tcpdump is a tool that may be used to inspect network traffic and is compatible with operating systems that are similar to Unix (such as Linux and Mac OS).
The tcpdump programme is a command line application that is available for free download and installation.
Because it is not typically incorporated into operating systems, you will need to download it from the tcpdump GitHub repository or the official website for tcpdump in order to install it.
Components that make up tcpdump
The C/C++ library of procedures known as libpcab is the source of the packet capture utility that is made available for usage by tcpdump. The interface for the process of packet capture is provided by the primary tcpdump programme. When you launch it, it will begin the libcap process, which will collect network packets and then show the contents of the captured packets on the screen. When the programme is started, if a cap on the total number of packets that are to be captured is not set, the programme will continue to run indefinitely. A signal that serves as an interrupt then brings an end to the processing (Control-C).
The programme can be executed via the command line and comes with a number of different parameters, which are denoted using flags. These flags cause the programme to behave differently by telling it to choose only those packets that fit a particular pattern, to limit the amount of time it can run for, or to read previously saved packets from a file rather than directly from the network interface.
Tcpdump format
The tcpdump command can be run by itself, with options, parameters, and/or regular expressions, or it can be run with all of these things together. There is no requirement to include any of these components, nor does the order matter.
tcpdump <-option identifier> <option name> <parameter> <parameter value> <regular expressions>
Options for Tcpdump
The tcpdump command is followed by a list of parameters, which may sometimes be referred to as flags. A hyphen is followed by the appropriate letter to represent each of these. The names of all of these flags are listed down below.
-A print packets in ASCII without the link-level headers
-b show the AS number is ASDOT format
-B buffer_size in units of KiB (1024 bytes
-c count – the limit of packets to capture
-C file_size – the process will create a new file once this file size limit is filled; Size is x 1 million bytes
-d Dump the compiled packet-matching code in ASCII
-dd Dump packet-matching code as a C program fragment
-ddd Dump packet-matching code as decimal numbers preceded with a count
-D List all accessible interfaces
-e Print the link-level header on each dump line
-E spi@ipaddr algo:secret – for decrypting IPsec ESP packets:
spi is the Security Parameter Index
ipaddr is the destination address on the packet
algo is the algorithm, defaulted to des-cbc and the field is optional.
Possible values are:
• des-cbc
• 3des-cbc
• blowfish-cbc
• rc3-cbc
• cast128-cbc
secret is the ASCII text for ESP secret key. If preceded by 0x, then it is a hex value
-f Print `foreign’ IPv4 addresses numerically rather than symbolically
-F file – use file as input for the filter expression
-G rotate_seconds – period to rotate save file of -w option, will add timestamp to name
-h Print the tcpdump and libpcap version strings, print a usage message, and exit
-H Detect 802.11s draft mesh headers
-i interface – the interface on which to listen, defaults to lowest name alphabetically
-I monitor-mode | immediate-mode – removes buffering
-j tstamp_type – set the timestamp type for the capture to tstamp_type
-J tstamp_precision – set the time stamp precision (micro or nano) default is micro. If tstamp_precision is null, list timestamp types and exit
-K Don’t verify checksums
-l Stdout line buffered. E.g. tcpdump -l | tee dat or tcpdump -l > dat & tail -f dat
-L List the known data link types for the interface, in the specified mode, and exit
-m module – load SMI MIB module definitions from file module.
