Complete tcpdump commands reference — 63 commands across 1 categories. Quick reference cheat sheet for Linux, macOS & BSD.
tcpdump captures packets on an interface, filters them with BPF expressions, and either prints them or writes them to a pcap file for Wireshark. The table lists its options from the manual page; in practice five of them, plus the filter expression, account for nearly every capture. The notes are about those five and the mistakes that follow from omitting them.
| Shortcut | Action |
|---|---|
| tcpdump -A | Print each packet (minus its link level header) in ASCII |
| tcpdump -b | Print the AS number in BGP packets using "asdot" rather than "asplain" representation, in RFC |
| tcpdump -B buffer_size --buffer-size=buffer_size | Set the operating system capture buffer size to buffer_size, in units of KiB (1024 bytes) |
| tcpdump -c count | Exit after receiving or reading count packets |
| tcpdump --count | Print only on stdout the packet count when reading capture file(s) instead of parsing/prin |
| tcpdump -C file_size | Before writing a raw packet to a savefile, check whether the file is currently larger than |
| tcpdump -d | Dump the compiled packet-matching code in a human readable form to standard output and sto |
| tcpdump -dd | Dump packet-matching code as a C array of struct bpf_insn structures |
| tcpdump -ddd | Dump packet-matching code as decimal numbers (preceded with a count) |
| tcpdump -D --list-interfaces | Print the list of the network interfaces available on the system and on which tcpdump can |
| tcpdump -e | Print the link-level header on each dump line |
| tcpdump -E | Use spi@ipaddr algo:secret for decrypting IPsec ESP packets that are addressed to addr |
| tcpdump -f | Print `foreign' IPv4 addresses numerically rather than symbolically (this option is intend |
| tcpdump -F file | Use file as input for the filter expression |
| tcpdump -g --ip-oneline | Do not insert a line break after the IP header in verbose mode |
| tcpdump -G rotate_seconds | If specified, rotates the dump file specified with the -w option every rotate_seconds seco |
| tcpdump -h --help | Print the tcpdump and libpcap version strings, print a usage message, and exit |
| tcpdump --version | Print the tcpdump and libpcap version strings and exit |
| tcpdump -i interface --interface=interface | Listen, report the list of link-layer types, report the list of time stamp types, or repor |
| tcpdump -I --monitor-mode | Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interface |
| tcpdump --immediate-mode | Capture in "immediate mode" |
| tcpdump -j tstamp_type --time-stamp-type=tstamp_type | Set the time stamp type for the capture to tstamp_type |
| tcpdump -J --list-time-stamp-types | List the supported time stamp types for the interface and exit |
| tcpdump --time-stamp-precision=tstamp_precision | When capturing, set the time stamp precision for the capture to tstamp_precision |
| tcpdump --micro --nano | Shorthands for --time-stamp-precision=micro or --time-stamp-precision=nano |
| tcpdump -K --dont-verify-checksums | Don't attempt to verify IP, TCP, or UDP checksums |
| tcpdump -l | Make stdout line buffered |
| tcpdump -L --list-data-link-types | List the known data link types for the interface, in the specified mode, and exit |
| tcpdump --lengths | Print the captured and original packet lengths |
| tcpdump -m module | Load SMI MIB module definitions from file module |
| tcpdump -M secret | Use secret as a shared secret for validating the digests found in TCP segments with the TC |
| tcpdump -n | Don't convert addresses (i.e., host addresses, port numbers, etc.) to names |
| tcpdump -N | Don't print domain name qualification of host names |
| tcpdump -# --number | Print a packet number at the beginning of the line |
| tcpdump -O --no-optimize | Do not run the packet-matching code optimizer |
| tcpdump -p --no-promiscuous-mode | Don't put the interface into promiscuous mode |
| tcpdump --print | Print parsed packet output, even if the raw packets are being saved to a file with the -w |
| tcpdump --print-sampling=nth | Print every nth packet |
| tcpdump -Q direction --direction=direction | Choose send/receive direction direction for which packets should be captured |
| tcpdump -q | Quick output |
| tcpdump -r file | Read packets from file (which was created with the -w option or by other tools that write |
