{"id":9329,"date":"2020-10-18T14:45:12","date_gmt":"2020-10-18T11:45:12","guid":{"rendered":"https:\/\/unihost.com\/help\/?p=9329"},"modified":"2023-01-19T13:59:37","modified_gmt":"2023-01-19T10:59:37","slug":"how-to-use-tcpdump","status":"publish","type":"post","link":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/","title":{"rendered":"How to use TCPDUMP"},"content":{"rendered":"

TCPDUMP is a tool that is used to analyze TCP\/IP packets. It was first released in 1988 and has since become a very powerful and widely used traffic analyzer on Linux as well as many other operating systems.<\/span><\/p>\n

TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic by interface, host, destination or source host, traffic type, and many other criteria. During troubleshooting, this helps to isolate only those packets that are relevant to you, so as not to be overwhelmed by the stream of bits and bytes.<\/span><\/p>\n

In this post, we’ll go over a list of very common tcpdump options to get you started. This will give you a good idea of \u200b\u200bhow much help you can get from it.<\/span><\/p>\n

In most cases, to use tcpdump, you must be root or run commands with the “sudo” keyword. This is because the packet capture mechanism requires elevated privileges. So, if you run the tcpdump command and you get no results, you may need to run it as superuser. However, tcpdump will actually notify you of the need for elevated privileges.<\/span><\/p>\n

Traffic on all interfaces<\/span><\/h5>\n

This command will give you all the traffic that goes in and out of all interfaces:<\/span><\/p>\n

