TCPDUMP(1) General Commands Manual TCPDUMP(1) (NAME) tcpdump - (SYNOPSIS) tcpdump [ -AbdDefghHIJKlLnNOpqStuUvxX# ] [ -B buffer_size ] [ -c count ] [ --count ] [ -C file_size ] [ -E spi@ipaddr algo:secret,... ] [ -F file ] [ -G rotate_seconds ] [ -i interface ] [ --immediate-mode ] [ -j tstamp_type ] [ -m module ] [ -M secret ] [ --number ] [ --print ] [ -Q in|out|inout ] [ -r file ] [ -s snaplen ] [ -T type ] [ --version ] [ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ] [ -Z user ] [ --time-stamp-precision=tstamp_precision ] [ --micro ] [ --nano ] [ expression ] tcpdump expression ( expression pcap-filter(7) ) . -w / -r . -V . expression tcpdump . tcpdump -c SIGINT ( control-C) SIGTERM ( kill(1)) -c SIGINT SIGTERM . tcpdump : "" ( tcpdump ) " " ( tcpdump - tcpdump tcpdump tcpdump ) " " ( tcpdump 0 ). SIGINFO BSD ( macOS) Digital/Tru64 UNIX SIGINFO ( "status" control-T macOS "status" stty(1) ) . SIGINFO SIGUSR1 . SIGUSR2 -w (flush) . ( ) pcap(3PCAP) . ..SH " (OPTIONS)" -A ( ) ASCII. . -x[x] -X[X] . -b AS BGP ASDOT ASPLAIN. -B buffer_size --buffer-size=buffer_size buffer_size KiB ( ). -c count count . --count () stdout . tcpdump . -C file_size file_size . -w . file_size ( ) . k/K m/M g/G (KiB) (MiB) (GiB) . -d . DLT DLT ( ) tcpdump DLT pcap -r DLT -i DLT -y -i . -d . -r -i -d tcpdump ( -i ). DLT EN10MB -y . -dd C. -ddd ( ). -D --list-interfaces tcpdump . . -i . ( Windows UNIX ifconfig -a ) Windows 2000 . tcpdump libpcap pcap_findalldevs(3PCAP) -D . -e . MAC Ethernet IEEE 802.11 . -E spi@ipaddr algo:secret IPsec ESP addr (Security Parameter Index) spi . . IPv4 ESP . des-cbc 3des-cbc blowfish-cbc rc3-cbc cast128-cbc none . des-cbc . tcpdump . secret ASCII ESP . 0x . RFC 2406 ESP RFC 1827 ESP. <<>> . IPsec ps(1) . file name tcpdump . ESP tcpdump . -f IPv4 <<>> ( NIS Sun -- ). IPv4 <<>> IPv4 (netmask) . "any" ( -i ) . -F file file . . -g --ip-oneline IP (verbose). -G rotate_seconds -w rotate_seconds ( ). -w strftime(3) . . tcpdump ..IP -C <>> . -h --help tcpdump libpcap . --version tcpdump libpcap . -H 802.11s. -i interface --interface=interface interface. -d tcpdump (up) ( loopback) <> . macOS Solaris interface <> . ( SocketCAN ) <> . -D . libpcap : Bluetooth DAG D-Bus SNF USB. <> (promiscuous mode) . -D interface . -I --monitor-mode << >> (monitor mode) Wi-Fi IEEE 802.11 . . . -L . -I -I . --immediate-mode << >> (immediate mode). tcpdump . <> ( ) . -j tstamp_type --time-stamp-type=tstamp_type tstamp_type. pcap-tstamp(7) . -J --list-time-stamp-types . . --time-stamp-precision=tstamp_precision tstamp_precision . () . savefile (magic number) pcap . savefile timestamp_precision . . timestamp_precision micro nano . . --micro --nano --time-stamp-precision=micro --time-stamp-precision=nano . savefile savefile --micro . savefile --nano . -K --dont-verify-checksums IP TCP UDP . TCP . -l (stdout) (line buffered) . . : tcpdump -l | tee dat tcpdump -l > dat & tail -f dat Windows <> << >> (unbuffered) -l WinDump . -U -l <> ( ) stdout Windows ..TP -L --list-data-link-types (data link) . Wi-Fi ( Ethernet 802.11 ) ( 802.11 802.11 ). -m module SMI MIB module . MIB tcpdump . -M secret secret (shared secret) TCP TCP-MD5 ( RFC 2385) . -n ( ) . -N . tcpdump ``nic.ddn.mil'' ``nic'' . -# --number . -O --no-optimize . (bug) . -p --no-promiscuous-mode (promiscuous mode) . `-p' `ether