Dump traffic on a network interface
tcpdump -r {flag-r} -b {flag-b} -B {flag-b} -c {flag-c} --count {count} 📎 flag-r 📎 flag-b 📎 flag-c 📎 count tcpdump -r {flag-r} -b {flag-b} -B {flag-b} -c {flag-c} --count {count}Sandbox: execFile · Timeout: 30s
network.capture.tcpdump network.capture.packet network.capture.sniff | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
flag-r | array | No | - | read packets from a network interface. It can also be run with the -V flag, which causes it to read a list of saved packet files. In all cases, only packets that match expression will be processed ... | -r |
flag-b | string | No | - | Print the AS number in BGP packets in ASDOT notation rather than | -b |
flag-B | string | No | - | --buffer-size=buffer_size Set the operating system capture buffer size to buffer_size, in units of KiB (1024 bytes) | -B |
flag-c | string | No | - | Exit after receiving count packets | -c |
count | string | No | - | Print only on stdout the packet count when reading capture file(s) instead of parsing/printing the packets. If a filter is specified on the command line, tcpdump counts only packets that were match... | --count |
flag-C | string | No | - | Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile wi... | -C |
flag-d | string | No | - | Dump the compiled packet-matching code in a human readable form | -d |
flag-i | string | No | - | In this case the DLT defaults to EN10MB and can be set to | -i |
flag-d-2 | string | No | - | Dump packet-matching code as a C program fragment | -d |
flag-d-3 | string | No | - | Dump packet-matching code as decimal numbers (preceded with a | -d |
flag-D | array | No | - | --list-interfaces Print the list of the network interfaces available on the system and on which tcpdump can capture packets. For each network in‐ terface, a number and an interface name, possibly f... | -D |
flag-a | string | No | - | where the interface name is a somewhat complex string | -a |
flag-e | string | No | - | Print the link-level header on each dump line. This can be used | -e |
flag-f | integer | No | - | Print `foreign' IPv4 addresses numerically rather than symboli‐ | -f |
flag-F | string | No | - | Use file as input for the filter expression. An additional ex‐ pression given on the command line is ignored | -F |
flag-g | string | No | - | --ip-oneline Do not insert a line break after the IP header in verbose mode | -g |
flag-G | file | No | - | If specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name spec‐ ified by -w which should include a time format as defined by strfti... | -G |
flag-h | string | No | - | --help Print the tcpdump and libpcap version strings, print a usage mes‐ sage, and exit | -h |
version | string | No | - | Print the tcpdump and libpcap version strings and exit | --version |
flag-i-2 | array | No | - | --interface=interface Listen, report the list of link-layer types, report the list of time stamp types, or report the results of compiling a filter ex‐ pression on interface. If unspecified and if ... | -i |
flag-I | string | No | - | --monitor-mode Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operat‐ ing systems | -I |
immediate-mode | string | No | - | Capture in "immediate mode". In this mode, packets are delivered to tcpdump as soon as they arrive, rather than being buffered for efficiency. This is the default when printing packets rather tha... | --immediate-mode |
flag-j | string | No | - | --time-stamp-type=tstamp_type Set the time stamp type for the capture to tstamp_type. The names to use for the time stamp types are given in pcap-tstamp(7); not all the types listed there will nece... | -j |
flag-J | string | No | - | --list-time-stamp-types List the supported time stamp types for the interface and exit. If the time stamp type cannot be set for the interface, no time stamp types are listed | -J |
time-stamp-precision | number | No | - | When capturing, set the time stamp precision for the capture to tstamp_precision. Note that availability of high precision time stamps (nanoseconds) and their actual accuracy is platform and hardwa... | --time-stamp-precision |
micro | number | No | - | --nano Shorthands for --time-stamp-precision=micro or --time-stamp-pre‐ cision=nano, adjusting the time stamp precision accordingly. When reading packets from a savefile, using --micro truncates ti... | --micro |
flag-K | string | No | - | --dont-verify-checksums Don't attempt to verify IP, TCP, or UDP checksums. This is use‐ ful for interfaces that perform some or all of those checksum calculation in hardware; otherwise, all outgoin... | -K |
flag-l | string | No | - | Make stdout line buffered. Useful if you want to see the data | -l |
