Port and Protocol Filters

Ports

sudo tcpdump -i eth0 -nn port 443
sudo tcpdump -i eth0 -nn tcp port 443
sudo tcpdump -i eth0 -nn 'tcp dst port 443'
sudo tcpdump -i eth0 -nn 'tcp portrange 8000-8100'
sudo tcpdump -i eth0 -nn 'port 80 or port 443'

Bare port N is wider than people expect. It expands to a check on TCP, UDP and SCTP, across IPv4 and IPv6, plus a fragment test. Prefix the transport (tcp port, udp port) both for correctness and for speed.

Service names work but hurt readability, and /etc/services differs across distributions. Use numbers.

Transport protocols

sudo tcpdump -i eth0 -nn tcp
sudo tcpdump -i eth0 -nn udp
sudo tcpdump -i eth0 -nn icmp
sudo tcpdump -i eth0 -nn icmp6
sudo tcpdump -i eth0 -nn 'tcp or udp'
sudo tcpdump -i eth0 -nn 'not (tcp or udp or icmp)'

\ before a protocol name is not optional. tcp, udp and icmp are reserved words in the filter grammar, so ip proto tcp is a syntax error while ip proto \tcp compiles. In a single-quoted shell string one backslash is enough.

Application protocols by port

pcap has no application-layer awareness, so "capture HTTP" means "capture the ports HTTP usually runs on".

A service on a non-standard port is invisible to a port filter. When you do not know the port, filter by host and read what comes back.

ICMP types by name

pcap defines symbolic names for ICMP types, which beats memorizing numbers.

# Pings out and replies back
sudo tcpdump -i eth0 -nn 'icmp[icmptype] == icmp-echo or
  icmp[icmptype] == icmp-echoreply'

# Only the errors, which is what you want for MTU and routing bugs
sudo tcpdump -i eth0 -nn -v 'icmp[icmptype] != icmp-echo and
  icmp[icmptype] != icmp-echoreply'

Path-MTU black holes are ICMP type 3 code 4:

sudo tcpdump -i eth0 -nn -v 'icmp[icmptype] == icmp-unreach and
  icmp[icmpcode] == 4'

If that filter is silent while large transfers hang, something upstream is dropping the "fragmentation needed" message, which is the classic PMTUD failure.

Fragments break port filters

A port lives in the transport header, which only exists in the first fragment. Later fragments carry no ports, so tcp port 80 silently drops them.

# Only non-first fragments
sudo tcpdump -i eth0 -nn 'ip[6:2] & 0x1fff != 0'

# First fragments and unfragmented packets only
sudo tcpdump -i eth0 -nn 'ip[6:2] & 0x1fff = 0'

# Anything fragmented at all: MF bit set or a nonzero offset
sudo tcpdump -i eth0 -nn 'ip[6] & 0x20 != 0 or ip[6:2] & 0x1fff != 0'

ip[6:2] is the 16-bit flags-plus-fragment-offset field. 0x1fff masks off the three flag bits and leaves the 13-bit offset. ip[6] & 0x20 tests the More Fragments bit on its own.

Size filters

sudo tcpdump -i eth0 -nn greater 1400
sudo tcpdump -i eth0 -nn less 100
sudo tcpdump -i eth0 -nn 'len > 1400 and len < 1500'

greater, less and len all compare the whole frame length as it was on the wire, not the payload. To find TCP segments carrying data, tcp[13] & 8 != 0 (PSH set) is a rough proxy, and the exact test is the payload-length expression in the byte-offsets topic.