Code360 powered by Coding Ninjas X Naukri.com. Code360 powered by Coding Ninjas X Naukri.com
Table of contents
1.
Introduction 
2.
Installing tcpdump Tool in Linux
2.1.
For Debian/Ubuntu users, open your terminal and type
2.2.
And for Fedora enthusiasts
3.
Working with tcpdump Command
3.1.
Saving Captured Packets to a File
3.2.
Reading from a Saved Packet File
4.
Filtering Packets
5.
Frequently Asked Questions
5.1.
Can tcpdump capture all types of network traffic?
5.2.
Is it necessary to run tcpdump as root?
5.3.
How can I limit the output of tcpdump to only show specific traffic?
6.
Conclusion
Last Updated: Mar 27, 2024
Easy

Tcpdump Command in Linux

Author Sinki Kumari
0 upvote
Create a resume that lands you SDE interviews at MAANG
Speaker
Anubhav Sinha
SDE-2 @
12 Jun, 2024 @ 01:30 PM

Introduction 

Linux offers a plethora of tools designed to probe network traffic, and among these, tcpdump stands out for its powerful & versatile nature. It's a command-line utility that enables users to capture & analyze network packets, offering insights into the traffic flowing through a system. 

Tcpdump Command in Linux

By the end of this article, you'll grasp how to install tcpdump, harness its command syntax, and apply it to real-world scenarios, enhancing your network troubleshooting skills.

Installing tcpdump Tool in Linux

tcpdump is a must-have tool for network analysis, often pre-installed on many Linux distributions. If it's not already on your system, installing it is straightforward. For most Linux users, the installation process involves a simple command that varies slightly depending on the distribution you're using.

For Debian/Ubuntu users, open your terminal and type

sudo apt-get update
sudo apt-get install tcpdump


If you're on a RedHat/CentOS system, you'd use:

sudo yum update
sudo yum install tcpdump

And for Fedora enthusiasts

sudo dnf install tcpdump


After installation, you can verify that tcpdump is ready to use by checking its version:

tcpdump --version


This command will display the version of tcpdump installed on your system, confirming the successful installation.

Get the tech career you deserve, faster!
Connect with our expert counsellors to understand how to hack your way to success
User rating 4.7/5
1:1 doubt support
95% placement record
Akash Pal
Senior Software Engineer
326% Hike After Job Bootcamp
Himanshu Gusain
Programmer Analyst
32 LPA After Job Bootcamp
After Job
Bootcamp

Working with tcpdump Command

Once tcpdump is installed, utilizing it to monitor network traffic becomes an invaluable skill. The basic syntax of tcpdump is as follows:

tcpdump [options] [filter]


Options allow you to modify how tcpdump captures packets, such as limiting the number of packets or specifying the interface.

Filter is a powerful feature that enables you to narrow down the captured packets to those that match specific criteria, like IP addresses or port numbers.

Capturing Packets

To start capturing packets on a specific interface, such as eth0, you can use:

sudo tcpdump -i eth0


This command will continuously list packets flowing through the eth0 interface until you stop it by pressing Ctrl+C.

Saving Captured Packets to a File

Often, you'll want to save the captured packets for later analysis. This can be done by adding the -w option, followed by the filename:

sudo tcpdump -i eth0 -w mycapture.pcap


This command saves the packets to a file named mycapture.pcap, which can be analyzed later with tcpdump or other tools like Wireshark.

Reading from a Saved Packet File

To analyze or simply review the packets from a saved file, use the -r option:

tcpdump -r mycapture.pcap

Filtering Packets

Filters are where tcpdump truly shines, allowing you to isolate packets that match specific criteria. For example, to capture only TCP packets from a particular IP and port, you might use:

sudo tcpdump -i eth0 tcp and src host 192.168.1.1 and src port 80


This command captures only TCP packets originating from IP 192.168.1.1 on port 80.

Frequently Asked Questions

Can tcpdump capture all types of network traffic?

Yes, tcpdump can capture all types of network traffic including TCP, UDP, ICMP, and more, provided it's not encrypted.

Is it necessary to run tcpdump as root?

Yes, tcpdump requires root privileges to capture network packets due to its access to low-level network interfaces.

How can I limit the output of tcpdump to only show specific traffic?

You can use filters with tcpdump, like tcpdump port 80 to only capture HTTP traffic, or tcpdump host example.com to capture traffic to and from example.com.

Conclusion

Diving into tcpdump opens up a world where data packets tell stories about network health, security breaches, and protocol behaviors. Mastering its commands and filters equips you with a deeper understanding of your network, making you adept at diagnosing issues and ensuring smooth communication flows. With the basics covered and some Frequently Asked Questionss addressed, you're well on your way to leveraging tcpdump for insightful network analysis.

You can refer to our guided paths on the Coding Ninjas. You can check our course to learn more about DSADBMSCompetitive ProgrammingPythonJavaJavaScript, etc. 

Also, check out some of the Guided Paths on topics such as Data Structure and AlgorithmsCompetitive ProgrammingOperating SystemsComputer Networks, DBMSSystem Design, etc., as well as some Contests, Test Series, and Interview Experiences curated by top Industry Experts.

Previous article
Linux Operating System
Next article
Linux Export Command
Live masterclass