tcpdump

Displays packet information for network traffic that matches a specified filter. The traffic can be captured from an interface or read from a previously saved file.

Note

Press Ctrl+C to exit this process.

Syntax

tcpdump [-aAdDeflLnNOpqRStuUvxX] [-ccount] [-Cfile_size] [-Espi@addr algo:secret] [-Ffile] [-iinterface] [-Msecret] [-rfile] [-ssnaplen] [-Ttype] [-wfile] [-Wfilecount] [-ydatalinktype] [-Zuser] [filter]

Parameters

-a

Attempts to convert network and broadcast addresses to names.

-A

Prints packets in ASCII (no link level headers). Used to capture Web pages.

-c count

Exits after receiving the specified number of packets. If a count is not specified, press Ctrl+C to stop the capture.

-C file_size

Specifies the maximum output file size in millions of bytes. Before the value is exceeded, a new file is opened with the name specified by the -w option, followed by a number (starting with 1).

-d

Prints the compiled packet-matching code in a human-readable form to standard output.

-D

Lists the network interfaces on which tcpdump can capture packets. The interface name or number can be used with the -i option.

Prints the link-level headers.

-E spi@addr algo:secret

Decrypts IPsec ESP packets that are addressed to addr and contain the Security Parameter Index value spi. The algorithms are des-cbc, 3des-cbc,blowfish-cbc, rc3-cbc, cast128-cbc, or none. The default is des-cbc. The secret is the ASCII text for the ESP secret key. A hexadecimal value can be preceded by 0x. This option is for debugging purposes, and using a true secret key is not recommended.

-f

Prints non-local IPv4 addresses numerically rather than symbolically (used to avoid long translation times).

Note

To avoid printing symbolic names, it is recommended that you use the -n or -nn option instead of the -f option.

-Ffile

Gets the filter from the specified file. A filter on the command line is ignored.

-i interface

Specifies the name or number of the interface used to capture traffic. If omitted, the lowest numbered, active interface is used (excluding loopback). Use the -D option to list the available interfaces. The interface pether refers to a physical ethernet interface. The physical ethernet interface is bridged to the logical ethernet device.

-l

Buffers the standard output so you can view the data while capturing it.

-L

Lists the known data link types for the interface and exits.

-M secret

Specifies a shared secret used to validate the MD5 digests found in TCP segments.

-n

Disables the conversion of host addresses to names.

-nn

Disables the conversion of protocols and port numbers to names.

-N

Omits domain name qualification of hostnames.

-O

Disables the packet-matching code optimizer (use only if you suspect a bug in the optimizer).

-p

Disables use of promiscuous mode on the interface.

-q

Prints less protocol information so output lines are shorter.

-r file

Reads packets from a file that was created with the -w option.

-R

Assumes ESP/AH packets are based on old specifications (RFC1825 to RFC1829). If specified, tcpdump does not print the replay prevention field.

-s snaplen

Captures the specified number of bytes (snapshot length) from each packet (the default of 68). Note that larger values increase the processing time, and may cause packets to be lost. A zero value captures the entire packet.

-S

Prints absolute, rather than relative, TCP sequence numbers.

-t

Omits the time stamp on each line.

-tt

Prints an unformatted time stamp on each line.

-ttt

Prints the time difference in micro-seconds from the previous line.

-tttt

Prints the date and time on each line.

-T type

Forces the filtered packets to be interpreted as the specified type. The current types are: aodv (Ad-hoc On-demand Distance Vector Protocol), cnfp (Cisco NetFlow Protocol), rpc (Remote Procedure Call), rtcp (Real-Time Applications Control Protocol), rtp (Real-Time Applications Protocol), snmp (Simple Network Management Protocol), tftp (Trivial File Transfer Protocol), vat (Visual Audio Tool), and wb (distributed White Board).

-u

Prints undecoded NFS handles.

-U

When the -w option is used, this option saves each packet as it is processed, rather than waiting until the output buffer is filled.

-v

Prints additional packet information, such as the time to live, identification, total length, and options for IP packets. Enables additional packet integrity checks as well, such as verifying the IP and ICMP header checksum.

-vv

Prints more information, such as additional fields from NFS reply packets, and SMB packets are fully decoded.

-vvv

Prints more information. For example, telnet SB ... SE options are printed in full, and -X telnet options are printed in hexadecimal.

-w file

Writes the raw packets to the specified file, rather than parsing and displaying them on the standard output. They can later be displayed with the -r option.

-W filecount

Used with the -C option to limit the number of files created. The oldest files are overwritten in a rotating sequence, as needed.

-x

Prints each packet in hexadecimal (no link level headers). The smaller of the entire packet or -s bytes are printed. The entire link-layer packet is printed, so for link layers that pad (such as Ethernet), the padding bytes will be printed when the higher layer packet is shorter than the required padding.

-xx

Prints each packet in hexadecimal, including the link level headers.

-X

Prints each packet in hex and ASCII (no link level headers). Useful for analyzing new protocols.

-XX

Prints each packet in hex and ASCII, including the link level headers.

-y datalinktype

Specifies the data link type to use.

-Zuser

Drops privileges (if root), and changes the user ID to the specified user and the group ID to the primary group of the specified user.

filter

Specifies the type of packets to be captured (all traffic is captured by default). For example:

Example

The following example shows a sample of the output from tcpdump.

hostname # tcpdump 18:48:57.391331 IP 192.168.0.186.1386 > 192.168.0.69.ssh: . ack 23560 win 16404
18:48:57.391359 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 25984:26248(264) ack 105 win 7504
18:48:57.391826 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 26248:26476(228) ack 105 win 7504
18:48:57.392732 IP 192.168.0.186.1386 > 192.168.0.69.ssh: . ack 23824 win 16140
18:48:57.392763 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 26476:26624(148) ack 105 win 7504
18:48:57.393210 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 26624:26852(228) ack 105 win 7504
18:48:57.396132 IP 192.168.0.186.1386 > 192.168.0.69.ssh: . ack 24184 win 17520
18:48:57.396161 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 26852:27000(148) ack 105 win 7504
18:48:57.396626 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 27000:27228(228) ack 105 win 7504
18:48:57.397079 IP 192.168.0.69.ssh > 192.168.0.186.1386: P 27228:27376(148) ack 105 win 7504
18:48:57.400616 IP 192.168.0.186.1386 > 192.168.0.69.ssh: . ack 24544 win 17160
333 packets captured
333 packets received by filter
0 packets dropped by kernel

Supported appliances

Endpoint Security (HX): Release 2.5