tcpdump Examples: Filters, pcap & BPF Cheat Sheet (2026)

tcpdump Examples

tcpdump is the packet capture tool on every Linux box, and it needs root, so prefix everything here with sudo. This sheet covers the filters people actually type: host and port, source and destination, protocols, and/or combinations, writing pcap files for Wireshark, and the BPF syntax behind it all.

Last updated September 5, 2026

Basics

tcpdump needs root. Every command here assumes , and Ctrl+C stops a capture.

Command	What it does
	Capture on one interface
	Capture on all interfaces at once
	List interfaces you can capture on
	Skip DNS lookups, show raw IPs and ports (faster, and usually what you want)
	Stop after 100 packets
	Verbose output: TTL, ID, checksums ( for more)
	Quieter, shorter lines
	Version, plus the libpcap it was built with

Host and Port Filters

Quote any filter that has more than one word so the shell leaves it alone.

Command	What it does
	Traffic to or from one IP
	Traffic coming from an IP
	Traffic going to an IP
	Traffic on a port, either direction
	Traffic from a source port
	Traffic to a destination port
	A range of ports
	Traffic to or from a whole subnet
	To one IP on one port

Combining Filters

, , and combine primitives; parentheses group them. Always quote the whole expression, or the shell will grab the special characters first.

Command	What it does
	One host's traffic on port 80
	Only the conversation between two hosts
	Either of two ports
	Everything except SSH (essential when capturing over SSH)
	From a host, minus its DNS lookups
	Grouping with parentheses

Protocols

A bare protocol name is a filter on its own, and it combines with everything above.

Command	What it does
	TCP only
	UDP only
	Pings and other ICMP (watch a land)
	ARP requests and replies (who-has, is-at)
	DNS queries and answers
	All DNS, including large TCP responses
	HTTP over TCP
	The low-level chatter, useful when a host is unreachable

Saving and Reading Captures

Write with , analyze later with or Wireshark. Terminal output stops while writing to a file; add to see a packet count tick up.

Command	What it does
	Write raw packets to a file
	Full packets, not truncated (do this for Wireshark)
	Capture 1000 packets, then stop
	Rotate at 100 MB, keep 5 files
	Read a capture back
	Filter while reading (filters work on files too)
	Cut a big capture down to one host

The pcap format is Wireshark's native format: capture on the server with , the file to your machine, and open it in Wireshark for the graphical view.

Reading Packet Contents

Command	What it does
	Print payloads as ASCII (readable HTTP)
	Hex and ASCII side by side
	Full payloads; without long packets are cut off
	Hex including the ethernet header

TLS traffic on 443 shows only gibberish with . That is the encryption working, not a tcpdump problem.

MAC Address Filters

For layer 2 problems: DHCP fights, ARP mysteries, finding a device with no IP yet.

Command	What it does
	Traffic to or from one MAC
	Frames sent by a MAC
	Show MAC addresses on every line
	Broadcast frames only

BPF Syntax

Filters compile to Berkeley Packet Filter programs, and the bracket syntax reads raw bytes: is a byte within that protocol's header. The practical use is matching TCP flags.

Filter	What it matches
	Any packet with SYN set (new connections)
	SYN only, no ACK (inbound connection attempts)
	Same, spelled with a mask
	Resets (something refusing connections)
	Connection teardowns
	SYN again, by raw offset (13 is the flags byte)

# Who is trying to open connections to this box, live:
sudo tcpdump -i any -n 'tcp[tcpflags] == tcp-syn'

# Check what a filter compiles to without capturing:
sudo tcpdump -d 'tcp[tcpflags] & tcp-syn != 0'

Gotchas

at the end means tcpdump could not keep up. Add , write to a file with instead of printing, and narrow the filter; raises the capture buffer.
is usually the shell eating your quotes. Wrap any multi-word filter in single quotes, and check keywords (, not ).
Capturing over SSH shows you your own SSH packets, which generate more packets, forever. Start every remote capture with .
sees all interfaces but cannot use promiscuous mode, so it misses traffic not addressed to the host. Switch to the real interface once you know it.
Old tcpdump versions truncated packets at 68 bytes by default. Modern ones capture full packets, but still makes the intent explicit for files headed to Wireshark.
tcpdump shows packets arriving; it does not show what the firewall then drops. Compare with your iptables rules when packets arrive but the service never sees them, and check what is listening with ss.

tcpdump Cheat Sheet FAQ

What does packets dropped by kernel mean in tcpdump?

The kernel captured packets faster than tcpdump could process them, so some never made it into your output or file. The counter at the end (captured / received by filter / dropped by kernel) tells you how bad it was. The usual causes are name resolution and screen output slowing tcpdump down. Add -n so it stops resolving every IP and port, write to a file with -w instead of printing, and tighten the filter so fewer packets match. If drops persist on a busy box, raise the buffer with -B 4096 (the size is in KiB).

Why does tcpdump say syntax error in filter expression?

The filter reached the BPF compiler in a shape it does not accept, and the shell is the usual culprit. Anything with and, or, parentheses, or brackets must be quoted, so the shell does not eat it: tcpdump -i any 'port 80 and host 10.0.0.5'. Other common causes: a keyword that does not exist (use portrange 8000-8100, not port-range), putting the protocol after the qualifier (tcp port 80 works, port 80 tcp does not), and misspelling a primitive. Test a filter without capturing by adding -d, which prints the compiled program or the same error.

What is the difference between host, src, and dst in tcpdump?

host 10.0.0.5 matches packets where that address is either end, source or destination. src host 10.0.0.5 matches only packets coming from it, and dst host 10.0.0.5 only packets going to it. The same qualifiers work for ports and networks: src port 22, dst net 10.0.0.0/24. Unqualified port 22 means src or dst port 22. For a conversation between two machines, combine them: tcpdump 'host 10.0.0.5 and host 10.0.0.9' shows only traffic between that pair.

How do I open a tcpdump capture in Wireshark?

Capture with -w and full packets, then copy the file to your desktop and open it: sudo tcpdump -i eth0 -s0 -w capture.pcap, Ctrl+C to stop, then scp user@host:capture.pcap . and File > Open in Wireshark. The -s0 matters, because a truncated snapshot length leaves Wireshark with half-parsed packets. On a long capture, cap the file count with -W and rotate with -C so you do not fill the disk. Wireshark reads .pcap and .pcapng directly, and you can pre-filter a huge file down first with tcpdump -r big.pcap 'port 443' -w small.pcap.

Which interface should I capture on with tcpdump?

Run tcpdump -D to list what the kernel offers, then pass one with -i eth0. When you do not know where the traffic flows, -i any captures on every interface at once, which is the right first move on a machine with Docker bridges, VPN tunnels, or multiple NICs. The tradeoff: -i any cannot put interfaces into promiscuous mode, so it only sees traffic addressed to the host, and on older kernels it used a cooked capture format that changes the link-layer header in saved files. Once you know the interface, switch to it directly.