tcpdump Cheat Sheet

tcpdump is the command-line packet capture tool that ships with, or is one install away on, almost every Linux and macOS machine. This tcpdump cheat sheet is the set of commands you actually reach for: picking an interface, making the output readable, filtering by host, port and protocol, saving and reading capture files, and the first security questions worth asking of a network. Every command copies with one click.

NyxHe made a cheat sheet so he’d never have to remember these flags. Bold of him to assume he’ll open it.

Swap eth0 for your own interface name (the first command below lists them). Capturing needs root, so most lines start with sudo; reading a saved file does not.

Pick an interface and start

List the interfaces tcpdump can capture on:

$ sudo tcpdump -D

Capture everything on one interface (press Ctrl+C to stop):

$ sudo tcpdump -i eth0

Capture on every interface at once (Linux):

$ sudo tcpdump -i any

Stop by itself after 100 packets:

$ sudo tcpdump -i eth0 -c 100

Make the output readable

Skip DNS and port-name lookups — faster, and tcpdump stops generating its own DNS traffic. Use this on almost every capture:

$ sudo tcpdump -i eth0 -nn

More protocol detail (add more vs for more):

$ sudo tcpdump -i eth0 -nn -v

Show each packet’s contents in hex and ASCII:

$ sudo tcpdump -i eth0 -nn -X

Contents as ASCII only — handy for plain-text protocols:

$ sudo tcpdump -i eth0 -nn -A

Include MAC addresses (the link-layer header):

$ sudo tcpdump -i eth0 -nn -e

Full date and time on every line instead of time of day:

$ sudo tcpdump -i eth0 -nn -tttt

Filter by host and network

Traffic to or from one address:

$ sudo tcpdump -i eth0 -nn host 192.168.1.10

Only traffic that address sends:

$ sudo tcpdump -i eth0 -nn src host 192.168.1.10

Only traffic sent to it:

$ sudo tcpdump -i eth0 -nn dst host 192.168.1.10

A whole subnet:

$ sudo tcpdump -i eth0 -nn net 192.168.1.0/24

Filter by port and protocol

One port, either direction:

$ sudo tcpdump -i eth0 -nn port 53

A range of ports:

$ sudo tcpdump -i eth0 -nn portrange 8000-8100

TCP only, one port:

$ sudo tcpdump -i eth0 -nn tcp port 443

Pings and other ICMP:

$ sudo tcpdump -i eth0 -nn icmp

ARP — who is asking for which address on the local network:

$ sudo tcpdump -i eth0 -nn arp

Combine conditions. Single-quote any filter that uses brackets:

$ sudo tcpdump -i eth0 -nn 'host 192.168.1.10 and (port 80 or port 443)'

Everything except your own SSH session, so the capture doesn’t fill with itself:

$ sudo tcpdump -i eth0 -nn 'not port 22'

Filter by TCP flags

New connection attempts only (SYN set, ACK not set):

$ sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'

Resets — refused or torn-down connections:

$ sudo tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-rst != 0'

Save and read capture files

Write packets to a file instead of the screen:

$ sudo tcpdump -i eth0 -nn -w capture.pcap

Read a saved file back (no root needed). Wireshark opens the same file:

$ tcpdump -nn -r capture.pcap

Apply a filter while reading:

$ tcpdump -nn -r capture.pcap 'port 53'

Ring buffer: ten files of about 100 MB each, oldest overwritten, so a long capture never fills the disk:

$ sudo tcpdump -i eth0 -nn -w ring.pcap -C 100 -W 10

A new file every hour, named by the time it started:

$ sudo tcpdump -i eth0 -nn -G 3600 -w capture-%Y%m%d-%H%M.pcap

Security questions to ask first

Every DNS lookup on the network, live. Unfamiliar or random-looking domains are worth a second look:

$ sudo tcpdump -i eth0 -nn -l port 53

Plain-text web requests. Anything here crossed the network unencrypted. The -l flag makes the pipe to grep work live:

$ sudo tcpdump -i eth0 -nn -l -A 'tcp port 80' | grep -E 'GET |POST |Host:'

Traffic leaving for the internet — anything not headed to a private address range:

$ sudo tcpdump -i eth0 -nn 'not (dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16)'

New devices asking for an address (DHCP):

$ sudo tcpdump -i eth0 -nn -v 'port 67 or port 68'

A burst of SYNs from one source to many ports, using the SYN filter above, is what a port scan looks like from the receiving end. Run Lab 01 in one terminal and this capture in another to see it.

Gotchas

• Slow output, or tcpdump creating its own DNS noise — you forgot -nn.
• “Permission denied” writing a file. On many distros tcpdump drops to its own user after opening the interface. Write into /tmp, or add -Z $USER.
• Filters with brackets, ! or & must be in single quotes, or the shell eats them first.
• On a switched network you only see your own traffic, plus broadcasts. Seeing other devices needs a mirror (SPAN) port on the switch, or capturing on the router itself.
• HTTPS shows who and when, not what. Payloads are encrypted, though the server name usually appears in the TLS handshake.
• -i any drops MAC addresses on Linux, so -e shows nothing useful there.

Where to go next

• Lab 01 — Your First Scan — make some traffic, then watch it here
• Nmap cheat sheet — the other side of the SYN filter
• Common ports cheat sheet — what usually lives on the port you just filtered
• Run your own DNS resolver — then watch its queries with port 53
• Lab 08 — Enroll a Wazuh agent — the same questions, answered by a SIEM

Original reference, checked against the tcpdump and pcap-filter manual pages. Last verified Sep 2026. Spotted something that no longer matches your system? Tell me and I will fix it.