| tcpdump -S --absolute-tcp-sequence-numbers | Print absolute, rather than relative, TCP sequence numbers |
| tcpdump -s snaplen --snapshot-length=snaplen | Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes |
| tcpdump --skip count | Skip count packets before writing or printing |
| tcpdump -T type | Force packets selected by "expression" to be interpreted the specified type |
| tcpdump -tt | Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and fractions of a s |
| tcpdump -ttt | Print a delta (microsecond or nanosecond resolution depending on the --time-stamp-precisio |
| tcpdump -tttt | Print a timestamp, as hours, minutes, seconds, and fractions of a second since midnight, p |
| tcpdump -ttttt | Print a delta (microsecond or nanosecond resolution depending on the --time-stamp-precision option) |
| tcpdump -U --packet-buffered | If the -w option is not specified, or if it is specified but the --print flag is also spec |
| tcpdump -v | When parsing and printing, produce (slightly more) verbose output |
| tcpdump -vv | Even more verbose output |
| tcpdump -vvv | Even more verbose output |
| tcpdump -V file | Read a list of filenames from file |
| tcpdump -w file | Write the raw packets to file rather than parsing and printing them out |
| tcpdump -W filecount | Used in conjunction with the -C option, this will limit the number of files created |
| tcpdump -x | When parsing and printing, in addition to printing the headers of each packet, print the d |
| tcpdump -xx | When parsing and printing, in addition to printing the headers of each packet, print the d |
| tcpdump -X | When parsing and printing, in addition to printing the headers of each packet, print the d |
| tcpdump -XX | When parsing and printing, in addition to printing the headers of each packet, print the d |
| tcpdump -y datalinktype --linktype=datalinktype | Set the data link type to use while capturing packets (see -L) or just compiling and dumpi |
| tcpdump -z postrotate-command | Used in conjunction with the -C or -G options, this will make tcpdump run " postrotate-com |
| tcpdump -Z user --relinquish-privileges=user | If tcpdump is running as root, after opening the capture device or input savefile, but bef |
sudo tcpdump -i eth0 -nn port 443 is the shape of most captures: an interface, no name resolution, a filter. tcpdump -i interface --interface=interface picks the interface (any captures all of them, at the cost of link-layer headers), and tcpdump -D --list-interfaces lists what is available. tcpdump -n disables DNS lookups, and doubling it (-nn) also stops translating port numbers into service names — without them, a busy capture stalls on reverse lookups and the output changes shape. tcpdump -c count stops after a number of packets, which prevents an unbounded capture on a production host.
tcpdump -w file writes raw packets to a pcap file and prints nothing, and tcpdump -r file reads one back with a filter applied, so a large capture can be sliced after the fact. For long captures, tcpdump -C file_size rotates files at a size in millions of bytes and tcpdump -G rotate_seconds rotates on time, with tcpdump -W filecount capping how many files are kept. tcpdump -s snaplen --snapshot-length=snaplen limits how many bytes of each packet are saved; the modern default captures full packets, and -s 96 is the old trick for headers only.
tcpdump -v, tcpdump -vv and tcpdump -vvv add protocol detail such as TTL, IP ID and checksum results. tcpdump -A prints packet payloads as ASCII, which makes unencrypted HTTP readable, and tcpdump -X prints hex and ASCII side by side. tcpdump -e adds the link-layer header with MAC addresses, needed for ARP and VLAN problems, and tcpdump -tttt prints full timestamps with the date. tcpdump -d dumps the compiled filter, which is how you check that a complicated expression means what you think.
It is resolving hostnames and service names. Add -nn to disable both lookups.
tcpdump -i eth0 -w capture.pcap with a filter. Open the file in Wireshark, or read it back with tcpdump -r.
Use -s with a small snapshot length, such as -s 96. The default captures whole packets.
Combine -w with -C (rotate by size) or -G (rotate by seconds) and -W to limit the number of files kept, or use -c to stop after N packets.
Open your assistant with this page preloaded as the source — great for follow-up questions like "which of these work in other apps?"