Cheatsheet & Examples: tcpdump
tcpdump is a powerful command-line packet analyzer used to capture network traffic passing through a network interface. It allows you to monitor and diagnose network issues by displaying the contents of network packets.
Capturing all traffic on an interface
Example Usage:
tcpdump -i eth0
What it does: Captures all network traffic on the specified interface (eth0 in this case) and displays it to the console.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.eth0is a common Ethernet interface. If no interface is specified,tcpdumpwill default to the first available interface, or use all interfaces if the-Aoption is also given.
Capturing traffic and saving it to a file
Example Usage:
tcpdump -i eth0 -w capture.pcap
What it does:
Captures all network traffic on the specified interface and saves it to a file named capture.pcap in a format that can be later analyzed by tools like Wireshark.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.-w capture.pcap: Writes the raw packet data to the specified file (capture.pcap). The file will be in a format suitable for analysis by other packet analysis tools.
Filtering traffic by host
Example Usage:
tcpdump -i eth0 host 192.168.1.100
What it does: Captures only packets to or from the specified host IP address (192.168.1.100).
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.host 192.168.1.100: Filters the traffic to show packets where either the source or destination IP address is 192.168.1.100.
Filtering traffic by port
Example Usage:
tcpdump -i eth0 port 80
What it does: Captures only packets that are using port 80 (HTTP).
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.port 80: Filters traffic to include only packets using TCP or UDP port 80.
Filtering traffic by protocol
Example Usage:
tcpdump -i eth0 tcp
What it does: Captures only TCP traffic.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.tcp: Filters traffic to include only TCP packets. Other options areudp,icmp,arp, etc.
Combining filters
Example Usage:
tcpdump -i eth0 tcp and port 80 and host 192.168.1.100
What it does: Captures only TCP traffic that is using port 80 and is to or from the host 192.168.1.100.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.tcp: Filters for TCP traffic.port 80: Filters for traffic using port 80.host 192.168.1.100: Filters for traffic to or from the specified host.and: The boolean AND operator, used to combine multiple filter criteria. Can also useorandnot.
Limiting the number of packets captured
Example Usage:
tcpdump -i eth0 -c 10
What it does: Captures only the first 10 packets and then exits.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.-c 10: Specifies the number of packets to capture.
Viewing packet content in ASCII
Example Usage:
tcpdump -i eth0 -A
What it does: Displays the contents of each packet in ASCII, which is useful for viewing the text-based data within HTTP requests or other text-based protocols.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.-A: Prints each packet's content in ASCII.
Displaying less verbose output
Example Usage:
tcpdump -i eth0 -n
What it does: Prevents hostnames from being resolved to IP addresses (and services to port numbers). This can speed up the output and avoid DNS lookups.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.-n: Do not resolve hostnames to IP addresses.
Saving to a pcap file with a specific snaplen (capture length)
Example Usage:
tcpdump -i eth0 -s 1500 -w capture.pcap
What it does: Captures packets to the file, but truncates the packets to the specified length. Useful for controlling file size.
Command-line Arguments Explained:
-i eth0: Specifies the network interface to listen on.-s 1500: Sets the snapshot length to 1500 bytes. This determines how much of each packet is captured. A value of 0 indicates that the entire packet is captured, while a smaller value will truncate the packets.-w capture.pcap: Writes the raw packet data to the specified file (capture.pcap).
