Using tcpdump on Linux for Network Packet Capture: Commands and Tips
This guide explains how to use tcpdump on Linux to capture all traffic, filter by IP or port, save to files, read pcap files, and apply advanced filters, while highlighting important security, permission, and storage considerations.
In Linux, network packet capture is typically performed with tools like tcpdump or Wireshark, which can intercept packets traversing a network interface to help analyze traffic, diagnose network problems, or conduct security audits.
Common tcpdump commands include:
Capture all traffic on a specific interface: sudo tcpdump -i eth0
Capture only traffic destined for a particular IP address: sudo tcpdump -i eth0 src <IP address>
Capture traffic on a specific port: sudo tcpdump -i eth0 port <port number> (e.g., sudo tcpdump -i eth0 'tcp port 80' )
Write captured packets to a file: sudo tcpdump -i eth0 -w bank.pcap
Read a saved pcap file: sudo tcpdump -r bank.pcap
Advanced filter examples: tcpdump '(src 192.168.240.26 and dst 192.168.240.8 ) or arp' -i eth0 -n , tcpdump src host 192.168.240.26 -i eth0 -n -c 10 , tcpdump dst host 192.168.240.8 -i eth0 -n -c 10 , tcpdump port 22 -i eth0 -n -c 5
Precautions:
Network capture may involve privacy and security issues; ensure you have proper authorization.
Root privileges are often required to capture packets.
Capturing large volumes of data can consume significant disk space; set appropriate limits.
tcpdump supports complex filter expressions, which can be studied further for specialized capture needs.
Images illustrating command output are included below:
Practical DevOps Architecture
Hands‑on DevOps operations using Docker, K8s, Jenkins, and Ansible—empowering ops professionals to grow together through sharing, discussion, knowledge consolidation, and continuous improvement.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.