tcpdump

tcpdump#

tcpdump is the operator’s go-to packet capture utility on Linux and macOS. This page covers basic filters, protocol selection, boolean composition, and a set of advanced BPF expressions that target specific TCP / IP fields.

Basic#

Command

Effect

tcpdump -i eth1 host 192.168.1.1

Match any traffic involving 192.168.1.1 as destination or source.

tcpdump -i eth1 src host 192.168.1.1

Match a particular source only.

tcpdump -i eth1 dst host 192.168.1.1

Match a particular destination only.

tcpdump -i eth1 port 25

Match any traffic involving port 25 as source or destination.

tcpdump -i eth1 src port 25

Source port 25.

tcpdump -i eth1 dst port 25

Destination port 25.

tcpdump -i eth1 net 192.168

Match network 192.168.

tcpdump -i eth1 src net 192.168

Source network.

tcpdump -i eth1 dst net 192.168

Destination network.

Protocol#

$ tcpdump -i eth1 arp
$ tcpdump -i eth1 ip
$ tcpdump -i eth1 tcp
$ tcpdump -i eth1 udp
$ tcpdump -i eth1 icmp

Boolean#

Negation ! or not, concatenate && or and, alternate || or or.

Match TCP traffic on port 80 to 192.168.1.254 or 192.168.1.200.

$ tcpdump -i eth1 '((tcp) and (port 80) and ((dst host 192.168.1.254) or (dst host 192.168.1.200)))'

Match ICMP traffic to a specific MAC.

$ tcpdump -i eth1 '((icmp) and ((ether dst host 00:01:02:03:04:05)))'

Match any traffic to a destination network except a specific host.

$ tcpdump -i eth1 '((tcp) and (dst net 192.168) and (not dst host 192.168.1.200))'

Advanced#

Command

Effect

tcpdump -i eth1 'ip[0] & 15 > 5'

Match IP header has options set (binary).

tcpdump -i eth1 'ip[0] & 0xf > 5'

Match IP header has options set (hex).

tcpdump -i eth1 'ip[6] = 64'

Match any fragmentation occurring.

tcpdump -i eth1 '((ip[6:2] > 0) and (not ip[6] = 64))'

Match the fragments and the last fragments.

tcpdump -i eth1 'ip[8] < 5'

Match traceroute usage on the network.

tcpdump -i eth1 'ip[2:2] > 600'

Match packets longer than 600 bytes.

tcpdump -i eth1 'tcp[0:2] > 1024'

Match any TCP traffic with a source port > 1024.

tcpdump -i eth1 'tcp[13] = 2'

Match packets with only SYN flag set.

tcpdump -i eth1 'tcp[13] = 18'

Match SYN, ACK (00010010 or 18 in decimal).

tcpdump -i eth1 'tcp[13] & 2 = 2'

Match either SYN only or SYN-ACK datagrams.

tcpdump -i eth1 'tcp[13] = 24'

Match PSH-ACK packets.

tcpdump -i eth1 'tcp[13] & 1 = 1'

Match any combination containing FIN.

tcpdump -i eth1 'tcp[13] & 4 = 4'

Match RST flag.

tcpdump -i eth1 'tcp[tcpflags] == tcp-ack'

Easier way to filter flags.

tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'

Match all packages with TCP-SYN or TCP-FIN set.

tcpdump -i eth1 '((port 25) and (tcp[20:4] = 0x4d41494c))'

Match any packet containing the MAIL command from SMTP exchanges.

tcpdump -i eth1 'tcp[32:4] = 0x47455420'

Match any packets containing GET requests.

tcpdump -i eth1 'tcp[(tcp[12]>>2):4] = 0x5353482D'

SSH connection on any port (look for SSH- 0x5353482D reply).

tcpdump -i eth1 '(tcp[(tcp[12]>>2):4] = 0x5353482D) and (tcp[((tcp[12]>>2)+4):2] = 0x312E)'

Find connections to older OpenSSH (1.99..).

tcpdump -i eth1 'icmp[0] = 4'

Match ICMP messages type 4 (congestion).

References#

Contents