tcpdump is a common packet analyzer that runs under the command line. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. Distributed under the BSD license, tcpdump is free software.
Tcpdump works on most Unix-like operating systems: Linux, Solaris, BSD, OS X, HP-UX, Android and AIX among others. In those systems, tcpdump uses the libpcap library to capture packets.
The port of tcpdump for Windows is called WinDump; it uses WinPcap, the Windows port of libpcap.
Download: tcpdump cheat sheet by packetlife.net
tcpdump man page: tcpdump man page
- tcpdump -i any : Listen on all interfaces to see if you’re seeing any traffic.
- tcpdump -i eth0 : Listen on the eth0 interface.
- tcpdump -D : Show the list of available interfaces
- tcpdump -n : Don’t resolve hostnames.
- tcpdump -nn : Don’t resolve hostnames or port names.
- tcpdump -q : Be less verbose (more quiet) with your output.
- tcpdump -X : Show the packet’s contents in both hex and ASCII.
- tcpdump -XX : Same as -X, but also shows the ethernet header.
- tcpdump -v, -vv, -vvv : Increase the amount of packet information you get back.
- tcpdump -c : Only get x number of packets and then stop.
- tcpdump icmp : Only get ICMP packets.
- tcpdump -s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.
- tcpdump -S : Print absolute sequence numbers.
- tcpdump -e : Get the ethernet header as well.
- tcpdump -q : Show less protocol information.
- tcpdump -E : Decrypt IPSEC traffic by providing an encryption key.
[ The default snaplength as of tcpdump 4.0 has changed from 68 bytes to 96 bytes. While this will give you more of a packet to see, it still won’t get everything. Use -s 1514 to get full coverage ]
Different combination of options to tcpdump, as can be seen below:
- Basic communication // see the basics without many options
# tcpdump -nS
- Basic communication (very verbose) // see a good amount of traffic, with verbosity and no name help
# tcpdump -nnvvS
- A deeper look at the traffic // adds -X for payload but doesn’t grab any more of the packet
# tcpdump -nnvvXS
- Heavy packet viewing // the final “s” increases the snaplength, grabbing the whole packet
# tcpdump -nnvvXSs 1514
Type options are host, net, and port. Direction is indicated by dir, and there you can have src, dst, src or dst, and src and dst. Here are a few that you should definitely be comfortable with:
- host // look for traffic based on IP address (also works with hostname if you’re not using -n) # tcpdump host 220.127.116.11
- src, dst // find traffic from only a source or destination (eliminates one side of a host conversation)
# tcpdump src 18.104.22.168
# tcpdump dst 22.214.171.124
- net // capture an entire network using CIDR notation # tcpdump net 126.96.36.199/24
- proto // works for tcp, udp, and icmp. Note that you don’t have to type proto# tcpdump icmp
- port // see only traffic to or from a certain port# tcpdump port 3389
- src, dst port // filter based on the source or destination port# tcpdump src port 1025 # tcpdump dst port 389
- src/dst, port, protocol // combine all three
# tcpdump src port 1025 and tcp
# tcpdump udp and src port 53
You also have the option to filter by a range of ports instead of declaring them individually, and to only see packets that are above or below a certain size.
- Port Ranges // see traffic to any port in a range
tcpdump portrange 21-23
- Packet Size Filter // only see packets below or above a certain size (in bytes)
tcpdump less 32
tcpdump greater 128
[ You can use the symbols for less than, greater than, and less than or equal / greater than or equal signs as well. ]
// filtering for size using symbols
tcpdump > 32
tcpdump <= 128
Writing to a File
tcpdump allows you to send what you’re capturing to a file for later use using the -w option, and then to read it back using the -r option. This is an excellent way to capture raw traffic and then run it through various tools later.
The traffic captured in this way is stored in tcpdump format, which is pretty much universal in the network analysis space. This means it can be read in by all sorts of tools, including Wireshark, Snort, etc.
Capture all Port 80 Traffic to a File
# tcpdump -s 1514 port 80 -w capture_file
Then, at some point in the future, you can then read the traffic back in like so:
Read Captured Traffic back into tcpdump
# tcpdump -r capture_file
# TCP traffic from 10.5.2.3 destined for port 3389
tcpdump -nnvvS src 10.5.2.3 and dst port 3389
# Traffic originating from the 192.168 network headed for the 10 or 172.16 networks
tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16
# Non-ICMP traffic destined for 192.168.0.2 from the 172.16 network
tcpdump -nvvXSs 1514 dst 192.168.0.2 and src net and not icmp
# Traffic originating from Mars or Pluto that isn’t to the SSH port
tcpdump -vv src mars and not dst port 22
If you tried to run this otherwise very useful command, you’d get an error because of the parenthesis. You can either fix this by escaping the parenthesis (putting a \ before each one), or by putting the entire command within single quotes:
# Traffic that’s from 10.0.2.4 AND destined for ports 3389 or 22 (correct)
tcpdump ‘src 10.0.2.4 and (dst port 3389 or 22)’
[ Hint: An anagram for the TCP flags: Unskilled Attackers Pester Real Security Folk ]
Show me all URGENT (URG) packets… # tcpdump ‘tcp & 32!=0‘
Show me all ACKNOWLEDGE (ACK) packets… # tcpdump ‘tcp & 16!=0‘
Show me all PUSH (PSH) packets… # tcpdump ‘tcp & 8!=0‘
Show me all RESET (RST) packets… # tcpdump ‘tcp & 4!=0‘
Show me all SYNCHRONIZE (SYN) packets… # tcpdump ‘tcp & 2!=0‘
Show me all FINISH (FIN) packets… # tcpdump ‘tcp & 1!=0‘
Show me all SYNCHRONIZE/ACKNOWLEDGE (SYNACK) packets… # tcpdump ‘tcp=18‘
[ Note: Only the PSH, RST, SYN, and FIN flags are displayed in tcpdump‘s flag field output. URGs and ACKs are displayed, but they are shown elsewhere in the output rather than in the flags field ]
tcpdump cheat sheet by packetlife.net
tcpdump man page: tcpdump man page