← All cheat sheets

🌶 tcpdump

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

tcpdump                          # Capture on default interface
tcpdump -i eth0                  # Capture on specific interface
tcpdump -i any                   # Capture on all interfaces
tcpdump -D                       # List available interfaces
tcpdump -c 100                   # Capture 100 packets
tcpdump -n                       # Don't resolve hostnames
tcpdump -nn                      # Don't resolve hostnames or ports
tcpdump -v                       # Verbose output
tcpdump -vv                      # More verbose
tcpdump -vvv                     # Maximum verbosity

tcpdump -w capture.pcap          # Write to file
tcpdump -r capture.pcap          # Read from file
tcpdump -w capture.pcap -G 3600  # Rotate file every hour
tcpdump -w capture.pcap -C 100   # Rotate file every 100MB
tcpdump -w 'capture_%Y%m%d.pcap' # Use date in filename

tcpdump -A                       # ASCII output
tcpdump -X                       # Hex and ASCII output
tcpdump -XX                      # Hex/ASCII with Ethernet header
tcpdump -q                       # Quick/quiet output
tcpdump -t                       # No timestamp
tcpdump -tt                      # Unix timestamp
tcpdump -ttt                     # Delta timestamp
tcpdump -tttt                    # Date and time

tcpdump host 192.168.1.1
tcpdump src host 192.168.1.1
tcpdump dst host 192.168.1.1
tcpdump host 192.168.1.1 or host 192.168.1.2
tcpdump not host 192.168.1.1

# By network
tcpdump net 192.168.1.0/24
tcpdump src net 192.168.1.0/24
tcpdump dst net 10.0.0.0/8

tcpdump port 80
tcpdump src port 80
tcpdump dst port 80
tcpdump port 80 or port 443
tcpdump portrange 1-1024
tcpdump not port 22

# Named ports
tcpdump port http
tcpdump port https
tcpdump port ssh
tcpdump port dns
tcpdump port ftp

tcpdump tcp
tcpdump udp
tcpdump icmp
tcpdump ip
tcpdump ip6
tcpdump arp

# Protocol and port
tcpdump tcp port 80
tcpdump udp port 53

tcpdump 'tcp[tcpflags] & tcp-syn != 0'     # SYN packets
tcpdump 'tcp[tcpflags] & tcp-ack != 0'     # ACK packets
tcpdump 'tcp[tcpflags] & tcp-fin != 0'     # FIN packets
tcpdump 'tcp[tcpflags] & tcp-rst != 0'     # RST packets
tcpdump 'tcp[tcpflags] & tcp-push != 0'    # PSH packets
tcpdump 'tcp[tcpflags] == tcp-syn'         # Only SYN
tcpdump 'tcp[tcpflags] == tcp-syn|tcp-ack' # SYN-ACK

# Three-way handshake
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'

# HTTP traffic
tcpdump -s0 -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

# HTTP GET requests
tcpdump -s0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

# HTTP POST requests
tcpdump -s0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

# DNS queries
tcpdump -vvv -s0 port 53

# SMTP
tcpdump tcp port 25

# SSH connections
tcpdump 'tcp port 22 and tcp[tcpflags] & tcp-syn != 0'

tcpdump -s 0                     # Capture full packets
tcpdump -s 96                    # Capture first 96 bytes
tcpdump less 64                  # Packets smaller than 64 bytes
tcpdump greater 256              # Packets larger than 256 bytes

tcpdump host 10.0.0.1 and port 80
tcpdump host 10.0.0.1 or host 10.0.0.2
tcpdump not port 22
tcpdump host 10.0.0.1 and \(port 80 or port 443\)
tcpdump 'host 10.0.0.1 and (port 80 or port 443)'

# Capture HTTP traffic
tcpdump -i eth0 -nn -s0 -A tcp port 80

# Capture HTTPS handshakes
tcpdump -i eth0 -nn tcp port 443 and 'tcp[tcpflags] & tcp-syn != 0'

# Capture DNS traffic
tcpdump -i eth0 -nn port 53

# Capture traffic to/from specific host
tcpdump -i eth0 -nn host 192.168.1.100

# Capture all non-SSH traffic
tcpdump -i eth0 -nn not port 22

# Capture ICMP (ping)
tcpdump -i eth0 -nn icmp

# Capture traffic on specific subnet
tcpdump -i eth0 -nn net 192.168.1.0/24

# Capture ARP
tcpdump -i eth0 -nn arp

# Capture DHCP
tcpdump -i eth0 -nn port 67 or port 68

# Top talkers (with post-processing)
tcpdump -nn -c 1000 | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head

# Capture SYN flood
tcpdump 'tcp[tcpflags] == tcp-syn'

# Find SSH brute force
tcpdump 'tcp port 22 and tcp[tcpflags] & tcp-syn != 0' -c 1000

# Capture passwords (unencrypted)
tcpdump -A -i eth0 'port http or port ftp or port smtp or port pop3 or port imap'

# Detect port scanning
tcpdump -i eth0 'tcp[tcpflags] == tcp-syn' and not src host <your-ip>

# Detect ping sweep
tcpdump -i eth0 icmp[icmptype] == 8

# Capture all traffic from suspicious host
tcpdump -i eth0 -w suspicious.pcap host <suspicious-ip>

# DNS exfiltration detection
tcpdump -i eth0 'udp port 53 and udp[10] & 0x80 = 0' -vv

# Extract source IPs
tcpdump -nn -r capture.pcap | awk '{print $3}' | cut -d. -f1-4 | sort -u

# Extract destination IPs
tcpdump -nn -r capture.pcap | awk '{print $5}' | cut -d. -f1-4 | sort -u

# Count packets per IP
tcpdump -nn -r capture.pcap | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn

# Extract HTTP hosts
tcpdump -nn -A -r capture.pcap 'tcp port 80' | grep -oE 'Host: [^ ]+' | sort -u

# Buffer size
tcpdump -B 4096                  # Set buffer size to 4MB

# Kernel filter (faster)
tcpdump -d filter                # Show compiled filter

# Non-promiscuous mode
tcpdump -p                       # Don't put interface in promisc mode

- Always use -nn to avoid DNS lookups
- Use -s0 to capture full packets when needed
- Write to pcap for later analysis
- Use specific filters to reduce capture size
- Be careful with -A on production systems
- Consider disk space when capturing long-term
- Use -c to limit capture size

tcpdump    - Lightweight, available everywhere
tshark     - Wireshark CLI, better dissection
Both can write pcap files for Wireshark analysis

# Permission denied
sudo tcpdump ...

# Interface not found
tcpdump -D                       # List interfaces
ip link show                     # Check interface names

# Dropped packets
tcpdump -i eth0 ... 2>&1 | tail  # Check stats
tcpdump -B 8192 ...              # Increase buffer