ArthurChiao's Blog

tcpdump: An Incomplete Guide

Published at 2018-11-28 | Last Update 2019-09-24

tcpdump is a network tool to dump traffic on the network. This post servers as a guide to some frequently used commands. For a complete guide, please refer to the man page, or man tcpdump on a linux machine.

1 Basic Usage

A help summary:

tcpdump [ -AbdDefhHIJKlLnNOpqRStuUvxX ] [ -B buffer_size ] [ -c count ]
        [ -C file_size ] [ -G rotate_seconds ] [ -F file ]
        [ -i interface ] [ -j tstamp_type ] [ -m module ] [ -M secret ]
        [ -P in|out|inout ]
        [ -r file ] [ -V file ] [ -s snaplen ] [ -T type ] [ -w file ]
        [ -W filecount ]
        [ -E spi@ipaddr algo:secret,...  ]
        [ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
        [ expression ]

Running tcpdump needs root privilege, so prefix sudo for all commands in this post if you are not root user.

1.1 Capture Device

The simplest way to capture traffic on a host is to specify a device with -i option, the output may look like this:

$ sudo tcpdump -i eth0 # use CTL-C to terminate it
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
18:10:14.578057 IP 192.168.1.3.ssh > 192.168.1.124.53519: Flags [P.], seq 2350:2350, ack 166, win 198, length 240
18:10:14.578775 IP 192.168.1.124.53519 > 192.168.1.3.ssh: Flags [.], ack 240, win 252, length 0
18:10:14.634826 ARP, Request who-has 192.168.1.68 tell 192.168.1.81, length 46
18:10:14.670785 ARP, Request who-has 192.168.1.146 tell 192.168.1.81, length 46
^C
4 packets captured
39 packets received by filter
0 packets dropped by kernel

One tcpdump process could only capture one device, to capture multiple devices, e.g. both eth0 and eth1, you have to launch two processes:

$ tcpdump -i eth0 [OPTIONS]

$ tcpdump -i eth1 [OPTIONS]

1.2 Output Options

This section describes the options for displaying packets info on standard output.

Verbosity

  • -v verbose
  • -vv more verbose
  • -vvv even more verbose

IP, Protocol, Port

  • -n print IP instead of host name. This can be used to avoid DNS lookups
  • -nn print integer protocol/port numbers instead of protocl/port names, e.g. 22 vs ssh, 80 vs http

Examples:

$ tcpdump -i eth0
14:54:35.161548 IP ctn-1.example.com > ctn-2.example.com: ICMP echo request, id 29455, seq 0, length 64
14:54:35.161599 IP ctn-2.example.com > ctn-1.example.com: ICMP echo reply, id 29455, seq 0, length 64

$ tcpdump -n -i eth0
14:55:34.296206 IP 192.168.1.3 > 192.168.1.4: ICMP echo request, id 29711, seq 0, length 64
14:55:34.296259 IP 192.168.1.4 > 192.168.1.3: ICMP echo reply, id 29711, seq 0, length 64

MAC Address

  • -e also print MAC address
$ tcpdump -n -e -i eth0
15:05:12.225901 fa:16:3e:39:8c:fd > 00:22:0d:27:c2:45, ethertype IPv4 (0x0800), length 294: 192.168.1.3 > 192.168.1.124: Flags [P.], seq ...
15:05:12.226585 00:22:0d:27:c2:45 > fa:16:3e:39:8c:fd, ethertype IPv4 (0x0800), length 60: 192.168.1.124 > 192.168.1.3: Flags [.], ack ...

Packet Content

  • -x print the data of each packet (minus its link level header) in hex
  • -xx print the data of each packet, including its link level header, in hex.
  • -X print the data of each packet (minus its link level header) in hex and ASCII.
  • -XX print the data of each packet, including its link level header, in hex and ASCII.
$ tcpdump -i eth0 -x
19:33:33.724674 IP 192.168.1.3 > 192.168.1.4: ICMP echo request, id 10258, seq 0, length 64
        0x0000:  4500 0054 6e2b 4000 4001 4926 c0a8 0103
        0x0010:  c0a8 0104 0800 a20e 2812 0000 0f1c 1ec3
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000
        0x0030:  0000 0000 0000 0000 0000 0000 0000 0000
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000
        0x0050:  0000 0000

1.3 Save to File & Read from file

  • -w outfile.pcap save packets to file
  • -G rotate the dump file, should be used with -w option
  • -r outfile.pcap read a captured file

Captured files usually suffixed with cap or .pcap, which means packet capture file. The captured files are totally different from those generated with > outfile, which only redirects the messages on standard output (text) to a file.

# save raw packets to file
$ tcpdump -i eth0 -w test.pcap

# redirect logs to text file
$ tcpdump -i eth0 > test.txt

Captured files could be open again later:

$ tcpdump -e -nn -r test.pcap # read captured file content, print ether header, and be more numeric
15:10:40.111214 fa:16:30:a1:33:27 (oui Unknown) > fa:16:3f:e2:16:17 (oui Unknown), ethertype 802.1Q (0x8100), length 78: [|vlan]
15:10:40.111275 fa:16:30:a1:33:27 (oui Unknown) > fa:16:3f:e2:16:17 (oui Unknown), ethertype 802.1Q (0x8100), length 78: [|vlan]

Or, those files could also be opened with more professional traffic analyzing tools, e.g. Wireshark.

