Which tcpdump

By default, tcpdump resolves IP addresses and ports into names, as shown in the previous example. When troubleshooting network issues, it is often easier to use the IP addresses and port numbers; disable name resolution by using the option -n and port resolution with -nn :. As shown above, the capture output now displays the IP addresses and port numbers. This also prevents tcpdump from issuing DNS lookups, which helps to lower network traffic while troubleshooting network issues.

While we can't cover all of them here, to help you get started, let's explore the TCP packet. You can find more details about the different protocol formats in tcpdump's manual pages. A typical TCP packet captured by tcpdump looks like this:. The first field, Next, IP represents the network layer protocol—in this case, IPv4.

For IPv6 packets, the value is IP6. The next field, This is followed by the destination IP address and port, represented by Typical values for this field include:. This field can also be a combination of these values, such as [S.

Next is the sequence number of the data contained in the packet. For the first packet captured, this is an absolute number. Subsequent packets use a relative number to make it easier to follow. In this example, the sequence is seq , which means this packet contains bytes to of this flow. This is followed by the Ack Number: ack 1. In this case, it is 1 since this is the side sending data. For the side receiving data, this field represents the next expected byte data on this flow.

For example, the Ack number for the next packet in this flow would be Finally, we have the packet length, length , which represents the length, in bytes, of the payload data. The length is the difference between the last and first bytes in the sequence number. Now let's learn how to filter packets to narrow down results and make it easier to troubleshoot specific issues.

As mentioned above, tcpdump can capture too many packets, some of which are not even related to the issue you're troubleshooting. For example, if you're troubleshooting a connectivity issue with a web server you're not interested in the SSH traffic, so removing the SSH packets from the output makes it easier to work on the real issue.

One of tcpdump's most powerful features is its ability to filter the captured packets using a variety of parameters, such as source and destination IP addresses, ports, protocols, etc. Let's look at some of the most common ones. To filter packets based on protocol, specifying the protocol in the command line. For example, capture ICMP packets only by using this command:.

Daniel Miessler is a cybersecurity leader, writer, and founder of Unsupervised Learning. An IP Header. A single ICMP packet captured by tcpdump. I spend my time reading books a month on security, technology, and society—and thinking about what might be coming next.

Every Monday morning I send out a list of the best content I've found in the last week to around 50, people. Newsletter only. Weekly Newsletter vs. Unabridged Podcast Feed Access. Show Archive Access. Exclusive Member-Only Content. In our previous article, we have seen 20 Netstat Commands netstat now replaced by ss command to monitor or manage a Linux network. This is our another ongoing series of packet sniffer tool called tcpdump.

Here, we are going to show you how to install tcpdump and then we discuss and cover some useful commands with their practical examples. It saves the file in a pcap format, that can be viewed by tcpdump command or an open-source GUI-based tool called Wireshark Network Protocol Analyzer that reads tcpdump pcap format files.

Once the tcpdump tool is installed on your system, you can continue to browse the following commands with their examples. The command screen will scroll up until you interrupt and when we execute the tcpdump command it will captures from all the interfaces, however with -i switch only capture from the desired interface.

When you run the tcpdump command it will capture all the packets for the specified interface, until you hit the cancel button. But using -c option, you can capture a specified number of packets. The below example will only capture 6 packets. It is a character-encoding scheme format. To list the number of available interfaces on the system, run the following command with -D option.

As we said, that tcpdump has a feature to capture and save the file in a. Tcpdump command can read the contents from a network interface or from a previously created packet file or we can also write the packets to a file to be used for later. One must use the tcpdump command as root or as a user with sudo privileges. In this tutorial, we are going to discuss the uses of tcpdump command along with some examples, but first let's start with installation of tcpdump on various Linux OS.

Recommended Read: Monitoring network bandwidth with iftop command. By default, tcpdump is available on almost all Linux distributions but if that's not the case for you, install it on your system using the following method. Get all the packets based on the IP address, whether source or destination or both, using the following command,. This helps when we have analyze network packets based on the some condtions.