tcpdump for Practical Packet Capture and Network Analysis
tcpdump is a command-line packet analyser built on libpcap. It captures network frames and applies Berkeley Packet Filter expressions, exposing details useful for diagnosing DNS failures, slow TLS sessions, routing surprises, and intermittent packet loss.
Australian networks add useful context. Many homes connect through the NBN using FTTP, FTTN, HFC, or fixed-wireless access, while providers include Telstra, Optus, TPG, and Aussie Broadband. ISP gateways may prevent direct access to the WAN interface, so administrators often capture the LAN side instead.
Work also moves between offices in Sydney and Melbourne, regional sites, and Perth, where longer routes can raise round-trip time. Capture practices must accommodate café Wi-Fi, mobile hotspots, workplace policies, and Australian privacy obligations when frames contain personal information.
Install tcpdump and inspect interfaces
On Fedora, RHEL 8 or 9, and CentOS Stream, install tcpdump with sudo dnf install tcpdump; older RHEL and CentOS releases use sudo yum install tcpdump. Check tcpdump --version to confirm the libpcap release.
List links with ip -br link, then run sudo tcpdump -D to see available interfaces. Servers commonly use names such as ens192 or eno1, while wireless adapters may appear as wlan0 or wlp2s0.
Most captures require elevated network privileges. Use sudo or an organisation-approved capability process, and keep test windows short because collection consumes resources and may expose sensitive payloads.
Choose the interface and capture filter
Select the interface where the symptom occurs. A virtual machine may use ens3; a container host may use docker0 or virbr0. Capture on the host-facing interface to observe guest traffic.
A capture filter narrows what tcpdump records. Examples include tcp port 443, udp port 53, host 192.0.2.10, net 198.51.100.0/24, and icmp. Combine expressions with and, or, and parentheses to match a service while retaining the addresses involved.
Promiscuous mode does not make Ethernet switching behave like a hub. Without a switch mirror port, or traffic already visible to the host, you normally see frames addressed to that machine rather than every client on the segment.
Read packets without losing context
Useful flags include -nn to avoid hostname lookups, -vvv for protocol detail, and -e for link-layer addresses. Add -c 20 to stop after twenty packets, and -X for a brief hexadecimal payload view.
DNS queries expose names and address records with ordinary DNS. TCP headers show setup, retransmissions, resets, and closes; ICMP can identify unreachable hosts or path MTU problems. HTTPS payloads remain encrypted, making timing and connection metadata more useful than content.
Timestamps and sequence numbers help separate server delay from network delay. A long gap before SYN-ACK suggests time away from the host, while repeated retransmissions indicate loss or congestion. Correlate both with application logs before assigning blame.
Compare common capture workflows
The right workflow depends on whether you need an immediate view, a protocol-specific test, or a reusable capture file.
| Operational need | Command | Result | Important limitation |
|---|---|---|---|
| Quick live view | sudo tcpdump -i eth0 -nn |
Packet summaries appear immediately | Fast output can scroll away |
| DNS diagnosis | sudo tcpdump -i eth0 -nn 'udp port 53' |
Queries and replies are visible | Encrypted DNS is not exposed |
| TLS timing | sudo tcpdump -i eth0 -nn 'tcp port 443' |
Handshakes and retransmissions appear | Payload content stays encrypted |
| Offline review | sudo tcpdump -i eth0 -s 0 -w trace.pcap |
A pcap file preserves the frames | The file may contain sensitive data |
Plain DNS output answers common “why is this name resolving incorrectly?” questions. For encrypted DNS, inspect the resolver configuration and connection timing rather than expecting readable queries.
A live view supports rapid triage, while a saved pcap supports repeatable analysis and peer review. Give files descriptive names and record the interface, filter, host, and capture time so another administrator can reproduce the test.
Control capture size and diagnostic scope
Use -s 0 to preserve complete packets when saving evidence, then review the file with tcpdump -nn -r trace.pcap. For routine triage, -s 96 reduces file size, although it may omit payload bytes needed for deeper inspection.
Large captures can fill a small volume or disrupt a busy host. A bounded command such as sudo timeout 30 tcpdump -i ens192 -nn -w tls.pcap 'tcp port 443' limits duration and scope. Rotate files with size and count options when continuous monitoring is justified.
Keep filters specific enough to answer the fault being investigated. Capturing everything increases storage use and makes later review harder. Record the exact command and preserve only the captures required for the incident.
Protect data and follow Australian law
Obtain authorisation before capturing traffic outside systems you administer. Packets may contain names, email addresses, authentication material, or health information, so the Privacy Act 1988 and contractual duties may apply even when the capture is intended for troubleshooting.
The Telecommunications Interception and Access Warrant Act 1979 and state or territory computer-misuse laws can affect deliberate interception. Public Wi-Fi at an airport, hotel, university, or local café is not permission to inspect other users’ traffic. Seek legal advice for ambiguous cases.
Minimise payload exposure, encrypt saved pcap files, restrict access, and set deletion dates. Share captures through approved systems rather than email or consumer file-sharing services. Document the purpose, operator, interfaces, and disposal decision so the investigation remains accountable.
Bring captures into operational context
Start with a baseline, reproduce one symptom, then capture the relevant interval. Preserve tcpdump’s output alongside application and firewall logs; matching timestamps turn an isolated packet observation into evidence about where a fault occurred.
For web servers, compare the client, reverse proxy, and upstream addresses before changing a route. The Nginx on Linux guide is useful background when Nginx sits between users and an application server, especially for interpreting proxy addresses and headers.
Use the capture to test a hypothesis, not to replace monitoring. A clear filter, an accurate clock, and a secure pcap file can turn a vague report into a repeatable diagnosis. The essential lesson is to capture narrowly, interpret cautiously, and treat every packet as potentially sensitive data.