Capturing traffic with tcpdump

Text transcript: tcpdump BPF filters and verbose output</summary>

# Re-reading fourth_capture.pcap with verbose flags and hex dump:
$ tcpdump -X -K -vvv -r fourth_capture.pcap
reading from file fourth_capture.pcap, link-type EN10MB (Ethernet)

# -X  : print each packet in hex and ASCII
# -K  : don't verify TCP, UDP, or SCTP checksums
# -vvv: maximum verbosity

19:40:34.703773 IP (tos 0x0, ttl 255, id 11705, proto UDP (17), length 660)
    172.16.139.1.mdns > 224.0.0.251.mdns: mDNS record for _ssh._tcp.local.
        0x0000:  4500 0294 2db9 0000 ff11 7392  E...-......s...
        0x0010:  e000 00fb 14e9 14e9 0280 a689  ................
        [... hex dump continues ...]

# Example BPF filter — capture only TCP port 443 (HTTPS):
$ tcpdump -Q inout tcp port 443

# Example filter — capture traffic to/from a specific host:
$ tcpdump host 192.168.1.1

# Example filter — capture DNS (UDP port 53):
$ tcpdump udp port 53

Demonstrates re-reading a capture file with -X (hex+ASCII dump), -K (skip checksum verification), and -vvv (maximum verbosity). Also shows representative BPF filter expressions for common use cases. </details>

Filters use a notation known as BPF, or Berkeley packet filter. See man pcap-filter for more information. Don’t be fooled that there is a bpf page in section 4 of the manual. That’s for the pseudo-device that the kernel exposes.

Interestingly enough, the Linux kernel supports eBPF, which is the extended BPF. This provides a Turing-complete language that can be used to instantiate many different, potentially complex, operations. Which, of course, means it is also a security nightmare and the source of many CVEs over the years.

BPF: Berkeley Packet Filter

BPF is the filter language used by tcpdump (and libpcap generally). When you pass a filter expression to tcpdump, it is compiled into BPF bytecode and loaded into the kernel, where it runs in a small virtual machine. Packets are evaluated against the bytecode before being copied to userspace — this is why filtering at capture time is far more efficient than capturing everything and filtering later.

Filter Primitives

A BPF expression is built from primitives combined with boolean operators. Each primitive has up to three qualifiers:

Primitives are combined with and (&&), or (||), and not (!). Parentheses group subexpressions (quote or escape them in the shell).

Common Examples

Capture traffic to/from a specific host:

tcpdump host 192.168.1.1

Capture traffic from a source host only:

tcpdump src host 192.168.1.1

Capture traffic to a destination host only:

tcpdump dst host 192.168.1.1

Capture a specific port:

tcpdump port 443

Capture a port range:

tcpdump portrange 8000-8080

Capture by protocol:

tcpdump icmp
tcpdump udp
tcpdump arp

Capture a specific host and port:

tcpdump 'host 10.0.0.1 and port 80'

Exclude a host:

tcpdump not host 10.0.0.1

Capture traffic between two hosts:

tcpdump 'host 10.0.0.1 and host 10.0.0.2'

Capture a subnet:

tcpdump net 10.0.0.0/24

Capture DNS queries (UDP port 53):

tcpdump 'udp port 53'

Capture HTTP and HTTPS:

tcpdump 'tcp port 80 or tcp port 443'

Capture all traffic except SSH (avoid polluting captures on remote sessions):

tcpdump 'not tcp port 22'

Capture TCP SYN packets only (connection initiations):

tcpdump 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'

Capture TCP RST packets (connection resets — useful for diagnosing refused connections):

tcpdump 'tcp[tcpflags] & tcp-rst != 0'

Capture ICMP echo requests (ping):

tcpdump 'icmp[icmptype] == icmp-echo'

Offset-Based Filters

BPF allows direct inspection of packet bytes using the syntax proto[offset:size], where offset is in bytes from the start of the protocol header and size is 1, 2, or 4 bytes.

Capture IPv4 packets with TTL less than 10 (useful for detecting TTL-based evasion):

tcpdump 'ip[8] < 10'

Capture packets with IP “Don’t Fragment” bit set:

tcpdump 'ip[6] & 64 != 0'

Capture HTTP GET requests (match literal bytes in TCP payload):

tcpdump 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420)'

The expression tcp[12:1] & 0xf0 >> 2 computes the TCP data offset to find the start of the payload, then checks if the first four bytes are GET (0x47455420).

Saving and Reusing Filters

Filters apply equally when reading a saved capture with -r:

# Capture everything, filter later
tcpdump -w capture.pcap

# Apply BPF filter to saved file
tcpdump -r capture.pcap 'host 10.0.0.1 and tcp port 443'

This is useful when you are unsure which traffic is relevant at capture time — save everything, then slice it with filters during analysis.

Interface-specific capture

You can use the -i flag to tcpdump to specify a particular interface on which to capture. I use this frequently when I am capturing both ends of a conversation, or from multiple taps. Many taps have USB interfaces, and present as a USB ethernet adapter – this flag allows you to specify that interface, so you can capture from it rather than the default interface.

There’s also a special interface called any that captures from ALL interfaces. This can be useful in situations where you are unsure which interface is being used, or if you really do want to capture all network traffic hitting your machine.

Key takeaways

• tcpdump is the libpcap front end — low overhead, no GUI required, and present on practically every Linux system. The skills here transfer directly to Wireshark and anything else built on libpcap.
• Capture everything, filter later: write raw packets with -w file, read them back with -r file, and apply BPF filters at either capture or read time.
• Control direction with -Q in|out|inout, pick interfaces with -i (including the special any), and limit volume with -c count.
• BPF filters are built from primitives — a type (host/net/port), a dir (src/dst), and a proto (tcp/udp/icmp/arp) — combined with and/or/not. They compile to bytecode that runs in the kernel, so filtering at capture time is far cheaper than capturing everything.
• Offset-based filters (proto[offset:size]) let you match on raw header or payload bytes — TCP flags, TTL, the DF bit, even literal payload strings like an HTTP GET.

References

• tcpdump man page. https://www.tcpdump.org/manpages/tcpdump.1.html
• pcap-filter — the BPF filter syntax. https://www.tcpdump.org/manpages/pcap-filter.7.html
• libpcap man page. https://www.tcpdump.org/manpages/pcap.3pcap.html
• Daniel Miessler — A tcpdump Tutorial with Examples. https://danielmiessler.com/study/tcpdump/

Related course pages: Analyzing traffic with Wireshark · Introduction to Networking

🛠️ Maintenance note: the asciinema casts and their text transcripts reflect an older Kali (/sbin/tcpdump, eth1); interface names and paths vary by host, and the man tcpdump synopsis option string changes between releases. Re-check the linked man pages and confirm the casts still play each term.