flag-U | string | No | - | be ``packet-buffered'', so that the output is written to stdout at the end of each packet rather than at the end of each line; this is buffered on all platforms, including Windows | -U, -l |
flag-L | array | No | - | --list-data-link-types List the known data link types for the interface, in the speci‐ fied mode, and exit. The list of known data link types may be dependent on the specified mode; for example, on... | -L |
XX | boolean | No | - | When parsing and printing, in addition to printing the headers of | -XX |
absolute_tcp_sequence_numbers | boolean | No | - | --absolute-tcp-sequence-numbers | |
buffer_size | boolean | No | - | --buffer-size | |
dd | boolean | No | - | code as a C program fragment. | -dd, -matching |
ddd | boolean | No | - | code as decimal numbers (preceded with a | -ddd, -matching |
direction | boolean | No | - | --direction | |
dont_verify_checksums | boolean | No | - | --dont-verify-checksums | |
flag-M | string | No | - | Use secret as a shared secret for validating the digests found in TCP segments with the TCP-MD5 option (RFC 2385), if present | -M |
flag-O | string | No | - | --no-optimize Do not run the packet-matching code optimizer. This is useful only if you suspect a bug in the optimizer | -O |
flag-Q | string | No | - | --direction=direction Choose send/receive direction direction for which packets should be captured. Possible values are `in', `out' and `inout'. Not available on all platforms | -Q |
flag-S | string | No | - | --absolute-tcp-sequence-numbers Print absolute, rather than relative, TCP sequence numbers | -S |
flag-T | string | No | - | Force packets selected by "expression" to be interpreted the specified type. Currently known types are aodv (Ad-hoc On-demand Distance Vector protocol), carp (Common Address Redundancy Proto‐ col), cnfp (Cisco NetFlow protocol), domain (Domain Name System), lmp (Link Management Protocol), pgm (Pragmatic General Multi‐ cast), pgm_zmtp1 (ZMTP/1.0 inside PGM/EPGM), ptp (Precision Time Protocol), radius (RADIUS), resp (REdis Serialization Protocol), rpc (Remote Procedure Call), rtcp (Real-Time Applications control protocol), rtp (Real-Time Applications protocol), snmp (Simple Network Management Protocol), someip (SOME/IP), tftp (Trivial File Transfer Protocol), vat (Visual Audio Tool), vxlan (Virtual eXtensible Local Area Network), wb (distributed White Board) and zmtp1 (ZeroMQ Message Transport Protocol 1.0) | -T |
flag-U-2 | string | No | - | --packet-buffered If the -w option is not specified, or if it is specified but the --print flag is also specified, make the printed packet output ``packet-buffered''; i.e., as the description of the contents of each packet is printed, it will be written to the standard out‐ put, rather than, when not writing to a terminal, being written only when the output buffer fills | -U |
flag-V | file | No | - | Read a list of filenames from file. Standard input is used if file is ``-'' | -V |
flag-W | integer | No | - | Used in conjunction with the -C option, this will limit the num‐ ber of files created to the specified number, and begin overwrit‐ ing files from the beginning, thus creating a 'rotating' buffer. In addition, it will name the files with enough leading 0s to support the maximum number of files, allowing them to sort cor‐ rectly | -W |
flag-Z | string | No | - | --relinquish-privileges=user If tcpdump is running as root, after opening the capture device or input savefile, but before opening any savefiles for output, change the user ID to user and the group ID to the primary group of user | -Z |
flag-m | string | No | - | Load SMI MIB module definitions from file module. This option can be used several times to load several MIB modules into tcp‐ dump | -m |
flag-n | integer | No | - | Don't convert addresses (i.e., host addresses, port numbers | -n |
flag-p | string | No | - | --no-promiscuous-mode Don't put the interface into promiscuous mode. Note that the in‐ terface might be in promiscuous mode for some other reason; hence, `-p' cannot be used as an abbreviation for `ether host {local-hw-addr} or ether broadcast' | -p |
flag-q | string | No | - | Quick (quiet?) output. Print less protocol information so output | -q |
flag-r-2 | string | No | - | Read packets from file (which was created with the -w option or by other tools that write pcap or pcapng files). Standard input is used if file is ``-'' | -r |
flag-s | string | No | - | --snapshot-length=snaplen Snarf snaplen bytes of data from each packet rather than the de‐ fault of 262144 bytes. Packets truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level at which the truncation has occurred | -s |
