How to use tcpdump to capture packets and inspect network traffic

What is tcpdump and why it matters

When an application fails to communicate with a database or an external API, network and support engineers face the challenge of discovering where the packet was dropped. tcpdump is a native Linux command-line utility designed to analyze and display network packets passing through a specific interface. In practice, it acts like a wiretap for your server's digital traffic, letting you see exactly what data is leaving and arriving.

Unlike complex graphical tools, tcpdump runs directly in the terminal, making it indispensable for remote servers accessed via SSH where graphical interfaces do not exist. However, without the right filters, the command can flood the screen with thousands of lines per second, making investigation impossible. Mastering filter expressions is the turning point between resolving an incident in minutes and spending hours trying to decipher network noise, something we also cover when inspecting traffic in Docker containers and isolated environments.

How to start a basic capture on the correct interface

Before applying complex filters, the first step is identifying which network interface is receiving the relevant traffic. Running the command without parameters can generate a massive volume of data if the machine is under heavy load. To start safely, the simplest command requires administrator privileges to access the network driver directly.

To perform this operation safely on the command line, follow these practical steps:

1. List the available network interfaces on the system to identify the correct device name using the command

   ip link show

2. Start listening on the chosen interface, limiting the number of displayed packets with the count parameter

   sudo tcpdump -i eth0 -c 10

3. Save the capture to a binary file for later analysis in graphical tools

   sudo tcpdump -i eth0 -w capture.pcap

The file generated with the .pcap extension can be transferred to your local machine and opened in software like Wireshark. This record-first, analyze-later approach prevents you from missing rapid network events due to terminal scrolling lag.

Filtering by specific IP addresses and ports

In a busy production environment, capturing all traffic is unfeasible. The true utility of tcpdump emerges when we combine filtering primitives to isolate exactly what matters. We can restrict the capture to a specific IP address, a service port, or a traffic direction, such as incoming or outgoing packets.

For example, to monitor all traffic destined for or originating from a server with IP 192.168.1.50, we use host-based syntax. If we want to narrow it down further and observe only requests directed to port 443, which corresponds to secure HTTPS traffic, we combine conditions using logical operators like 'and'. This surgical precision is essential to isolate communication failures without exposing sensitive data from other applications running on the same host.

Using boolean expressions to isolate complex issues

When investigating intermittent failures, a simple filter is often not enough. Tcpdump allows you to build complex boolean expressions using the and, or, and not operators. This enables refined rules, such as monitoring traffic between two specific IPs while excluding traffic generated by internal monitoring tools.

Another powerful feature is the ability to filter packets based on TCP flags, such as packets with the SYN flag enabled. This is extremely useful for diagnosing hanging connection attempts or connections refused by firewalls, complementing other diagnostic routines like reading system logs in real time to correlate network and operating system events.

Inspecting packet contents with hexadecimal format

By default, tcpdump displays only packet headers, showing IP addresses, ports, and sequence numbers. However, in many debugging scenarios involving custom protocols or legacy APIs, it is necessary to inspect the payload, meaning the actual data payload traveling inside the packet.

To view raw packet contents directly in the terminal, we use modifiers that print data in hexadecimal and ASCII formats. This allows you to verify whether an application is sending the correct bytes or if there are corrupted characters along the way. Although hexadecimal reading requires patience, it solves obscure problems where headers look perfect, but the message content fails at the receiving end. To explore these architectural concepts further in production, see our related technical analysis on How to test an open fusible resistor with a multimeter.

Final thoughts on network diagnostics

Tcpdump remains one of the most reliable, lightweight, and versatile tools in any technology professional's arsenal. Mastering its advanced filters transforms how we approach connectivity problems, replacing trial and error with an investigation based on real evidence extracted directly from the cable or virtual interface.

Practicing filter expressions in staging environments prepares you to act quickly and accurately during critical production incidents. By combining command-line capture, pcap file storage, and a solid understanding of network protocols, any connectivity bottleneck ceases to be an insurmountable mystery.