first, and for tagged or untagged traffic write 'tcp port 80 or (vlan and tcp port 80)'.