host {local-hw-addr} or ether broadcast' . --print -w . -Q direction --direction=direction / (direction) . `in' `out' `inout'. . -q ( ). . -r file file ( -w pcap pcapng ) . file ``-'' . -S --absolute-tcp-sequence-numbers (sequence numbers) TCP . -s snaplen --snapshot-length=snaplen 262144 snaplen . ``[|proto]'' proto . . . . NFS AFS . snaplen . snaplen 0 tcpdump 262144 . -T type "expression" (type) . : aodv ( Ad-hoc On-demand Distance Vector) carp ( Common Address Redundancy Protocol) cnfp ( Cisco NetFlow) domain ( - Domain Name System) lmp ( Link Management Protocol) pgm ( Pragmatic General Multicast) pgm_zmtp1 ( ZMTP/1.0 PGM/EPGM) ptp ( Precision Time Protocol) radius ( RADIUS) resp ( REdis Serialization Protocol) rpc ( - Remote Procedure Call) rtcp ( Real-Time Applications) rtp ( Real-Time Applications) snmp ( Simple Network Management Protocol) someip ( SOME/IP) tftp ( Trivial File Transfer Protocol) vat ( Visual Audio Tool) vxlan ( Virtual eXtensible Local Area Network) wb ( - distributed White Board) zmtp1 ( ZeroMQ Message Transport Protocol 1.0). pgm UDP PGM IP 113 . PGM UDP "EPGM" "PGM/UDP" . pgm_zmtp1 PGM UDP . PGM ODATA/RDATA ZeroMQ ZMTP/1.0 . UDP UDP PGM . -t (timestamp) . -tt 00:00:00 UTC . -ttt ( --time-stamp-precision) . . -tttt . -ttttt ( --time-stamp-precision) . ..TP -u NFS. -U --packet-buffered -w --print << >> (packet-buffered) ( ) . -w << >> . -U tcpdump libpcap pcap_dump_flush(3PCAP) . -v () . time to live (identification) IP . (checksum) IP ICMP . -w -r stderr . Solaris FreeBSD tcpdump . -vv . NFS SMB . -vvv . telnet SB ... SE . -X Telnet . -V file file. file <<->> . -w file file . -r . file <<->> . (pipe) . -U . MIME application/vnd.tcpdump.pcap IANA pcap . .pcap .cap .dmp . tcpdump ( ). ( .pcap) . pcap-savefile(5) . -W filecount -C <<>> (rotating) . . -G . -C -G -W . -x ( ) . snaplen . (padding) ( Ethernet) . / (truncated) -xx . -X[X] . -xx . -X[X] . -X ( ) ASCII . . (truncated) -XX . -XX ASCII . -y datalinktype --linktype=datalinktype (data link type) (: -L) (: -d) datalinktype. -z postrotate-command -C -G tcpdump " postrotate-command file " file . -z gzip -z bzip2 gzip bzip2 ..IP fork ( Windows ). tcpdump . savefile . -Z user --relinquish-privileges=user tcpdump (root) savefile savefile (user ID) user (group ID) user . . expression . expression . expression `true' . expression : pcap-filter(7). expression Shell Shell tcpdump . Shell () Shell . . (EXAMPLES) sundown : tcpdump host sundown helios hot ace: tcpdump host helios and \( hot or ace \) IP ace helios: tcpdump ip host ace and not helios Berkeley: tcpdump net ucb-ether ftp snup: ( () Shell ): tcpdump 'gateway snup and (port ftp or ftp-data)' ( (gateway) ): tcpdump ip and not net localnet ( SYN FIN) TCP : tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet' TCP RST ACK : ( RST ACK << RST ACK>> ): tcpdump 'tcp[tcpflags] & (tcp-rst|tcp-ack) == (tcp-rst|tcp-ack)' IPv4 HTTP 80 SYN FIN ACK ( IPv6 ): tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' IP 576 snup: tcpdump 'gateway snup and ip[2:2] > 576' broadcast multicast IP broadcast multicast Ethernet : tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224' ICMP / echo ( ping ): tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply' tcpdump . . (Timestamps) . : hh:mm:ss.frac (kernel) . . << >> . (Interface) any LINUX_SLL2 . In Out . B (broadcast) M (multicast) P . (Link Level Headers) '-e' . . FDDI '-e' tcpdump <> . ( <> . ( IP ) <> <>. 