How to inspect TCP network traffic in real time with tcpdump

What is tcpdump and why it is essential

When an application fails to communicate with a database or an external API, developers are often left in the dark wondering where the data got lost. In practice, guessing the root cause of a network failure wastes precious troubleshooting time. This is exactly where tcpdump comes in, a lightweight yet powerful command-line utility capable of intercepting and displaying data packets traveling across your server's network in real time.

Unlike complex graphical software, tcpdump runs directly in the terminal, making it ideal for remote servers accessed via SSH where graphical displays are unavailable. It acts like a wiretap for your computer's virtual or physical network cables. To fully grasp connection behavior, we often combine this tool with port diagnostics, as explained in our guide on how to use the ss command on Linux to audit network connections, ensuring complete traffic visibility.

Preparing the environment and capturing your first packet

Before recording data, we need to identify which network interface the system uses to communicate with the outside world. On modern servers, names like eth0 or enp3s0 are common. Because packet capture requires direct access to the hardware or the operating system kernel, you will need to run commands with administrative privileges using sudo.

To perform a basic capture and watch raw data stream across your screen, simply run the command pointing to your desired interface. If you want to deepen your investigations and learn how to track lost network packets with tcpdump, mastering this foundational command is the required first step. See below how to start a simple read on the default interface:

sudo tcpdump -i eth0

Once the command runs, you will see a flood of lines appearing on the screen. Each line represents a data packet crossing the network card, containing source and destination IP addresses, ports, and the protocol used. To stop the execution, simply press the Ctrl and C keys on your keyboard.

Filtering specific ports and addresses

Leaving tcpdump running without filters on an active production server is like trying to drink water from a firehose: the volume of information is overwhelming and useless. Therefore, the utility's true power shines when we apply filters to isolate only the traffic we care about, such as a specific port where our microservice listens.

If you need to investigate communication failures in a web application running on port 80 or 443, or a database on port 5432, you can instruct the command to ignore everything else. To isolate traffic for a specific port, use the following command in your terminal:

sudo tcpdump -i eth0 port 5432

This filter restricts output exclusively to packets whose source or destination involves the PostgreSQL database port. As a result, it becomes much easier to see whether requests are reaching their destination and whether the server is responding back.

Analyzing TCP flags and connectivity issues

The TCP protocol uses a system of acknowledgments and flow control based on flags. When a connection is established, the famous three-way handshake occurs, involving SYN, SYN-ACK, and ACK signals. Understanding these messages helps identify precisely where a connection is dying.

If you notice an application trying to talk to another and receiving only packets with the RST flag, it means the destination actively refused the connection, usually because no service is listening on that port. To view these flag details in a readable format in the terminal, we add parameters that avoid time-consuming hostname lookups:

sudo tcpdump -nnvv -i eth0 tcp port 80

The -nn parameter prevents the program from wasting time trying to resolve IP addresses into domain names, while -vv increases the level of detail displayed on screen. This combination reveals the exact state of TCP conversations, allowing you to isolate bottlenecks that often cause unexpected behavior in distributed systems. To explore these architectural concepts further in production, see our related technical analysis on Why pods get OOM Killed in Kubernetes and how to adjust limits.

Saving captures for later analysis

Often, network issues occur intermittently and transiently, making it impossible to analyze the terminal screen at the exact moment of failure. In these cases, the best strategy is to record raw traffic directly into a file for later detailed inspection in visual tools.

You can save the capture output into a file with a pcap extension using the write parameter. To store interface packets in a secure file, run the command below specifying the output name:

sudo tcpdump -i eth0 -w network_capture.pcap port 443

This generated file can be transferred to your local machine and opened in software like Wireshark, enabling meticulous study of every single byte transmitted. Mastering this technique guarantees total autonomy to solve complex infrastructure and network problems without relying on guesswork.