tcpdump — Capturing and Analyzing Network Packets in Real Time¶

tcpdump is a command-line packet analyzer used to capture, inspect, and analyze network traffic directly from a network interface. It allows administrators to observe every packet entering or leaving a system, making it one of the most powerful tools for diagnosing network connectivity issues, DNS failures, TCP handshake problems, HTTP requests, TLS communication, routing issues, packet loss, and Kubernetes networking problems. Every Linux Administrator, Network Engineer, DevOps Engineer, SRE, Cloud Architect, Security Engineer, and Kubernetes Administrator should master tcpdump.

Learning Path¶

Networking Mastery → Module 12: Network Troubleshooting → Lesson 3

Difficulty: Advanced

Reading Time: 220 Minutes

Course Progress

Course: Networking Mastery

Module: Network Troubleshooting

Lesson: 3 of 10

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand packet capturing
Capture network traffic using tcpdump
Apply capture filters
Analyze TCP handshakes
Inspect DNS, HTTP, and HTTPS traffic
Troubleshoot production networking issues
Capture packets in cloud and Kubernetes environments

Prerequisites¶

Complete:

Ping
traceroute
TCP/IP
Linux Networking
Routing

Basic understanding of:

Transmission Control Protocol (TCP)
User Datagram Protocol (UDP)
Internet Control Message Protocol (ICMP)
Domain Name System (DNS)
HTTP

Why Do We Need tcpdump?¶

Imagine an application reports:

Connection

Timeout

Ping works.

Traceroute works.

But:

Is the packet leaving the server?
Is the response returning?
Is DNS working?
Is TLS failing?
Is TCP completing the handshake?

The answer is:

tcpdump

What is tcpdump?¶

tcpdump is:

A

Packet

Capture

And

Analysis

Tool

It captures packets directly from a network interface.

Packet Capture Workflow¶

Application

↓

Network Interface

↓

tcpdump

↓

Packet Analysis

tcpdump observes packets before applications process them.

Where tcpdump Works¶

tcpdump can capture traffic from:

Ethernet
Wi-Fi
Loopback
Virtual Interfaces
Docker Networks
Kubernetes Nodes
VPN Interfaces

List Network Interfaces¶

Display available interfaces.

tcpdump -D

Example:

eth0

lo

docker0

cni0

Capture All Traffic¶

Capture packets on:

eth0

sudo tcpdump -i eth0

Packets appear in real time.

Capture Limited Packets¶

Capture only ten packets.

sudo tcpdump -i eth0 -c 10

Useful during quick troubleshooting sessions.

Disable Name Resolution¶

Avoid DNS lookups.

sudo tcpdump -n

Advantages:

Faster Output
Raw IP Addresses
Easier Troubleshooting

Verbose Output¶

Increase details.

sudo tcpdump -vv

or

sudo tcpdump -vvv

Displays:

Time To Live (TTL)
Window Size
TCP Options
Flags

Save Packets¶

Write captures to a file.

sudo tcpdump -i eth0 -w capture.pcap

The file can later be opened in:

Wireshark
tcpdump

Read Saved Packets¶

tcpdump -r capture.pcap

Analyze previously captured traffic.

Packet Flow¶

Client

↓

Switch

↓

Router

↓

Server

↓

Network Interface

↓

tcpdump

tcpdump records every packet that reaches the selected interface.

Capture Filters¶

Capture only traffic matching specific conditions.

Examples:

Host:

tcpdump host 192.168.1.10

Source Host:

tcpdump src host 192.168.1.10

Destination Host:

tcpdump dst host 192.168.1.20

Port Filters¶

Capture traffic on port:

sudo tcpdump port 80

Specific destination port:

sudo tcpdump dst port 443

Multiple ports:

sudo tcpdump 'port 80 or port 443'

Protocol Filters¶

Capture ICMP.

sudo tcpdump icmp

Capture TCP.

sudo tcpdump tcp

Capture UDP.

sudo tcpdump udp

Network Filters¶

Capture an entire subnet.

sudo tcpdump net 192.168.1.0/24

Useful for analyzing traffic across multiple hosts.

Boolean Filters¶

Example:

sudo tcpdump 'tcp and port 443'

Example:

sudo tcpdump 'host 10.0.0.5 and port 53'

Filters can combine:

and
or
not

TCP Three-Way Handshake¶

Capture:

SYN

↓

SYN-ACK

↓

ACK

tcpdump allows you to verify whether the TCP connection completes successfully.

Example TCP Output¶

SYN

↓

SYN-ACK

↓

ACK

↓

HTTP GET

A successful handshake indicates the TCP session is established.

DNS Troubleshooting¶

Capture DNS traffic.

sudo tcpdump port 53

Observe:

DNS Query
DNS Response

Useful when applications cannot resolve hostnames.

HTTP Troubleshooting¶

Capture HTTP.

sudo tcpdump port 80

View:

HTTP Requests
HTTP Responses

HTTPS Troubleshooting¶

Capture encrypted traffic.

sudo tcpdump port 443

Although payloads are encrypted, you can still inspect:

TCP Handshake
TLS Handshake
Packet Sizes
Retransmissions

ICMP Troubleshooting¶

Capture Ping packets.

sudo tcpdump icmp

Observe:

Echo Request

↓

Echo Reply

Useful for validating connectivity.

Kubernetes Perspective¶

Capture packets on a Kubernetes node.

sudo tcpdump -i cni0

Capture Pod traffic.

sudo tcpdump -i any

Useful for:

Container Network Interface (CNI) Debugging
Service Issues
Network Policies
DNS Resolution

Docker Perspective¶

Capture Docker bridge traffic.

sudo tcpdump -i docker0

Useful for container networking analysis.

