Tcpdump command examples

Hey everyone! As someone who's spent countless hours troubleshooting network woes, I can tell you that tcpdump is an absolute lifesaver. It’s like having x-ray vision for your network traffic. I often find myself using it to quickly diagnose what's happening on a server or my local machine when things go astray. Let me share some of my go-to tcpdump commands, building on the essentials. First off, for basic capturing, you'll often just want to see what's passing by a specific network interface. I usually start with sudo tcpdump -i eth0 (replace eth0 with your actual interface, like enp0s3 or wlan0). This gives you a raw stream, which is useful but can be overwhelming. That’s where filtering comes in handy, and it's a game-changer. If you're looking for issues on a particular machine, tcpdump -i eth0 host 192.168.1.100 will show you all traffic to and from that IP. Need to check if a web server is responding? tcpdump -i eth0 port 80 is your friend – it filters specifically for HTTP traffic. For other services, just swap out the port number; for instance, tcpdump port 22 for SSH. I also frequently filter by protocol. If I suspect an issue with ICMP (like pings not working), tcpdump icmp gives me just that. Similarly, tcpdump tcp or tcpdump udp helps narrow down to TCP or UDP traffic. And for a whole segment of the network? tcpdump net 192.168.1.0/24 is perfect for monitoring a subnet. One of the most practical things I do is saving captures to files. When I need to analyze traffic offline or share it with a colleague, tcpdump -w mycapture.pcap saves everything to a .pcap file. Later, I can open this with Wireshark or even tcpdump -r mycapture.pcap to review it. Don't forget the -r flag to read from the file! Sometimes, you need to see the nitty-gritty details of each packet. Using options like -A (ASCII) or -X (hex and ASCII) with -q (quiet, less verbose) can be incredibly insightful for displaying detailed packet information. For instance, tcpdump -A -s 1500 port 80 can show you the actual HTTP requests/responses, making it easy to spot malformed packets or unexpected data. The -s flag sets the snaplen to capture full packets. For more advanced scenarios, I've found advanced filtering using TCP flags and VLANs to be super powerful. For example, to catch only SYN packets (the start of a TCP handshake), I use tcpdump 'tcp[tcpflags] & tcp-syn != 0'. Or, if I'm working in a virtualized environment, tcpdump vlan 100 helps me focus on traffic from a specific VLAN. These advanced filters let you zero in on very specific network events, which is crucial for deep-dive network analysis and security auditing. Tcpdump might seem intimidating at first, but with these examples, you'll be well on your way to mastering network diagnosis on Linux. It's truly an indispensable tool for any tech enthusiast or professional!