Linux Command #59 introduces tcpdump, a command-line packet capture tool used to inspect network traffic. It is particularly useful when a server cannot reach a service, DNS lookups fail, or an administrator needs to see whether packets are arriving at a network interface.

What tcpdump Does

The command captures packets visible to a selected interface and prints summaries of their headers. With appropriate privileges, it can save packet captures in PCAP format for analysis in Wireshark. Capturing a packet does not automatically prove an application processed it.

Check Available Interfaces

sudo tcpdump -D

This lists capture-capable interfaces. Select the interface connected to the network you need to investigate.

Capture a Small Sample

sudo tcpdump -i eth0 -nn -c 20

-i eth0 chooses an interface, -nn prevents name and service lookups, and -c 20 stops after 20 packets. Replace eth0 with the actual interface name.

Filter for DNS

sudo tcpdump -i eth0 -nn 'port 53'

This captures traffic involving port 53, commonly used for DNS. DNS over HTTPS and DNS over TLS use different ports and will not necessarily appear in this filter.

Inspect a Specific Host

sudo tcpdump -i eth0 -nn 'host 192.0.2.10 and tcp port 443'

This filter narrows the capture to TCP port 443 traffic involving the example IP address 192.0.2.10. Substitute the actual host under investigation.

Save a Packet Capture

sudo tcpdump -i eth0 -nn -c 100 -w capture.pcap

The -w option writes raw packet records to a file instead of printing a decoded summary. Open the file later with tcpdump -r capture.pcap or a compatible packet analyzer. Capture files may contain confidential network data: obtain authorization, restrict access, and delete files according to retention policy.

Common Mistakes

Do not assume every missing packet is a network failure: the wrong interface, a restrictive capture filter, hardware offloading, or dropped capture packets can also affect observations. On switched networks, an interface normally sees its own traffic and relevant broadcasts, not all traffic on the switch.

Knowledge Check

1. What does -i select? 2. Why use -nn? 3. What does -c 20 do? 4. Which option saves a PCAP file? 5. Why should packet captures be handled carefully?

Answers

1. The capture interface. 2. To suppress address and port name resolution. 3. Stop after 20 captured packets. 4. -w. 5. Captures can expose sensitive network data.

References

tcpdump official manual; pcap-filter manual; Wireshark user guide.

BitcoinVersus.Tech Editor’s Note: We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate using the QR code provided

For best QR-code scanning results, please scan this donation code from a desktop or larger screen. Mobile screens may prevent camera recognition.