TCPDUMP reference

tcpdump.md

Overview

tcpdump

• Is a packet content inspection tool
• Does packet filtering by boolean expression

For expression syntax, refere to pcap-filter(7)

Syntax

• Tool syntax

    tcpdump [<options>] <expression>
    <expression> := <primitive> [ {and|or|not} <primitive ] ...
    <primitive> := <qualifier> [qualifier ...] <id>

• Common options
  • -n : NO conversion of hostname
  • -nn : NO conversion of protocol and port
  • -t : NO timestamp
  • -tt : timestamp in seconds
  • -ttt : delta in micro-second between current and previous line
  • -tttt : timestamp in hours,minutes,seconds,fraction of a second since mignight
  • -ttttt : delta in micro-second between curent and first line

Syntax components

Primitive

Qualifier

• type : host x |net #.#.# |port ##|portrange ##-## , host by default.
• dir : src|dst|src or dst| src and dst|ra|ta|addr1~4, src or dst by default.
• proto : ether|fddi|tr|wlan|ip|ip6|arp|rarp|decnet|tcp|udp

Examples