Capturing Packets with tcpdump¶

How to capture, filter, save, and inspect network traffic using tcpdump.

This English edition retains the original diagrams and examples for direct use.

Reference diagram 1

Reference diagram 2

Commands and examples¶

tcpdump [选项] [表达式]

sudo tcpdump -i ens33

sudo tcpdump -i ens33 udp

sudo tcpdump -i ens33 port 53

sudo tcpdump -i ens33 -w capture.pcap

sudo tcpdump -i ens33 'tcp and src host 192.168.1.100 and dst port 80'

sudo tcpdump -i ens33 'dst host 192.168.1.1 or dst host 192.168.1.2'

sudo tcpdump -i ens33 -n udp port 53

ping www.baidu.com

22:19:17.750222 IP 192.168.1.39.36573 > 192.168.1.1.53: 38393+ A? www.baidu.com. (31)
   22:19:17.750482 IP 192.168.1.39.48126 > 192.168.1.1.53: 35135+ AAAA? www.baidu.com. (31)
   22:19:17.762914 IP 192.168.1.1.53 > 192.168.1.39.36573: 38393 3/5/9 CNAME www.a.shifen.com., A 183.240.99.224, A 111.45.11.5 (351)
   22:19:17.763217 IP 192.168.1.1.53 > 192.168.1.39.48126: 35135 3/5/9 CNAME www.a.shifen.com., AAAA xxx:8c54:xx:187:0:ff:xxx:xxx, AAAA xxxx:8c54:870:310:0:ff:b0ed:40ac (375)

Practical notes¶

Adapt the commands and configuration to the version, distribution, and target hardware being used.