How to use tcpdump to inspect network traffic

What is tcpdump and why it matters

When an application fails to communicate over the network, developers and system administrators often find themselves troubleshooting in the dark. This is precisely where tcpdump comes in, a classic command-line tool on Linux specialized in capturing and displaying data packets traveling across a network interface. In practice, it acts like a wiretap on your server's fiber optic cables or Wi-Fi waves, letting you see exactly what is leaving and entering. For anyone who has ever investigated network packet loss using the ping command, tcpdump goes a step further by opening up the internal payload of each message.

Unlike complex graphical interfaces, tcpdump is lightweight, runs directly in the terminal, and comes built into the vast majority of Linux distributions. It interacts directly with the operating system's link layer through capture libraries, intercepting each frame before the file system or applications even process the information. This means that if data reached the network interface, tcpdump can show it. However, collecting everything passing through a modern network can generate an overwhelming amount of data, making mastery of filters and targeted reading techniques essential.

Setting up the environment and running your first capture

To start using the tool, you will generally need superuser privileges, since listening to network traffic is a sensitive security operation. The first practical step is discovering which network interfaces are available on your server using commands like ip a. With the interface identified, you run the base command telling it which card to monitor. In practice, this means opening your terminal and typing a simple instruction to watch traffic flow in real-time on your screen.

To perform this basic procedure safely and orderly, follow the steps below in your terminal:

1. Identify the exact name of your active network interface by running

   ip link show

   in your terminal.
2. Start basic listening on your chosen interface (for example, eth0) requiring administrative permissions with

   sudo tcpdump -i eth0

   to view raw packets.
3. Stop the capture at any time by pressing

   Ctrl + C

   to analyze the statistical summary provided by the utility.

Each line displayed in the terminal represents an individual packet crossing the network interface. It includes information such as the exact capture timestamp, source and destination IP addresses, ports involved, and specific transport protocol flags. However, without filters, this flood of data scrolls past too quickly for human reading, requiring selection criteria to isolate the problem.

Filtering traffic to find what matters

The true power of tcpdump emerges when you apply capture filters based on BPF syntax, which stands for Berkeley Packet Filter. This built-in language allows you to restrict collection to specific IP addresses, targeted ports, or even particular protocols like TCP, UDP, or ICMP. In practice, if you suspect a specific database is causing slowness, you can instruct the tool to ignore everything else and show only conversations directed to that specific port.

For example, to monitor exclusively traffic destined for port 80 on a web server, you execute the restricted instruction in the terminal. In practice, this means filtering out visual noise generated by DNS lookups, administrative SSH traffic, and other background chatter. Proper use of these filters prevents log files from growing uncontrollably and exhausting server disk space during extended investigations.

sudo tcpdump -i eth0 port 80

Beyond ports, you can combine conditions using logical operators like and, or, and not. If you want to isolate packets exchanged with a specific IP address, the command structure adjusts to focus on that exact host. This flexibility turns tcpdump into a Swiss Army knife for quick security audits and communication failure diagnostics between microservices.

Reading headers and interpreting transport flags

Capturing traffic is only half the battle; the other half consists of reading and interpreting packet headers. tcpdump offers different levels of verbosity through flags like -v, -vv, and -vvv, which reveal internal details such as packet time-to-live (TTL), TCP window size, and sequence numbers. In practice, understanding these fields helps diagnose hanging connections, excessive retransmissions, or network MTU issues.

When a TCP connection is established, the famous three-way handshake occurs. tcpdump allows you to clearly visualize SYN, ACK, and FIN flags traveling between machines, revealing whether a server refused a connection or simply dropped the packet due to firewall rules. Knowing how to cross-reference this information with infrastructure utilities, such as diagnosing network loops on switches with tcpdump, ensures a systemic view of your environment.

Another important detail is the -nn parameter, which disables reverse DNS and port name resolution, causing the utility to display raw numbers directly instead of trying to query local name servers. This drastically accelerates data rendering on screen and prevents the diagnostic process itself from generating unwanted network traffic during critical incident analysis.

Saving captures to files for advanced analysis

In complex intermittent problems, watching the terminal in real time is not enough. For these scenarios, tcpdump lets you write all captured traffic directly into a binary file using the -w parameter, preserving every byte for later analysis in graphical tools like Wireshark. In practice, this means you can collect data on a remote production server, download the generated file, and inspect every detail on your own development machine.

To ensure the generated file does not corrupt the system due to lack of space, it is advisable to limit the size of each captured packet using the -s flag, which sets the snapshot length. Capturing only the first 64 or 96 bytes of each packet is usually more than enough to inspect network and transport headers without recording giant payloads of files transferred via HTTP.

sudo tcpdump -i eth0 -s 96 -w network_capture.pcap

Later, you can read this binary file back into the terminal using the -r parameter, applying new read-time filters without needing to run a fresh live capture. This approach guarantees operational safety, letting you collect evidence overnight and analyze data calmly during business hours. To explore these architectural concepts further in production, see our related technical analysis on How to test optocouplers on a board: Practical guide.

Conclusion and best practices in packet analysis

Mastering tcpdump is a fundamental skill for any professional dealing with networks, infrastructure, or backend development on Linux. The ability to inspect traffic directly at the source eliminates guesswork and accelerates troubleshooting for issues that once seemed invisible. By combining precise filters, careful header reading, and offline audit file recording, you gain total autonomy to audit the real behavior of your systems.

Always remember to use these capabilities cautiously in high-volume environments, respecting privacy policies and avoiding the capture of sensitive data without authorization. Constant practice with BPF filters and a solid understanding of the TCP/IP model will ensure you tackle any network failure with calm and surgical precision.