How to Use tcpdump for Network Troubleshooting

How to Use tcpdump for Network Troubleshooting

tcpdump is one of the most powerful command-line tools for capturing and analyzing network traffic. It is lightweight, fast, and available on most Linux distributions.

---

Install tcpdump

Ubuntu/Debian:

sudo apt install tcpdump

Fedora:

sudo dnf install tcpdump

---

Capture Traffic

Capture packets on interface eth0:

sudo tcpdump -i eth0

---

Capture HTTP Traffic

sudo tcpdump port 80

Only HTTP packets will be displayed.

---

Capture Traffic from a Specific Host

sudo tcpdump host 192.168.1.50

Useful when troubleshooting communication with a single device.

---

Save Packets

sudo tcpdump -w capture.pcap

The capture can later be opened in Wireshark.

---

Read a Capture

tcpdump -r capture.pcap

---

Filter by Protocol

TCP only:

sudo tcpdump tcp

UDP only:

sudo tcpdump udp

DNS traffic:

sudo tcpdump port 53

---

Why Use tcpdump?

It is ideal for:

• Network troubleshooting
• Malware investigations
• Security monitoring
• Learning networking
• Packet collection

---

Conclusion

Although Wireshark provides a graphical interface, tcpdump remains the preferred packet capture tool for many Linux administrators because of its speed and flexibility.