802.2 Logical Link Control (LLC) ISO SNAP LLC . Token Ring '-e' tcpdump <> <> . FDDI LLC . '-e' (source-routed) . 802.11 '-e' tcpdump <> 802.11 . FDDI LLC . (: SLIP RFC 1144 .) SLIP (``I'' ``O'' ) . . ip utcp ctcp . ip . TCP . . *S+n *SA+n n ( ack) . . U ( urgent pointer) W ( window) A ( ack) S ( sequence number) I ( packet ID) (+n -n) (=n) . . TCP ack : O ctcp * A+6 S+49 I+6 3 (6) ARP/RARP . . "rlogin" rtsg csam : arp who-has csam tell rtsg arp reply csam is-at CSAM rtsg ARP csam . csam ( ). tcpdump -n : arp who-has 128.3.254.6 tell 128.3.254.68 arp reply 128.3.254.6 is-at 02:07:01:00:01:c4 tcpdump -e (broadcast) : RTSG Broadcast 0806 64: arp who-has csam tell rtsg CSAM RTSG 0806 64: arp reply csam is-at CSAM RTSG 0806 ( ETHER_ARP) . IPv4 (IPv4 Packets) IPv4 IP . -v IPv4 IP . : tos tos, ttl ttl, id id, offset offset, flags [flags], proto proto, length length, options (options) tos (type of service) ECN ECT(1) ECT(0) CE . ttl (time-to-live) . id IP . offset (fragment offset) . flags MF DF MF + DF DF . . . proto . length TSO ( TCP Segmentation Offload) [was 0, presumed TSO] . options IP . TCP UDP IP TCP UDP IP > . > . . IP . -v IP ..SS TCP (TCP Packets) (: TCP RFC 793 . .) TCP : src > dst: Flags [tcpflags], seq data-seqno, ack ackno, win window, urg urgent, options [opts], length len Src dst IP . Tcpflags S (SYN) F (FIN) P (PSH) R (RST) U (URG) W (CWR) E (ECE) '.' (ACK) 'none' . Data-seqno ( ). Ackno . Window . Urg ('urgent') . Opts TCP ( mss 1024). Len (payload) . Iptype Src dst flags . TCP . rlogin rtsg csam . IP rtsg.1023 > csam.login: Flags [S], seq 768512:768512, win 4096, opts [mss 1024] IP csam.login > rtsg.1023: Flags [S.], seq, 947648:947648, ack 768513, win 4096, opts [mss 1024] IP rtsg.1023 > csam.login: Flags [.], ack 1, win 4096 IP rtsg.1023 > csam.login: Flags [P.], seq 1:2, ack 1, win 4096, length 1 IP csam.login > rtsg.1023: Flags [.], ack 2, win 4096 IP rtsg.1023 > csam.login: Flags [P.], seq 2:21, ack 1, win 4096, length 19 IP csam.login > rtsg.1023: Flags [P.], seq 1:2, ack 21, win 4077, length 1 IP csam.login > rtsg.1023: Flags [P.], seq 2:3, ack 21, win 4077, urg 1, length 1 IP csam.login > rtsg.1023: Flags [P.], seq 3:4, ack 21, win 4077, urg 1, length 1 TCP 1023 rtsg login csam . S SYN . 768512 . ( 'first:last' " first last ( )" .) ACK (piggy- backed) 4096 max-segment-size MSS 1024 . csam ACK SYN rtsg . rtsg SYN csam (ACK) . '.' ACK . . ACK (1) . tcpdump <<>> (conversation) TCP . . ( '1' ). -S . rtsg 19 csam ( 2 20 rtsg -> csam ). PSH . csam rtsg 21 . (socket buffer) csam 19 . csam rtsg . csam (urgent) (pushed) rtsg . (snapshot) tcpdump TCP "[|tcp]" . ( ) tcpdump "[bad opt]" ( ). IP tcpdump "[bad hdr length]" ..SS TCP ( SYN-ACK URG-ACK ) TCP : CWR | ECE | URG | ACK | PSH | RST | SYN | FIN TCP . TCP (3-way handshake) TCP : 1) SYN 2) SYN, ACK 3) ACK (capture) SYN (set) ( ). (SYN-ACK) SYN . tcpdump . TCP (options) : 0 15 31 ----------------------------------------------------------------- | source port | destination port | ----------------------------------------------------------------- | sequence number | ----------------------------------------------------------------- | acknowledgment number | ----------------------------------------------------------------- | HL | rsvd |C|E|U|A|P|R|S|F| window size | ----------------------------------------------------------------- | TCP checksum | urgent pointer | ----------------------------------------------------------------- TCP (octet) . . TCP : 0 7| 15| 23| 31 ----------------|---------------|---------------|---------------- | HL | rsvd |C|E|U|A|P|R|S|F| window size | ----------------|---------------|---------------|---------------- | | 13th octet | | | : | | |---------------| |C|E|U|A|P|R|S|F| |---------------| |7 5 3 0| TCP . PSH URG . SYN . TCP SYN : |C|E|U|A|P|R|S|F| |---------------| |0 0 0 0 0 0 1 0| |---------------| |7 6 5 4 3 2 1 0| (SYN) . (network byte order) () : 00000010 () : 7 6 5 4 3 2 1 0 0*2 + 0*2 + 0*2 + 0*2 + 0*2 + 0*2 + 1*2 + 0*2 = 2 SYN TCP . : tcp[13] == 2 tcpdump SYN : tcpdump -i xl0 'tcp[13] == 2' << TCP >> . SYN ACK TCP . TCP SYN-ACK : |C|E|U|A|P|R|S|F| |---------------| |0 0 0 1 0 0 1 0| |---------------| |7 6 5 4 3 2 1 0| . : 00010010 : 7 6 5 4 3 2 1 0 0*2 + 0*2 + 0*2 + 1*2 + 0*2 + 0*2 + 1*2 + 0*2 = 18 'tcp[13] == 18' tcpdump SYN-ACK SYN . SYN ACK . AND SYN . SYN SYN AND : 00010010 SYN-ACK 00000010 SYN AND 00000010 (we want SYN) AND 00000010 (we want SYN) -------- -------- = 00000010 = 00000010 AND ACK TCP . AND ( 00000010) SYN : ( ( value of octet 13 ) AND ( 2 ) ) == ( 2 ).PP tcpdump : tcpdump -i xl0 'tcp[13] & 2 == 2' . tcp[13] tcp[tcpflags] . TCP : tcp- fin tcp-syn tcp-rst tcp-push tcp-ack tcp-urg tcp-ece tcp-cwr. : tcpdump -i xl0 'tcp[tcpflags] & tcp-push != 0' AND (') . UDP (UDP Packets) UDP rwho : actinide.who > broadcast.who: udp 84 who actinide UDP who broadcast ( ) . . UDP ( ) (RFC 1034/1035) Sun RPC (RFC 1050) NFS. TCP UDP (TCP or UDP Name Server Requests) (: Domain Service RFC 1035 . .) : src > dst: id op? flags qtype qclass name (len) h2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37) h2opolo helios (qtype=A) ucbvax.berkeley.edu. . `3' . `+' recursion desired . IP TCP UDP. Query op . op `3' `+' . qclass C_IN . qclass `A' . : ancount nscount arcount `[na]' `[nn]' `[nau]' n . (AA RA rcode) `must be zero' `[b2&3=x]' x ..SS TCP UDP (TCP or UDP Name Server Responses) : src > dst: id op rcode flags a/n/au type class data (len) helios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273) helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97) helios h2opolo . A () 128.32.137.3 . TCP UDP IP . op (Query) (NoError) (C_IN) A . helios (NXDomain) . `*' authoritative answer ( ) . . `-' ( RA ) `|' ( TC ). <> `[nq]' . SMB/CIFS (SMB/CIFS Decoding) tcpdump SMB/CIFS/NBT UDP/137 UDP/138 TCP/139 . SMB IPX NetBEUI . -v . -v SMB -v . SMB https://download.samba.org/pub/samba/specs . SMB Andrew Tridgell (tridge@samba.org) . NFS (NFS Requests and Replies) Sun NFS ( ) : src.sport > dst.nfs: NFS request xid xid len op args src.nfs > dst.dport: NFS reply xid xid reply stat len op results sushi.1023 > wrl.nfs: NFS request xid 26377 112 readlink fh 21,24/10.73165 wrl.nfs > sushi.1023: NFS reply xid 26377 reply ok 40 readlink "../var" sushi.1022 > wrl.nfs: NFS request xid 8219 144 lookup fh 9,74/4096.6878 "xcolors" wrl.nfs > sushi.1022: NFS reply xid 8219 reply ok 128 lookup fh 9,74/4134.3150 sushi 26377 wrl . UDP IP . readlink ( ) (fh) 21,24/10.731657119 . ( major,minor inode .) wrl `ok' . sushi ( ) wrl `xcolors' 9,74/4096.6878 (lookup). wrl . . NFS . tcpdump NFS : (xid) NFS . -v () . : sushi.1023 > wrl.nfs: NFS request xid 79658 148 read fh 21,11/12.195 8192 bytes @ 24576 wrl.nfs > sushi.1023: NFS reply xid 79658 reply ok 1472 read REG 100664 ids 417/0 sz 29388 ( -v TTL ID IP .) sushi wrl 21,11/12.195 . Wrl `ok' ( NFS UDP ). -v ( ) : (``REG'' ) ( ) UID GID . -v . NFS RPC . tcpdump <<>> (transaction ID) . ..SS " AFS (AFS Requests and Replies)" Transarc AFS ( ) : src.sport > dst.dport: rx packet-type src.sport > dst.dport: rx packet-type service call call-name args src.sport > dst.dport: rx packet-type service reply call-name args elvis.7001 > pike.afsfs: rx data fs call rename old fid 536876964/1/1 ".newsrc.new" new fid 536876964/1/1 ".newsrc" pike.afsfs > elvis.7001: rx data fs reply rename elvis RX pike . data RX fs ( ) RPC . RPC (rename) (fid) 536876964/1/1 ".newsrc.new" 536876964/1/1 ".newsrc". pike RPC rename ( data abort). RPC AFS RPC . RPC AFS ( <<>> ). AFS RX . -v () (acknowledgement) RX ( RX call ID) (sequence number) RX. -v RX RX . MTU RX ack . -v (security index) service id . abort beacon Ubik ( abort Ubik ). AFS RPC . tcpdump <<>> (service ID) . . KIP AppleTalk (DDP UDP) AppleTalk DDP UDP DDP (dump) ( UDP ). /etc/atalk.names AppleTalk . : number name 1.254 ether 16.1 icsd-net 1.254.110 ace AppleTalk . ( - ). ( tab) . /etc/atalk.names ( '#' ) . AppleTalk : net.host.port 144.1.209.2 > icsd-net.112.220 office.2 > icsd-net.112.220 jssmag.149.235 > icsd-net.2 ( /etc/atalk.names / AppleTalk .) NBP ( DDP 2) 144.1 209 220 icsd 112 . ("office"). 235 jssmag 149 (broadcast) NBP icsd-net ( (255) - /etc/atalk.names ). NBP ( ) ATP ( AppleTalk) . ( ) ..SS " NBP (NBP Packets)" NBP : icsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*" jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250 techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186 (name lookup) laserwriter 112 icsd jssmag (broadcast) . nbp 190 . ( ) jssmag.209 laserwriter "RM1140" 250 . techpit laserwriter "techpit" 186 . ATP (ATP Packets) ATP : jssmag.209.165 > helios.132: atp-req 12266<0-7> 0xae030001 helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000 jssmag.209.165 > helios.132: atp-req 12266<3,5> 0xae030001 helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000 helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000 jssmag.209.165 > helios.132: atp-rel 12266<0-7> 0xae030001 jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002 Jssmag.209 12266 helios ( `<0-7>`) . `userdata` . Helios . `:digit` ATP . `*` 7 EOM . Jssmag.209 3 5 . Helios jssmag.209 . jssmag.209 . `*` XO ( `exactly once` ) . (BACKWARD COMPATIBILITY) TCP tcp-ece tcp-cwr libpcap 1.9.0 . (SEE ALSO) stty(1), pcap(3PCAP), bpf(4), nit(4P), pcap-savefile(5), pcap-filter(7), pcap-tstamp(7) https://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap : Van Jacobson Craig Leres Steven McCanne Lawrence Berkeley National Laboratory University of California Berkeley CA. The Tcpdump Group . HTTPS : https://www.tcpdump.org ftp : ftp://ftp.ee.lbl.gov/old/tcpdump.tar.Z IPv6/IPsec WIDE/KAME . OpenSSL/LibreSSL . (BUGS) security@tcpdump.org . CONTRIBUTING.md tcpdump . NIT BPF . . IP . : () . tcpdump. ( ). Token Ring Token Ring (source-routed) . 802.11 802.11 To DS From DS . ip6 proto . ip6 protochain . tcp[0] IPv6 . IPv4 . 30 June 2025 TCPDUMP(1)