How to use tcpdump on Linux to capture network packets

What is tcpdump and why is it essential on Linux

When an application fails to connect to a database or when network traffic appears inexplicably slow, system administrators need to look beyond superficial CPU and memory usage metrics. In practice, this means opening the operating system's hood to examine the raw data traveling through cables or virtual network cards. tcpdump is the classic Linux command-line utility designed precisely for this purpose: it intercepts and displays network packets passing through a specific interface, acting as a digital stethoscope for data traffic.

Unlike complex visual tools, tcpdump runs on headless servers without a graphical interface, making it ideal for remote diagnostics via SSH. Every network packet arriving at or leaving the machine is inspected in real time, allowing you to discover whether packets are being dropped by a firewall or if the application is even sending the expected request. Before performing deeper data loss analyses using utilities like mtr, inspecting raw content with tcpdump offers exact evidence of what is happening at the data link and transport layers.

How to list available network interfaces on the system

Before capturing any data, the first practical step is to find the exact name of the network interface you want to monitor. In modern Linux, traditional names like eth0 have given way to predictable naming conventions based on physical location or bus controllers, such as enp3s0 or wlan0. To list all active and inactive interfaces available on your operating system, use the ip command with the link argument.

Open your Linux server terminal and run the following command to inspect the connected network adapters:

ip link show

The output will display a numbered list containing the current state of each interface, indicating whether it is operational (UP) or shut down (DOWN). Identify the name of the network card handling the traffic you want to investigate, as this name will be mandatory in tcpdump capture commands to avoid listening on all interfaces simultaneously, which would generate an excessive volume of irrelevant data.

Capturing basic traffic with essential commands

With the network interface properly identified, running tcpdump in its simplest mode requires superuser privileges, since the tool directly accesses the network card's promiscuous mode to read packets destined for other hosts if necessary. In practice, calling the command without any filters will flood the terminal with thousands of lines of text representing every HTTP, DNS, ARP, or SSH packet passing through the chosen card.

To start a basic capture on the default interface, type the following command in your Linux terminal:

sudo tcpdump -i enp3s0

To stop execution and return to the command prompt, simply press the Ctrl + C keys. The utility will display a statistical summary reporting how many packets were captured by the interface, how many were ignored by the kernel, and how many suffered drops due to buffer limitations. This immediate feedback helps you understand traffic intensity at the moment of collection.

Filtering packets by IP address, port, and protocol

Since data volume on a production server is usually overwhelming, reading every line of text printed on the screen becomes a humanly impossible task. This is where filters based on BPF (Berkeley Packet Filter) syntax come in, allowing you to limit capture only to traffic that truly matters for investigating your current connectivity problem.

You can restrict searches by source or destination IP addresses, specific service ports, or protocols like TCP and UDP. For example, to monitor exclusively traffic destined for or originating from the IP address 192.168.1.50, use the following command:

sudo tcpdump -i enp3s0 host 192.168.1.50

If your goal is to isolate only requests directed to port 443, commonly used by secure HTTPS connections, simply append the port restriction to the command. Combining logical operators such as and, or, and not allows you to create highly refined rules to isolate specific failures in corporate environments or even in home testing labs.

Saving captures in PCAP files for later analysis

Often, diagnosing an issue in real time under the pressure of a production outage is not the best strategy. A much safer and more professional approach consists of recording the packet flow into a binary file for subsequent thorough analysis, either on your workstation using a graphical interface or by sending the file to another specialist engineer.

Tcpdump allows you to save all captured traffic using the -w flag, writing data into a file with a .pcap extension. Run the command below to save two hundred packets directed to port 80 into a file named trafego.pcap:

sudo tcpdump -i enp3s0 -c 200 -w trafego.pcap port 80

Later, you can read the contents of this binary file directly in the terminal using tcpdump's -r flag. This technique preserves the exact bits transmitted across the network, ensuring no header detail is lost during the technical incident investigation. To complement this implementation in production environments, see our related technical analyses on How to test power good circuit with a multimeter and How to test SMD MOSFET transistors on board with multimeter.

Final considerations on network diagnostics

Mastering tcpdump transforms how you perceive the behavior of networked systems and applications, eliminating guesswork during complex troubleshooting. By combining precise command-line packet capture with a solid understanding of transport protocols, administrators gain total autonomy to validate firewall rules, debug dropped connections, and certify the integrity of data flows on Linux servers. Integrating this inspection routine into your daily operational workflow dramatically elevates your technical resilience and responsiveness against any downtime.