Tcpdump Tutorial: Complete Guide

1️⃣ Introduction

Tcpdump is a powerful command-line packet analyzer. This guide covers everything you need to know about capturing and analyzing network traffic with tcpdump.

Key areas covered:

  • Basic Usage
  • Capture Filters
  • Display Filters
  • Protocol Analysis
  • Advanced Features
  • Best Practices

2️⃣ Basic Usage

🔹 Capturing Packets

# List available interfaces
tcpdump -D

# Capture on specific interface
tcpdump -i eth0

# Capture with verbose output
tcpdump -i eth0 -v

# Save capture to file
tcpdump -i eth0 -w capture.pcap

# Read from capture file
tcpdump -r capture.pcap

# Display packet contents
tcpdump -i eth0 -X

# Limit number of packets
tcpdump -i eth0 -c 100

🔹 Basic Filters

# Capture only TCP traffic
tcpdump -i eth0 tcp

# Capture traffic on specific port
tcpdump -i eth0 port 80

# Capture traffic to/from host
tcpdump -i eth0 host 192.168.1.1

# Capture specific protocol
tcpdump -i eth0 icmp

# Combine filters
tcpdump -i eth0 'tcp and port 80'

# Source/destination filters
tcpdump -i eth0 src host 192.168.1.1
tcpdump -i eth0 dst port 443

3️⃣ Advanced Filters

🔹 Complex Expressions

# TCP flags
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn) != 0'

# Packet size filters
tcpdump -i eth0 'len > 1000'

# MAC address filters
tcpdump -i eth0 'ether host 00:11:22:33:44:55'

# VLAN filters
tcpdump -i eth0 'vlan 100'

# Complex boolean logic
tcpdump -i eth0 '(tcp and port 80) or (udp and port 53)'

# Packet content matching
tcpdump -i eth0 'tcp[32:4] = 0x47455420'  # GET

🔹 Protocol Analysis

# HTTP traffic
tcpdump -i eth0 -A 'tcp port 80'

# DNS queries
tcpdump -i eth0 'udp port 53'

# HTTPS traffic
tcpdump -i eth0 'tcp port 443'

# ICMP traffic
tcpdump -i eth0 'icmp[icmptype] = icmp-echo'

# ARP traffic
tcpdump -i eth0 'arp'

# NTP traffic
tcpdump -i eth0 'udp port 123'

4️⃣ Output Formatting

🔹 Display Options

# Timestamp options
tcpdump -i eth0 -tttt  # Human readable time
tcpdump -i eth0 -ttt   # Delta time

# Verbose output levels
tcpdump -i eth0 -v     # Verbose
tcpdump -i eth0 -vv    # More verbose
tcpdump -i eth0 -vvv   # Even more verbose

# ASCII output
tcpdump -i eth0 -A     # ASCII
tcpdump -i eth0 -X     # Hex and ASCII

# Quiet output
tcpdump -i eth0 -q     # Less protocol info

# Custom format
tcpdump -i eth0 -l | awk '{print $3}'

🔹 Capture Options

# Buffer size
tcpdump -i eth0 -B 4096

# Snapshot length
tcpdump -i eth0 -s 96

# No name resolution
tcpdump -i eth0 -n     # No DNS
tcpdump -i eth0 -nn    # No DNS or port names

# Rotate capture files
tcpdump -i eth0 -W 5 -C 1 -w capture.pcap

# Monitor mode
tcpdump -i wlan0 --monitor-mode

5️⃣ Common Use Cases

🔹 Security Monitoring

# Detect SYN flood
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn) != 0 and not tcp[tcpflags] & (tcp-ack) != 0'

# Monitor SSH attempts
tcpdump -i eth0 'tcp port 22'

# Detect port scanning
tcpdump -i eth0 'tcp[tcpflags] == tcp-syn'

# Monitor DNS tunneling
tcpdump -i eth0 'udp port 53 and length > 100'

# Track suspicious IPs
tcpdump -i eth0 'host 192.168.1.100'

# Monitor large packets
tcpdump -i eth0 'length > 1500'

6️⃣ Q&A / Frequently Asked Questions

Common filters: (1) host [ip]. (2) port [number]. (3) tcp/udp. (4) src/dst host. (5) src/dst port. (6) and/or/not operators. (7) greater/less than. (8) protocol filters.

File operations: (1) -w flag to write. (2) -r flag to read. (3) -C for file size limits. (4) -W for file rotation. (5) -G for time-based rotation. (6) Compress with gzip. (7) Use with Wireshark. (8) Merge multiple files.

Best practices: (1) Use specific filters. (2) Limit capture size. (3) Use appropriate buffer size. (4) Monitor disk space. (5) Consider privacy. (6) Document captures. (7) Regular cleanup. (8) Secure storage.

7️⃣ Best Practices & Pro Tips 🚀

  • Use specific filters
  • Monitor disk space
  • Rotate capture files
  • Document captures
  • Secure storage
  • Regular cleanup
  • Consider privacy
  • Use appropriate buffer
  • Verify captures
  • Backup important data
  • Monitor performance
  • Follow security policy

Read Next 📖

Conclusion

Tcpdump is an essential tool for network analysis and security monitoring. By mastering its features and following best practices, you can effectively capture and analyze network traffic.

Remember to use appropriate filters and consider security implications when capturing network traffic.

Security Essentials