flag-t | string | No | - | Don't print a timestamp on each dump line | -t |
flag-t-2 | number | No | - | Print the timestamp, as seconds since January 1, 1970, 00:00:00 | -t |
flag-t-3 | number | No | - | Print a delta (microsecond or nanosecond resolution depending on | -t |
flag-t-4 | number | No | - | second since midnight, preceded by the date, on each dump line | -t |
flag-t-5 | number | No | - | the --time-stamp-precision option) between current and first line on each dump line. The default is microsecond resolution | -t |
flag-u | string | No | - | Print undecoded NFS handles | -u |
flag-v | string | No | - | When parsing and printing, produce (slightly more) verbose out‐ | -v |
flag-v-2 | string | No | - | Even more verbose output. For example, additional fields are | -v |
flag-v-3 | string | No | - | Even more verbose output. For example, telnet SB ... SE options | -v |
flag-w | string | No | - | Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Stan‐ dard output is used if file is ``-'' | -w |
flag-x | string | No | - | When parsing and printing, in addition to printing the headers of | -x |
flag-x-2 | string | No | - | When parsing and printing, in addition to printing the headers of | -x |
flag-y | string | No | - | --linktype=datalinktype Set the data link type to use while capturing packets (see -L) or just compiling and dumping packet-matching code (see -d) to datalinktype | -y |
flag-z | string | No | - | Used in conjunction with the -C or -G options, this will make tcpdump run " postrotate-command file " where file is the save‐ file being closed after each rotation. For example, specifying -z gzip or -z bzip2 will compress each savefile using gzip or bzip2 | -z, -c |
help | boolean | No | - | Print the tcpdump and libpcap version strings, print a usage mes‐ | --help |
interface | boolean | No | - | --interface | |
ip_oneline | boolean | No | - | --ip-oneline | |
linktype | boolean | No | - | --linktype | |
list_data_link_types | boolean | No | - | --list-data-link-types | |
list_interfaces | boolean | No | - | --list-interfaces | |
list_time_stamp_types | boolean | No | - | --list-time-stamp-types | |
monitor_mode | boolean | No | - | --monitor-mode | |
nano | boolean | No | - | ‐ | --nano, --time-stamp-precision, --time-stamp-pre |
no_optimize | boolean | No | - | --no-optimize | |
no_promiscuous_mode | boolean | No | - | --no-promiscuous-mode | |
number | string | No | - | Print a packet number at the beginning of the line | --number |
packet_buffered | boolean | No | - | --packet-buffered | |
print | string | No | - | Print parsed packet output, even if the raw packets are being saved to a file with the -w flag | --print |
relinquish_privileges | boolean | No | - | --relinquish-privileges | |
snapshot_length | boolean | No | - | --snapshot-length | |
time_stamp_type | boolean | No | - | --time-stamp-type | |
tt | boolean | No | - | Print the timestamp, as seconds since January 1, 1970, 00:00:00, | -tt |
ttt | boolean | No | - | Print a delta (microsecond or nanosecond resolution depending on | -ttt |
tttt | boolean | No | - | Print a timestamp, as hours, minutes, seconds, and fractions of a | -tttt |
vv | boolean | No | - | Even more verbose output. For example, additional fields are | -vv |
vvv | boolean | No | - | Even more verbose output. For example, telnet SB ... SE options | -vvv |
xx | boolean | No | - | When parsing and printing, in addition to printing the headers of | -xx |
Display help message
tcpdump --helpCapture packets from a specific network interface
tcpdump -i eth0Capture only a certain number of packets
tcpdump -c 10Capture and write packets to a file for later analysis
tcpdump -w capture.pcapRead packets from a file
tcpdump -r capture.pcapCapture packets from a specific host
tcpdump host 192.168.1.1Capture packets from a specific port
tcpdump port 80Capture packets based on a specific protocol (e.g., TCP)
tcpdump tcpCapture packets and filter for HTTP traffic
tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'Capture packets from a specific source IP
tcpdump src 192.168.1.1Capture packets to a specific destination IP
tcpdump dst 192.168.1.2Display captured packets with timestamp
tcpdump -ttttCapture packets and display with verbose output
tcpdump -vCapture packets and display with extra verbose output
tcpdump -vvCapture packets and resolve hostnames
tcpdump -nCapture packets and disable resolving hostnames
tcpdump -nnCapture packets and show link-layer headers
tcpdump -eCapture IPv6 packets
tcpdump ip6Capture packets larger than a specific size
tcpdump greater 1024tcpdump is a command-line utility for dump traffic on a network interface.
tcpdump -r {flag-r} -b {flag-b} -B {flag-b} -c {flag-c} --count {count}