How to monitor network traffic on specific ports with tcpdump

Why monitor specific network ports?

When an application fails to connect to a database or an external API, the root cause usually lies within the network layer. At such moments, checking application logs does not always reveal the truth, because the error might happen even before the data packet gets processed by the software. In practice, this means we need to intercept the electrical signals or logical packets entering and leaving the server to understand precisely what is happening on the wire or virtual interface. To further expand your troubleshooting toolkit, check out our guide on how to use tcpdump to capture network packets on Linux.

The tcpdump utility is a classic command-line program in the Unix world that acts as an invisible listener. It captures copies of every packet crossing a network interface and displays them in a readable format. However, on busy servers, capturing everything generates gigabytes of useless data within seconds. That is why filtering traffic by specific ports—such as port 3306 for MySQL or port 443 for HTTPS requests—becomes an essential skill for any system administrator or support engineer.

Identifying the correct network interface

Before starting any capture, you must figure out which network interface on your Linux server is handling the actual traffic. In modern environments with Docker or multiple network cards, traffic might flow through virtual interfaces like docker0, eth0, or specific network bridges. If you listen on the wrong interface, the command will simply return no packets, making the network look completely dead.

To list available interfaces on your system and check the status of each, run the command below in your terminal:

ip link show

This command lists all physical and virtual interfaces present on the machine. Note down the name of the interface that shows active traffic (usually identified by names like eth0, ens18, or enp3s0). Choosing the correct interface ensures tcpdump focuses exclusively on the channel where the communication failure is happening, isolating the noise generated by other applications running on the same server.

How to capture TCP traffic on a specific port

The TCP protocol is responsible for reliable connections requiring delivery confirmation, such as web requests and database access. When an application fails to establish this connection, tcpdump is the ideal tool to discover whether the packet is leaving the server, reaching the destination, or being dropped by a firewall along the way. If your issue involves broader latency bottlenecks, you can also review the tips in how to use tcpdump to troubleshoot network latency and errors.

To capture only packets targeting or originating from a specific TCP port, we use the port operator combined with the desired number. The command below listens to port 443 (HTTPS) on the eth0 interface:

sudo tcpdump -i eth0 -nnv 'tcp port 443'

In this command, the -i flag sets the interface, -nn prevents DNS and IP name resolution to speed up output, and -v increases the level of detail shown on screen. Wrapping the expression 'tcp port 443' in single quotes is crucial to prevent the Linux shell from misinterpreting special characters. As a result, you will see every connection setup request and data flow exclusively on that port in real time.

How to isolate UDP traffic and alternative ports

Unlike TCP, the UDP protocol is simpler and does not guarantee that a packet reached its destination. It is widely used in streaming services, DNS lookups, and monitoring protocols like SNMP. When a UDP-based service fails, diagnosing the issue requires capturing short bursts of packets that often go unnoticed in traditional infrastructure monitoring tools.

To capture exclusively UDP packets on a specific port, such as port 53 used by domain name servers (DNS), the procedure is quite similar, changing only the protocol filter. Run the following command in your terminal:

sudo tcpdump -i any -nn 'udp port 53'

Notice that we use -i any to monitor all network interfaces simultaneously, which comes in handy when we are unsure which exact card is processing those queries. This flexibility lets you quickly map whether DNS requests are leaving the server and whether replies are returning properly, helping debug intermittent name resolution failures.

Often, analyzing traffic directly in the terminal while a problem happens is stressful and difficult. For complex scenarios where failures occur sporadically, the best strategy is to save raw packets into a file with a .pcap extension and transfer it to a machine with a graphical interface for detailed inspection.

Saving captures for later analysis in Wireshark

To record traffic from a specific port directly into a file, combine the -w flag with the appropriate filter command. Check out the practical example below:

sudo tcpdump -i eth0 'port 8080' -w traffic_port_8080.pcap

The generated file stores the exact bits captured at execution time. You can stop recording at any moment by pressing Ctrl + C. Later, this file can be opened in visual software like Wireshark, allowing you to apply advanced filters, follow complete TCP conversation flows, and inspect internal packet payloads with complete comfort. To explore these architectural concepts further in production, see our related technical analysis on Pods stuck in Terminating? How to force remove them in Kubernetes.

Final Thoughts

Mastering tcpdump to monitor specific ports transforms how you troubleshoot network and system communication issues. Instead of guessing why a connection failed, you get to see exactly what is happening at the packet level. This technical clarity accelerates diagnostics and drastically reduces production downtime for your services.

Remember to always use appropriate filters to avoid cluttering your terminal with unnecessary data and to use capture files whenever you need a more thorough analysis. With these practices in your daily engineering toolkit, any network anomaly ceases to be an insurmountable mystery and becomes just another straightforward problem to solve.