To capture packets flowing through a specific interface, use the -i flag with the interface name. This is especially useful on systems that do not have a command to list interfaces. # tcpdump -DĢ.nflog (Linux netfilter log (NFLOG) interface)ģ.nfqueue (Linux netfilter queue (NFQUEUE) interface)ĥ.any (Pseudo-device that captures on all interfaces) To see the list of network interfaces available on the system and on which tcpdump can capture packets. Running tcpdump without any options will capture all packets flowing through the default interface.

Or using DNF if RHEL 8 # dnf install tcpdump -y tcpdump command options On RPM-based distributions tcpdump can be installed with YUM : # yum install tcpdump -y On Debian based distributions tcpdump can be installed with the APT command : # apt install tcpdump -y The number of bytes available in the receiving buffer.

Sequence number of the data in the packet.

Tells the receiver to process packets instead of buffering them. Acknowledgment packet received successfully. The first step in establishing the connection. This field can have the following values : This can include more than one value, like in this example for FIN-ACK. Flags indicate the state of the connection.

destination hostname or IP, and port number ( 10.0.1).

the source hostname or IP, and port number ( 10.0.0.50.80).

It prints one line for each packet, and command keeps running until you press Ctrl+C to terminate. Tcpdump allows you to examine the headers of the TCP/IP packets.

It is a good idea to run this tool occasionally to keep a watch over your network. The packets can be saved to a file and later analyzed. The tcpdump tool can be of great help when resolving networking issues. It is an industry-standard for capturing and analyzing TCP/IP packets. Tcpdump is an amazing command-line tool for network sniffing.

Open tcpdump in wireshark