Skip to main content


Capture All traffic
tcpdump -i eth0
tcpdump -i wlan0
To a File
tcpdump -i eth0 -w capture.pcap

# Set Timeout
timeout 6m tcpdump -i eth0 -w capture.pcap
Read a file (.pcap)
tcpdump -r capture.pcap
# Filter by Source IP
tcpdump src

# Filter by Destination IP
tcpdump dst

# Filter by Port
tcpdump port 80

# Filter by Protocol
tcpdump icmp

# Protocol and Port
tcpdump tcp port 443

# Source and Destination
tcpdump src and dst

Display in ASCII
# Dispaly in ASCII
tcpdump -A

# Display in Hexadecimal
tcpdump -X
Specific Number of Packets
tcpdump -c 100
# Capture and Display IPv6 Traffic
tcpdump -6

# Capture and Display Traffic in Timestamp Format
tcpdump -tttt
SSH Connections
# -l: real-time
# -e: including ethernet headers
tcpdump -i eth0 'tcp port 22' -l -e
HTTP Request and Response
tcpdump -i eth0 -s 0 -A -n 'tcp dst port 80'
IP Range and Protocol
tcpdump -i eth0 'net and (tcp port 22 or icmp)'
DNS Traffic
tcpdump -i eth0 'udp port 53' -nnvvv
FTP Traffic
tcpdump -i eth0 -s 0 'tcp port 21'