Cloud Perspective¶

Capture traffic on:

AWS EC2
Azure VM
Google Compute Engine

Common use cases:

Security Group Validation
Firewall Troubleshooting
VPN Diagnostics

Enterprise Troubleshooting Workflow¶

Ping

↓

traceroute

↓

tcpdump

↓

Wireshark

Each tool provides progressively deeper visibility.

Common TCP Flags¶

Flag	Meaning
SYN	Start Connection
ACK	Acknowledgement
FIN	Close Connection
RST	Reset Connection
PSH	Push Data
URG	Urgent Data

CLI Examples¶

Capture on interface.

sudo tcpdump -i eth0

Capture ten packets.

sudo tcpdump -c 10

Capture DNS traffic.

sudo tcpdump port 53

Capture HTTPS traffic.

sudo tcpdump port 443

Save capture.

sudo tcpdump -w traffic.pcap

Read capture.

tcpdump -r traffic.pcap

Hands-on Lab¶

Task 1¶

List network interfaces.

tcpdump -D

Task 2¶

Capture ten packets.

sudo tcpdump -i eth0 -c 10

Task 3¶

Ping another host while running:

sudo tcpdump icmp

Observe:

Echo Request
Echo Reply

Task 4¶

Capture DNS queries.

sudo tcpdump port 53

Run:

nslookup example.com

Observe the request and response.

Task 5¶

Capture HTTPS traffic.

sudo tcpdump port 443

Browse a secure website and observe the TCP and TLS handshakes.

Task 6¶

Save a packet capture.

sudo tcpdump -i eth0 -w network.pcap

Open the file later in Wireshark.

Task 7¶

Capture traffic on a Kubernetes node while accessing a ClusterIP Service.

Task 8¶

Draw the packet journey:

Browser

↓

TCP Handshake

↓

HTTP Request

↓

Server

↓

HTTP Response

Explain what tcpdump captures at every stage.

Production Troubleshooting¶

Problem:

Application

Cannot

Connect

Check:

DNS Query
TCP SYN
SYN-ACK
ACK
TLS Handshake
HTTP Request
Firewall
Packet Loss

Workflow:

Application

↓

Packet Capture

↓

TCP Handshake

↓

Protocol Analysis

↓

Root Cause

tcpdump vs Wireshark¶

tcpdump	Wireshark
Command Line	Graphical Interface
Lightweight	Rich Visualization
Live Capture	Live & Offline Analysis
Ideal for Servers	Ideal for Desktop Analysis
Low Resource Usage	Higher Resource Usage

Common Mistakes¶

❌ Capturing all traffic without filters.

✅ Apply capture filters to reduce unnecessary data.

❌ Forgetting -n.

✅ Disable DNS resolution for faster and clearer output.

❌ Capturing on the wrong interface.

✅ Verify the correct interface using tcpdump -D.

❌ Ignoring packet timestamps.

✅ Use timestamps to correlate events with application logs.

❌ Leaving long-running captures active.

✅ Limit packet count or duration to avoid large capture files.

Best Practices¶

Capture only the traffic you need.
Always identify the correct interface before capturing.
Save important captures as .pcap files.
Use filters to minimize noise.
Combine tcpdump with application logs.
Analyze complex captures using Wireshark.
Remove sensitive packet captures after analysis.
Be aware of privacy and security requirements when capturing production traffic.

Interview Questions¶

Beginner¶

What is tcpdump?
What is a packet capture?
How do you capture packets on an interface?
What is a .pcap file?

Intermediate¶

Explain the TCP three-way handshake using tcpdump.
How do you capture only DNS traffic?
Compare tcpdump and Wireshark.
How would you troubleshoot a failed HTTPS connection?

Architect Level¶

Design a packet capture strategy for a production Kubernetes cluster.
Explain how tcpdump helps diagnose intermittent network failures.
How would you troubleshoot application connectivity across cloud regions using packet captures?

Summary¶

In this lesson, you learned:

tcpdump
Packet Capture
Capture Filters
TCP Three-Way Handshake
DNS Analysis
HTTP Analysis
HTTPS Analysis
ICMP Analysis
Kubernetes Packet Capture
Production Network Troubleshooting

tcpdump is one of the most powerful command-line tools for network troubleshooting. It provides direct visibility into packets flowing across network interfaces, allowing engineers to diagnose connectivity issues, routing problems, protocol failures, and application communication with precision. It is an essential skill for Linux, cloud, networking, and Kubernetes professionals.

Key Takeaways¶

tcpdump captures packets directly from network interfaces.
Use capture filters to focus on relevant traffic.
Verify the TCP three-way handshake when troubleshooting connection issues.
Capture DNS, HTTP, HTTPS, and ICMP traffic for protocol-specific analysis.
Save captures as .pcap files for later analysis in Wireshark.
Combine tcpdump with Ping, traceroute, and application logs for systematic troubleshooting.

What's Next?¶

Wireshark

In the next lesson, you'll learn about Wireshark.

You'll explore:

Packet Analysis
Protocol Decoding
Display Filters
TCP Stream Analysis
DNS Analysis
HTTP and HTTPS Inspection
Production Packet Investigation

By the end of the lesson, you'll be able to analyse packet captures visually, inspect network protocols in depth, and diagnose complex networking issues using one of the industry's most powerful protocol analyzers.