-M secret – shared secret value for validating with the TCP-MD5 option
-n Don’t convert addresses (i.e. host addresses, port numbers, etc.) to names
-N Don’t print domain name qualification of host names
-# Print an optional packet number at the beginning of the line
-O Don’t run the packet-matching code optimizer
-p Don’t put the interface into promiscuous mode
-Q direction – send/receive direction. Can be in, out, or inout
-q Print less protocol information
-r file – read packets from file. Specify – for standard input
-S Print absolute TCP sequence numbers
-s snaplen – snarf snaplen bytes from each packet, not the default 262144 bytes
-T type – interpret packets as the specified type. Options are:
• aodv Ad-hoc On-demand Distance Vector Protocol
• carp Common Address Redundancy Protocol
• cnfp Cisco NetFlow Protocol
• lmp Link Management Protocol
• pgm Pragmatic General Multicast
• pgm_zmtp1 ZMTP/1.0 inside PGM/EPGM)
• resp REdis Serialization Protocol
• radius RADIUS
• rpc Remote Procedure Call
• rtp Real-Time Applications protocol
• rtcp Real-Time Applications control protocol
• snmp Simple Network Management Protocol
• tftp Trivial File Transfer Protocol
• vat Visual Audio Tool
• wb distributed White Board
• zmtp1 ZeroMQ Message Transport Protocol 1.0
• vxlan Virtual eXtensible Local Area Network
-t Don’t print a timestamp on each dump line
-tt Print the timestamp as offset since January 1, 1970 on each dump line
-ttt Print a delta (micro-second resolution) between current and previous line
-tttt Print a timestamp: date, hour, minute, second on each dump line
-ttttt Print a delta (micro-second resolution) between current and first line
-u Print undecoded NFS handles
-U Packet buffered
-v Slightly more verbose output
-vv More verbose output
-vvv Most verbose output
-V file – read a list of filenames from file. Standard input is used if file is –
-w file – write output to file
-W limit – the maximum number of files to be created by the -C and -G options
-x Print the data of each packet minus its link level header in hex
-xx Print the data of each packet, including its link level header, in hex
-X Print the data of each packet minus its link level header in hex and ASCII
-XX Print the data of each packet, including its link level header, in hex and ASCII.
-y datalinktype – Set the data link type to use while capturing packets to datalinktype
-z postrotate-command – process save files usually with compression, eg -z gzip
-Z user – change the user ID to user and the group ID to the primary group of user
Tcpdump parameters
Primitives are another name for the parameters that are used with tcpdump. These indicate whether the packet capture should only receive data sourced from the given hosts. You can alternatively define these factors as conditions by using the Boolean operators and, or, and not. You are not required to insert an equals sign (=) between the parameter name and its value, nor are you required to put any punctuation marks between the parameters themselves. In every circumstance, all that is required is a space.
The host parameter is the one that is utilised the most frequently since it enables the user to restrict the capture to only include transmissions from a single source. It is possible to use a device’s address in place of its name as a parameter value in each and every scenario. In cases where a parameter has a dst version, the output is restricted to just packets that have that attribute for their destination when that variation is used. src parameters conduct a search for data packets that contain the specified value and are related to the source of the packets’ data.
Here are the parameter options:
host host_name – also dst host or src host.
Can also be prepended with ip, arp, or rarp
ether ehost – value from /etc/ethers or a number. Also ether src and ether dest.
gateway host – get packets that passed through gateway host
net network_num – source or destination IP includes network_num Also dst net and src net
port number|name – also dst port and src port. Can be with tcp or udp to limit protocol
ip proto protocol – capture IP packets of the named protocol. Name must be in /etc/protocols
ether proto protocol – capture packet of ether protocol type. Options for protocol are a number or:
• ip
• ip6
• arp
• rarp
• atalk
• atalkarp
• decnet
• decdts
• decdns
• lanbridge
• lat
• mopdl
• moprc
• pup
• sca
• sprite
• stp
• vexp
• vprod
• xns
Broadcast Captures Ethernet broadcast packets. Also written as ether broadcast
ip broadcast Captures ip broadcast packets
multicast Captures Ethernet multicast packets. Also written as ether multicast
ip multicast Captures IP multicast packets
decnet host host_name – if either the DECNET source or destination is host_name
decnet src host_name – capture if DECNET source is host_name
decnet dst host_name – capture if DECNET destination is host_name
wlan host ehost – if the first, second, third, or fourth IEEE 802.11 address is ehost
wlan addr1 ehost – capture if the first IEEE 802.11 address is ehost
wlan addr2 ehost – capture if the second IEEE 802.11 address is ehost
wlan addr3 ehost – capture if the third IEEE 802.11 address is ehost
wlan addr4 ehost – if the fourth IEEE 802.11 address is ehost. Only used for WDS
type type – capture if the IEEE 802.11 frame type is type, which is a number or:
• data
• mgt
• ctl
subtype subtype – capture if the IEEE 802.11 frame is subtype, which is a number or:
• assocreq
• assocresp
• reassocreq
• reassocresp
• probereq
• proberesp
• beacon
• atim
• disassoc
• auth
• deauth
• data
dir dir – capture if the IEEE 802.11 frame direction is dir, which is a number or:
• nods
• tods
• fromds
• dstods
Tcpdump expression
You are able to add some degree of programming to the packet selection process by utilising the expressions section of a tcpdump command. However, as contrast to a typical computer programme, these specific instructions have to be typed out on a single line. If you use Unix or Linux on a regular basis, you will be familiar with the regular expressions used in shell scripting, and you should have no trouble comprehending the structure of these filters because of this familiarity.