sudo tcpdump<\/span><\/pre>\n
\"How<\/span><\/p>\n
The screen will display information about packages until you press Ctrl+C. Alternatively, you can use the ‘-c’ option to dump a certain number of packages (for example, tcpdump -c 10).<\/span>
Let’s take a look at one of the packages above to understand what each field is:<\/span><\/p>\n
11: 16: 20.681353: – packet timestamp;<\/span>
System.44956: – the package was generated by the operating system and the source port;<\/span>
192.168.6.114.ssh: – destination IP address and port (ssh means port 22);<\/span>
Flags [S]: – any TCP flags;<\/span>
seq 3135937357: – starting sequence number of the TCP packet;<\/span>
win 64240: – TCP window;<\/span>
length 0: – TCP packet length (in bytes) without headers.<\/span><\/p>\n
Let’s see how we can use some filters to narrow down the traffic we want to check.<\/span><\/p>\n
Specific interface<\/span><\/strong><\/p>\n
tcpdump -i enp3s0<\/span><\/pre>\n
It shows all traffic in and out of the \u201cenp3s0\u201d interface:<\/span><\/p>\n
\"How<\/span><\/p>\n
tcpdump host 8.8.8.8<\/span>
tcpdump src host 8.8.8.8<\/span>
tcpdump dst host 8.8.8.8<\/span><\/pre>\n
It shows all traffic associated with host 8.8.8.8, all traffic coming from 8.8.8.8, and all traffic that goes to 8.8.8.8.<\/span><\/p>\n
Specific port<\/strong><\/span><\/p>\n
tcpdump port 22<\/span>
tcpdump dst port 22<\/span>
tcpdump src port 22<\/span>
tcpdump portrange 22-30<\/span><\/pre>\n
Human readable format<\/span><\/strong><\/p>\n
tcpdump -A<\/span><\/pre>\n
It shows all packages in ASCII format. This way you can read the actual payload of the packages whenever possible.<\/span><\/p>\n
Encrypted\/unencrypted traffic<\/strong><\/span><\/p>\n
As an example, let’s use tcpdump to see what unencrypted HTTP and encrypted HTTPS traffic looks like at the packet level. Here are the steps on how to do it:<\/span><\/p>\n
Login to Linux host with two different sessions<\/span>
In one session, run the command:<\/span><\/p>\n
tcpdump port 80 -A<\/span><\/pre>\n
In another session, run:<\/span><\/p>\n
curl google.com<\/span><\/pre>\n
You will see that some of the output looks like this:<\/span><\/p>\n
\"How<\/p>\n
As you can see, the raw output of the unencrypted google.com page can be displayed clearly. Consequently, the content of any unencrypted message can be intercepted.<\/span><\/p>\n
Let’s see what encrypted communication looks like. Let’s do the following:<\/span><\/p>\n
Login to Linux host with two different sessions<\/span>
In one session, run the command:<\/span><\/p>\n
tcpdump port 443 -A<\/span><\/pre>\n
In another session, run the command:<\/span><\/p>\n
curl https:\/\/google.com<\/span><\/pre>\n
The output is filled with packages that look like this:<\/span><\/p>\n
\"How<\/p>\n
This is unreadable encrypted content for HTTPS communication.<\/span><\/p>\n
More detailed tspdump description on the project page TCPDUMP<\/a><\/span><\/p>\n
\u00a0<\/p>\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
TCPDUMP is a tool that is used to analyze TCP\/IP packets. It was first released in 1988 and has since become a very powerful and widely used traffic analyzer on Linux as well as many other operating systems.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[158],"tags":[648,646,647],"class_list":["post-9329","post","type-post","status-publish","format-standard","hentry","category-dedicated-servers","tag-analyze","tag-tcpdump","tag-troubleshooting"],"yoast_head":"\nHow to use TCPDUMP - Unihost.FAQ<\/title>\n<meta name=\"description\" content=\"TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to use TCPDUMP - Unihost.FAQ\" \/>\n<meta property=\"og:description\" content=\"TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\" \/>\n<meta property=\"og:site_name\" content=\"Unihost.FAQ\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/unihost\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-10-18T11:45:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-19T10:59:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png\" \/>\n<meta name=\"author\" content=\"Unihost Support\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@unihost\" \/>\n<meta name=\"twitter:site\" content=\"@unihost\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Unihost Support\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\"},\"author\":{\"name\":\"Unihost Support\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a\"},\"headline\":\"How to use TCPDUMP\",\"datePublished\":\"2020-10-18T11:45:12+00:00\",\"dateModified\":\"2023-01-19T10:59:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\"},\"wordCount\":541,\"publisher\":{\"@id\":\"https:\/\/unihost.com\/help\/#organization\"},\"image\":{\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png\",\"keywords\":[\"analyze\",\"tcpdump\",\"troubleshooting\"],\"articleSection\":[\"02. Dedicated servers\"],\"inLanguage\":\"en\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\",\"url\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\",\"name\":\"How to use TCPDUMP - Unihost.FAQ\",\"isPartOf\":{\"@id\":\"https:\/\/unihost.com\/help\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png\",\"datePublished\":\"2020-10-18T11:45:12+00:00\",\"dateModified\":\"2023-01-19T10:59:37+00:00\",\"description\":\"TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic\",\"breadcrumb\":{\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage\",\"url\":\"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png\",\"contentUrl\":\"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Unihost\",\"item\":\"https:\/\/unihost.