Split captured file

  • -C <N> write pcap file every N MB.
# read the entire file, split into 10MB chunks
$ tcpdump -r a.pcap -C 10 b.pcap
$ ls
b.pcap0 b.pcap1 b.pcap2 ...

1.4 Stop Capturing

CTL-C will stop capturing.

Besides, -c <count> will auto exit after receiving <count> packets.

$ tcpdump -i eth0 -c 2
15:00:18.129859 IP 192.168.1.3.ssh > 192.168.1.4.53519: Flags [P.], seq ...
15:00:18.130500 IP 192.168.1.4.53519 > 192.168.1.3.ssh: Flags [.], ack ...
2 packets captured

2 Match Expression

tcpdump supports filter expressions, this is where the real power comes to place. A complete guide of pcap-filter could be get from it’s man page, or through:

$ man 7 pcap-filter

If no filter expressions specified, tcpdump will capture all the packets on the device, which may be huge in mount. With filter expressions, it will only capture those that match the expressions.

$ tcpdump [OPTIONS] [expression]

2.1 Match Host

  • host <hostname or IP> - capture packets sent from and to host
  • src host <hostname or IP> - capture packets sent from host
  • dst host <hostname or IP> - capture packets sent to host

Examples:

$ tcpdump -i eth0 host baidu.com   # traffic from or to baidu.com
$ tcpdump -i eth0 host 192.168.1.3 # traffic from or to 192.168.1.3

$ tcpdump -i eth0 src host 192.168.1.3
$ tcpdump -i eth0 dst host 192.168.1.3

2.2 Match MAC Address & VLAN

  • ether host <MAC> - capture packets sent from and to <MAC>
  • ether src <MAC> - capture packets sent from <MAC>
  • ether dst <MAC> - capture packets sent to <MAC>
  • vlan <VLAN ID> - match VLAN ID

2.3 Match Network

  • net <NET> mask <MASK> - IPv4 only
  • net <NET>/<LEN> - IPv4/IPv6

May be qualified with src and dst.

Examples:

$ tcpdump -i eth0 net 192.168.1.0 mask 255.255.255.0
$ tcpdump -i eth0 net 192.168.1.0/24

2.4 Match Port

  • port <port> - packets from and to <port>
  • src port <port> - packets from <port>
  • dst port <port> - packets to <port>
  • portrange <port1>-<port2> - packets from and to <port1>-<port2>
  • src portrange <port1>-<port2> - packets from <port1>-<port2>
  • dst portrange <port1>-<port2> - packets to <port1>-<port2>

Examples:

$ tcpdump -i eth0 port 80
$ tcpdump -i eth0 dst port 80
$ tcpdump -i eth0 src portrange 8000-8080

2.5 Match Protocol

Match protocols in L3 header:

  • ip proto <PROTO> - PROTO: icmp, icmp6, igmp, igrp, pim, ah, esp, vrrp, udp, or tcp

Follow are abbreviations:

  • icmp = proto icmp
  • tcp = proto tcp
  • udp = proto udp

Match protocols in L2 header:

  • ether proto <PROTO> - PROTO: ip, ip6, arp, rarp, atalk, aarp, decnet, sca, lat, mopdl, moprc, iso, stp, ipx, or netbeui

Follow are abbreviations:

  • ip = ether proto ip
  • ip6 = ether proto ip6
  • arp = ether proto arp
  • rarp = ether proto rarp
$ tcpdump -i eth0 arp
$ tcpdump -i eth0 icmp

2.6 Match Traffic Direction (ingress/egress)

  • --direction=[in|out|inout] - note that not all platform supports this

2.7 Logical Operators

With logical operators, we could combine simple expressions into a complex one.

  • and
  • or

Examples:

# capture traffic: 192.168.1.3<->192.168.1.4:80
$ tcpdump -i eth0 'host 192.168.1.3 and (host 192.168.1.4 and port 80)'

# capture traffic: 192.168.1.3->192.168.1.4:80
$ tcpdump -i eth0 'src host 192.168.1.3 and (dst host 192.168.1.4 and port 80)'

# capture traffic: 192.168.1.0/24->10.1.1.4
$ tcpdump -i eth0 'src net 192.168.1.0/24 and dst host 10.1.1.4 -w test.pcap'

3 Misc

3.1 Truncate Packet Length

-s <LEN> truncate each packet to length LEN bytes. This could substantially reduce the resulted pcap file size.

For example, if want to capture only L2 and L3 headers, you could truncate each packet to 14 (ether header) + 2 (potential VLAN) + 20 (IP header basic part) = 36 bytes, thus:

$ tcpdump -i eth0 -s 36 -w test.pcap

Reference

  1. Man Page of tcpdump
  2. Wireshark
  3. Man Page of pcap-filter