/PLAYBOOK · 2026-08-23

Tcpdump Packet Analysis: CLI Traffic Triage and Security Detection

Hands-on tcpdump: install, common BPF filters, attack-traffic identification, and pcap analysis. Copy-paste commands for ops and security to locate network anomalies and intrusion traces from the CLI.

Applicable Scenarios

tcpdump is the default CLI network diagnostic on Linux servers. Typical uses: site access failures and connect timeouts, outbound packet behavior, SYN flood and port-scan detection, third-party service comms checks, packet capture forensics on headless hosts. Unlike Wireshark GUI, tcpdump runs on minimal installs with tiny resource cost. First-choice tool for production triage.

Prerequisites

Linux server (CentOS / Ubuntu / Debian), root or sudo
NIC supports promiscuous mode (capture frames not destined to local MAC)
libpcap installed (tcpdump dependency)

How It Works

tcpdump sits on libpcap. NIC goes promiscuous; kernel copies frames to the tcpdump process; BPF (Berkeley Packet Filter) matches packets. BPF matching runs in-kernel, so capture stays fast under high traffic. Output is protocol-decoded: timestamp, src/dst IP, ports, flags, length.

Procedure

Step 1: Install tcpdump

`# CentOS / RHEL
yum install -y tcpdump

# Ubuntu / Debian
apt-get update && apt-get install -y tcpdump

# verify
tcpdump --version`

Step 2: Basic capture

`# all traffic on eth0, print to screen
tcpdump -i eth0

# stop after 100 packets
tcpdump -i eth0 -c 100

# no DNS reverse lookups; numeric addresses
tcpdump -i eth0 -nn

# write to file (production: land to disk, analyze later)
tcpdump -i eth0 -nn -w /tmp/capture.pcap -c 10000`

Step 3: Common filters

`# by host
tcpdump -i eth0 -nn host 192.168.1.10

# by port
tcpdump -i eth0 -nn port 80
tcpdump -i eth0 -nn port 443 or port 22

# by protocol
tcpdump -i eth0 -nn tcp
tcpdump -i eth0 -nn udp

# combined
tcpdump -i eth0 -nn src 192.168.1.10 and dst port 8080

# SYN packets (TCP handshake first packet)
tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'`

Step 4: Read pcap files

`# read saved capture
tcpdump -r /tmp/capture.pcap -nn

# count connections per source IP (scan/flood triage)
tcpdump -r /tmp/capture.pcap -nn 'tcp[tcpflags] & tcp-syn != 0' | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# filter one host from file
tcpdump -r /tmp/capture.pcap -nn host 10.0.0.5`

Step 5: Attack-traffic identification

`# live port 80: SYN flood (many SYN, no ACK)
tcpdump -i eth0 -nn 'tcp port 80 and (tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0)' -c 500 | wc -l

# full-port scan (many dest ports from one IP in a short window)
tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0' -w /tmp/scan.pcap -c 2000
tcpdump -r /tmp/scan.pcap -nn | awk '{print $3}' | cut -d. -f1-4 | uniq -c | sort -rn`

Config Verification

Run these to confirm tcpdump works:

`# background capture 10s, then hit local web
tcpdump -i eth0 -nn port 80 -c 10 -w /tmp/verify.pcap &
sleep 10
curl -s -o /dev/null http://127.0.0.1/

# read file; expect TCP handshake between local and target
tcpdump -r /tmp/verify.pcap -nn`

`SYN`, `SYN-ACK`, `ACK` flag sequence in output means the capture path is live.

FAQ

FAQ 1: tcpdump says You dont have permission to capture on that device?

Current user lacks raw socket rights. Run tcpdump with `sudo`, or add the user to the `wireshark` group: `usermod -aG wireshark username`, then re-login.

FAQ 2: Capture file too large; how to filter before write?

Limit packet count with `-c`, snapshot length with `-s` (e.g. `-s 96` keeps headers only): `tcpdump -i eth0 -nn -s 96 -w /tmp/cap.pcap 'tcp port 443'`. Cuts file size hard.

Summary

tcpdump is the baseline Linux tool for traffic triage and security detection. BPF filters, pcap analysis, and attack signatures let ops locate connection faults, scans, and floods fast. Keep common filters as shell scripts. On suspected intrusion, capture to disk first; preserve evidence.