• Salman Qadir
• March 22, 2020

Exploring Network Traffic Analysis:

Tcpdump Commands in Linux

Introduction:

In the realm of Linux networking, understanding and analyzing network traffic is crucial for troubleshooting, monitoring, and security purposes. Tcpdump, a powerful command-line packet analyzer, provides detailed insights into network packets. In this comprehensive guide, we’ll delve into the functionalities of tcpdump commands, exploring their various variations with practical examples and sample outputs.

Understanding Tcpdump Command:

Tcpdump is a command-line utility used for capturing and analyzing network packets in real-time. It offers extensive capabilities for filtering and displaying packet data, making it an essential tool for network administrators and security professionals.

Syntax:

tcpdump [options] [expression]

Common Options:

• -i: Specify the network interface to capture packets.
• -c: Limit the number of packets to capture.
• -n: Display IP addresses and port numbers numerically.
• -s: Set the snapshot length (number of bytes to capture).
• -w: Write captured packets to a file for later analysis.
• -r: Read packets from a saved file instead of capturing them live.

Variations of Tcpdump Commands:

1. Capture Packets on a Specific Interface:

tcpdump -i eth0

Example:

tcpdump -i eth0

Sample Output:

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

2. Capture and Display Packets with a Filter:

tcpdump -i eth0 tcp port 80

Example:

tcpdump -i eth0 tcp port 80

Sample Output:

15:43:22.148361 IP 192.168.1.10.53248 > 151.101.1.69.80: Flags [S], seq 1234567890, win 65535, options [mss 1460,sackOK,TS val 1234567890 ecr 0,nop,wscale 7], length 0
15:43:22.148522 IP 151.101.1.69.80 > 192.168.1.10.53248: Flags [S.], seq 1234567890, ack 1234567891, win 65535, options [mss 1440,sackOK,TS val 1234567890 ecr 1234567890,nop,wscale 9], length 0

3. Limit the Number of Packets Captured:

tcpdump -i eth0 -c 10

Example:

tcpdump -i eth0 -c 10

Sample Output:

10 packets captured

4. Display Packets in ASCII Format:

tcpdump -A -i eth0

Example:

tcpdump -A -i eth0

Sample Output:

GET /index.html HTTP/1.1
Host: example.com
Connection: keep-alive

5. Save Captured Packets to a File:

tcpdump -i eth0 -w capture.pcap

Example:

tcpdump -i eth0 -w capture.pcap

Sample Output:

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C
10 packets captured

6. Read Packets from a Saved File:

tcpdump -r capture.pcap

Example:

tcpdump -r capture.pcap

Sample Output:

10 packets captured

Conclusion:

Tcpdump commands are indispensable tools for capturing and analyzing network packets in Linux environments. By mastering the various options and variations, users can effectively monitor network traffic, troubleshoot connectivity issues, and detect security threats. Incorporate tcpdump commands into your network management toolkit to enhance your network analysis capabilities and ensure the integrity and security of your systems. Experiment with different options and explore their functionalities to unleash the full potential of tcpdump in Linux.