tcpdump in Linux: Read Packets on the Wire

tcpdump captures packets as they cross an interface — the ground truth underneath every other networking tool. When ss says the connection is open and curl says it hangs, tcpdump shows what actually left the machine and what came back.

The first captures #

Watch one interface, human-readable

$ sudo tcpdump -i eth0
14:02:11.401234 IP laptop.51432 > aospix.com.https: Flags [S], length 0
14:02:11.419876 IP aospix.com.https > laptop.51432: Flags [S.], length 0

Every line is one packet: timestamp, source and destination with ports, TCP flags, length. The [S]/[S.] pair above is a handshake opening — reading flags is the skill (S sync, . ack, P data, F finish, R reset). An R appearing where data should be is a connection being refused at the TCP level, visible before any application log knows.

The two flags that make output readable: -n (no DNS lookups — faster and less noisy) and host/port filters so you watch one conversation instead of the whole wire:

Narrow the view to what you care about

$ sudo tcpdump -ni eth0 host 203.0.113.7
$ sudo tcpdump -ni eth0 port 443
$ sudo tcpdump -ni eth0 host aospix.com and port 443

Filters compose #

Filter	Captures
`host 10.0.0.9`	Anything with that host
`port 5432`	That port either direction
`src host x and dst port y`	One precise direction
`net 10.0.0.0/24`	A whole subnet
`tcp[tcpflags] & tcp-syn != 0`	Only connection attempts
`not port 22`	Everything except your own session

That last one is the classic first-capture fix: without it, watching a remote machine shows an endless stream of your own SSH packets.

Seeing payloads and saving captures #

ASCII payload — read the protocol conversation

$ sudo tcpdump -i eth0 -A port 80 | head -40
GET /blog HTTP/1.1
Host: aospix.com

  # Save for later analysis (Wireshark opens it)
$ sudo tcpdump -i eth0 -w capture.pcap port 443
$ tcpdump -r capture.pcap             # replay

Plaintext protocols (HTTP, SMTP, redis) are directly readable with -A; TLS traffic is not — you see handshakes, sizes, and timing, which is exactly what latency and reset debugging needs. -w files are the currency of network tickets: capture on the server, analyse in Wireshark locally.

Captures see everything on the interface, including credentials in plaintext protocols and session tokens. Capture narrowly (filters), stop quickly, and treat pcap files as sensitive — a -A capture of a login flow is a password dump with extra steps.

Throughput measurement belongs to iperf3; path diagnosis to mtr. The network series continues.