The Complete Guide to Tcpdump on Linux

Tcpdump is a powerful command-line network packet analyzer available on most Unix systems. In this guide, we will explore its core features and learn how to use it effectively to diagnose network problems.

Installing Tcpdump

On most Linux distributions, tcpdump can be installed through the package manager:

# Debian/Ubuntu
sudo apt install tcpdump

# Red Hat/CentOS
sudo yum install tcpdump

# Arch Linux
sudo pacman -S tcpdump

Basic Commands

Simple capture

To start capturing traffic on all interfaces:

sudo tcpdump -i any

Specifying an interface

To capture traffic on a specific interface:

sudo tcpdump -i eth0

Displaying packets in a readable format

To view packet contents in ASCII:

sudo tcpdump -A -i eth0

Capture Filters

Filtering by host

Capture traffic for a specific host:

sudo tcpdump host 192.168.1.1

Filtering by port

Capture traffic on a specific port:

sudo tcpdump port 80

Filtering by protocol

Capture only TCP traffic:

sudo tcpdump tcp

Advanced Filter Expressions

Combining filters

Use logical operators (and, or, not):

# HTTP traffic to a specific host
sudo tcpdump 'tcp port 80 and host 192.168.1.1'

# SSH or HTTP traffic
sudo tcpdump 'tcp port 22 or tcp port 80'

Filtering by direction

Specify the traffic direction:

# Incoming traffic
sudo tcpdump 'dst host 192.168.1.1'

# Outgoing traffic
sudo tcpdump 'src host 192.168.1.1'

Saving and Analyzing Captures

Saving the capture

Save the capture to a file for later analysis:

sudo tcpdump -w capture.pcap

Reading a saved capture

Analyze an existing capture file:

sudo tcpdump -r capture.pcap

Practical Use Cases

DNS debugging

Capture DNS queries:

sudo tcpdump -i any port 53

HTTP traffic analysis

Capture and analyze web traffic:

sudo tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

Monitoring SSH connections

Monitor SSH connection attempts:

sudo tcpdump 'tcp port 22'

Best Practices and Tips

1. Limiting packet size:

   sudo tcpdump -s 96

2. Displaying timestamps:

   sudo tcpdump -tttt

3. Capturing without DNS resolution:

   sudo tcpdump -n

4. Limiting the number of packets:

   sudo tcpdump -c 100

Common Troubleshooting

Permission issues

If you run into permission errors:

• Make sure you are using sudo
• Check capabilities with getcap $(which tcpdump)
• Add your user to the appropriate group

Interface not found

• Check the list of available interfaces with tcpdump -D
• Make sure the interface is up

Conclusion

Tcpdump is an essential tool for any Linux system administrator. Its flexibility and power make it an excellent choice for network analysis, debugging, and security. With the commands and examples provided in this guide, you now have a solid foundation to start using tcpdump effectively.

Additional Resources

• Official Tcpdump documentation
• Tcpdump man page
• Wireshark - A graphical alternative to tcpdump

Remember that practice is the key to mastering tcpdump. Start with simple captures and work your way up to more complex filters as you gain confidence.