Only those packets will be recorded that are able to pass the test outlined by the phrase. Therefore, the answer to each phrase must always be “true.”
There are a few expression conditions that are rarely seen in shell scripting, and I have included them here for your convenience:
len
This returns the length of a packet. Usage example: len != 5.
proto[expr:size]
In this object:
proto is the name of a protocol layer. It can be:
• ether
• fddi
• ip
• arp
• rarp
• tcp
• udp
• icmp
expr is the byte offset. This needs to be included, but it can be given as 0 in order to take the value from the beginning of the object.
size is optional and it represents the number of bytes in the option. The default value is 1, but it can also be 2, 3, or 4.
Usage examples:
ether[0] & 1 != 0 is true for all multicast traffic.
ip[0] & 0xf != 5 is true for all IP packets with options.
ip[6:2] & 0x1fff = 0 is true for unfragmented datagrams and frag zero of fragmented datagrams.
Tcpdump examples
The results of the command will always be displayed on the screen, unless a file-related option is supplied in the command, the command is started with a stand output redirect, or it is piped to a file. In any of these scenarios, the file-related option must be present.
Show data packets that are being sent or received by the computer that is labelled as lab1:
tcpdump on host lab1’s traffic
Show all IP packets that are travelling between lab1 and any other node besides the reception node:
tcpdump ip host lab1 and not reception
Display all ftp traffic through internet gateway styx:
tcpdump ‘gateway styx and (port ftp or ftp-data)’
Display the SYN and FIN packets of each TCP conversation that involves a non-local host:
tcpdump ‘tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet’
Display IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
tcpdump ‘ether[0] & 1 = 0 and ip[16] >= 224’
Tcpdump output format
The record format that is used to write network packets to files has become a standard that has been adopted by many modern packet sniffers and traffic analyzers. This has led to the creation of a standard for writing network packets to files.
The standard is not easy to understand and needs to be modified for each protocol. On the other hand, programmes that have embraced the format also take these changes into consideration. The name of the format is pcap, which is also the name of the procedure that tcpdump uses to capture packets of data. The extension.pcap is often appended to files that are saved in this format.
Tcpdump for Windows
There is an adaptation of tcpdump that runs on Windows. This is called WinDump and it relies on WinPcap for packet capture in the same way that tcpdump uses the pcap function of libpcap. WinPcap is actually owned by Riverbed Technology. This same company is the primary funder of Wireshark, which is probably the most famous and widely-used packet sniffer in the world. There is a wireless version of WinPcap, which is called AirPcap. You can download WinDump, WinPcap, and AirPcap for free from the WinPcap website.
Using packet sniffers
The tcpdump command line utility is useful for those who are familiar with the Unix and Linux operating systems and enjoy writing shell scripts. Those who are not so experienced at putting together commands with regular expressions at the command line will find it difficult to use this program.
You have other options because there are many packet sniffers available, such as Wireshark, which was mentioned above. You can find out more about alternatives to tcpdump in this review of packet sniffers.
Do you have a favorite packet sniffer? Are you a fan of tcpdump, or do you prefer more user-friendly alternatives? Leave a message in the Comments section below and share your experiences.
tcpdump FAQs
What is the difference between Wireshark and tcpdump?
Both Wireshark and tcpdump capture packets. On that level, both of these tools are the same. However, Wireshark has a DUI interface that includes packet analysis functions. Tcpdump is a command line utility. It has fewer features and it is harder to use.
How do I kill a tcpdump process?
Usually, entering Control-C will stop the tcpdump process. If that doesn’t work, find the process id of the tcpdump process with the ps -aux command, then type in kill -9 followed by the process ID and hit return.
Where are tcpdump files stored?
Unless you specify a directory and file name where tcpdump records should be stored, the file will be written to the directory that you were in when you ran tcpdump. You can specify where tcpdump should store captured packets with sudo tcpdump -i 1 -w followed by the path and filename.
