Tcpdump

Network sniffer, inspect network traffic. Tcpdump is one of the most common command-line packet analyzers and can be found on most Unix and Linux operating systems. Tcpdump can capture files from the network, or read existing capture files.

• Official Documentation

Promiscuous Mode

Network interface will send all packets to CPU for processing and not discard packets that are not addressed to this interface.

💡 Tcpdump enables promiscuous mode by default. Capture on the any interface will not be done in promiscuous mode.

Disable promiscuous mode

tcpdump -p ...

Capture/Display Filters

Capture filters and display filters have the same syntax.

tcpdump -i any [filters] [options...]

Description	Capture/Display Filter
Capture/display only ftp and ssh packets	port ftp or ssh
Capture/display traffic from or to port 53	port 53
Capture/display traffic from port 53	src port 53
Capture/display traffic to port 53	dst port 53
Filter on source IPs	src host x.x.x.x
Filter on destination IPs	dst host x.x.x.x
Specific tcpflags	‘tcp[13] & 2 == 2’ ‘tcp[13] = 2 or tcp[13] = 16’ ‘tcp[tcpflags] & tcp-push != 0’ ‘tcp[tcpflags] & tcp-ack != 0 and tcp[tcpflags] & tcp-syn != 0’ Available flags: tcp-fin, tcp-syn, tcp-rst, tcp-push, tcp-ack, tcp-urg
Data packets (ACK&PSH) *	‘tcp[13] = 24’

* All TCP packets sent and received after the initial 3-way handshake have the ACK flag set. PSH is used to enforce immediate delivery and is typical for application layer protocols to avoid buffering.

Capture traffic

❗ Local user permissions determine the ability to capture network traffic.

List all interfaces

tcpdump -D

Capture traffic in pcap file

• -s 0 will set the capture byte to its maximum i.e. 65535, after this capture file will not truncate.
• -i eth0 is using to give Ethernet interface, which you to capture. Default is eth0, if you not use this option.
• -w mypcap.pcap will create that pcap file, which will be opened using wireshark.

sudo tcpdump -s 0 -i eth0 [filters] -w capture.pcap
[Ctrl+C]

Read pcap file

💡 Format of IP address in output is x.x.x.x.port

tcpdump [filters] -r capture.pcap

Without DNS lookup (-n)

tcpdump -n [filters] -r capture.pcap

Extract unique IP addresses

tcpdump -n -r capture.pcap | cut -d " " -f 3 | sort -u | head

tcpdump -n -r capture.pcap | awk -F" " '{print $3}' | sort -u | head

Extract & count unique IP addresses

tcpdump -n -r capture.pcap | cut -d " " -f 3 | sort | uniq -c | head

tcpdump -n -r capture.pcap | awk -F" " '{print $3}' | sort | uniq -c | head

Packet details, additional information, hex format

tcpdump -nX -r capture.pcap

Print each packet (minus its link level header) in ASCII

tcpdump -A -n -r capture.pcap

Handy for capturing web pages, with ACK & PUSH TCP flags.

tcpdump -A -n 'tcp[13] = 24' -r capture.pcap