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Help\",\"item\":\"https:\/\/unihost.com\/help\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How to use TCPDUMP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/unihost.com\/help\/#website\",\"url\":\"https:\/\/unihost.com\/help\/\",\"name\":\"Unihost.FAQ\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/unihost.com\/help\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/unihost.com\/help\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/unihost.com\/help\/#organization\",\"name\":\"Unihost\",\"alternateName\":\"Unihost\",\"url\":\"https:\/\/unihost.com\/help\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png\",\"contentUrl\":\"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png\",\"width\":300,\"height\":300,\"caption\":\"Unihost\"},\"image\":{\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/unihost\/\",\"https:\/\/x.com\/unihost\",\"https:\/\/www.instagram.com\/unihost\/?hl=en\",\"https:\/\/www.linkedin.com\/company\/unihost-com\",\"https:\/\/www.youtube.com\/channel\/UCITKsxMDnslQY8brN3advgw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a\",\"name\":\"Unihost Support\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g\",\"caption\":\"Unihost Support\"},\"sameAs\":[\"https:\/\/unihost.com\/\"],\"url\":\"https:\/\/unihost.com\/help\/author\/support\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to use TCPDUMP - Unihost.FAQ","description":"TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/","og_locale":"en_US","og_type":"article","og_title":"How to use TCPDUMP - Unihost.FAQ","og_description":"TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic","og_url":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/","og_site_name":"Unihost.FAQ","article_publisher":"https:\/\/www.facebook.com\/unihost\/","article_published_time":"2020-10-18T11:45:12+00:00","article_modified_time":"2023-01-19T10:59:37+00:00","og_image":[{"url":"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png","type":"","width":"","height":""}],"author":"Unihost Support","twitter_card":"summary_large_image","twitter_creator":"@unihost","twitter_site":"@unihost","twitter_misc":{"Written by":"Unihost Support","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#article","isPartOf":{"@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/"},"author":{"name":"Unihost Support","@id":"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a"},"headline":"How to use TCPDUMP","datePublished":"2020-10-18T11:45:12+00:00","dateModified":"2023-01-19T10:59:37+00:00","mainEntityOfPage":{"@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/"},"wordCount":541,"publisher":{"@id":"https:\/\/unihost.com\/help\/#organization"},"image":{"@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage"},"thumbnailUrl":"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png","keywords":["analyze","tcpdump","troubleshooting"],"articleSection":["02. Dedicated servers"],"inLanguage":"en"},{"@type":"WebPage","@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/","url":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/","name":"How to use TCPDUMP - Unihost.FAQ","isPartOf":{"@id":"https:\/\/unihost.com\/help\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage"},"image":{"@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage"},"thumbnailUrl":"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png","datePublished":"2020-10-18T11:45:12+00:00","dateModified":"2023-01-19T10:59:37+00:00","description":"TCPDUMP allows you to listen for all inbound and outbound traffic from all interfaces. More importantly, it can filter traffic","breadcrumb":{"@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unihost.com\/help\/how-to-use-tcpdump\/"]}]},{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#primaryimage","url":"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png","contentUrl":"https:\/\/unihost.com\/help\/wp-content\/uploads\/Screenshot-at-13-55-08.png"},{"@type":"BreadcrumbList","@id":"https:\/\/unihost.com\/help\/how-to-use-tcpdump\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Unihost","item":"https:\/\/unihost.com\/"},{"@type":"ListItem","position":2,"name":"Help","item":"https:\/\/unihost.com\/help\/"},{"@type":"ListItem","position":3,"name":"How to use TCPDUMP"}]},{"@type":"WebSite","@id":"https:\/\/unihost.com\/help\/#website","url":"https:\/\/unihost.com\/help\/","name":"Unihost.FAQ","description":"","publisher":{"@id":"https:\/\/unihost.com\/help\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unihost.com\/help\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":"Organization","@id":"https:\/\/unihost.com\/help\/#organization","name":"Unihost","alternateName":"Unihost","url":"https:\/\/unihost.com\/help\/","logo":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/","url":"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png","contentUrl":"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png","width":300,"height":300,"caption":"Unihost"},"image":{"@id":"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/unihost\/","https:\/\/x.com\/unihost","https:\/\/www.instagram.com\/unihost\/?hl=en","https:\/\/www.linkedin.com\/company\/unihost-com","https:\/\/www.youtube.com\/channel\/UCITKsxMDnslQY8brN3advgw"]},{"@type":"Person","@id":"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a","name":"Unihost Support","image":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/unihost.com\/help\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g","caption":"Unihost Support"},"sameAs":["https:\/\/unihost.com\/"],"url":"https:\/\/unihost.com\/help\/author\/support\/"}]}},"_links":{"self":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts\/9329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/comments?post=9329"}],"version-history":[{"count":11,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts\/9329\/revisions"}],"predecessor-version":[{"id":9355,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts\/9329\/revisions\/9355"}],"wp:attachment":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/media?parent=9329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/categories?post=9329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/tags?post=9329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}