Understanding tcpdump filters
tcpdump uses the libpcap filter syntax, often called BPF syntax (Berkeley Packet Filter). The same syntax applies to capture filters in Wireshark, tshark and dumpcap. A filter is made of simple primitives that you combine with and, or and not.
The primitives: type, direction, protocol
- Type:
host(one address),net(a network in CIDR notation),portandportrange. - Direction:
src(sender) ordst(receiver). Without it, either matches. - Protocol:
tcp,udp,icmp,ip,ip6,arp,etherand more.
tcp dst port 443 src net 10.0.0.0/8 ether host 00:11:22:33:44:55
Combining and parentheses
In libpcap, and and or have the same precedence and are evaluated left to right. So a or b and c means (a or b) and c. Use parentheses whenever you mix the two. In the generator, every pair of parentheses comes from a group.
Always put the filter in single quotes, otherwise the shell interprets parentheses and special characters itself:
sudo tcpdump -nn -i eth0 'host 10.0.0.5 and (port 80 or port 443)'
Filtering TCP flags
tcp[tcpflags] gives you access to the flags in the TCP header. tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn matches only the first packet of each connection: SYN set, ACK not set. This only works for IPv4, because libpcap cannot locate the TCP header behind IPv6 extension headers.
Common filters
| Purpose | Filter |
|---|---|
| Traffic of one host | host 192.168.1.10 |
| Traffic between two hosts | host 10.0.0.5 and host 10.0.0.20 |
| Web without your own SSH session | (port 80 or port 443) and not port 22 |
| DNS | port 53 |
| DHCP | udp portrange 67-68 |
| Connection setup | tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn |
| Connection resets | tcp[tcpflags] & tcp-rst != 0 |
| Ping | icmp[icmptype] == icmp-echo |
| Packets in VLAN 100 | vlan 100 and host 10.1.1.1 |
| Large packets (MTU issues) | greater 1400 |
Practical tips
-nnturns off DNS and port name lookups. Output appears immediately and tcpdump creates no DNS traffic of its own.-i anycaptures on all interfaces at once (Linux).- If you are logged in via SSH, exclude your own session with
not port 22, or you will mostly see your own output. -w file.pcapsaves the raw packets. Open the file later in Wireshark or withtcpdump -r.- For VLAN traffic,
vlanmust come before the other conditions because it shifts the position of the following headers. - For long captures, rotate files with
-C(size) or-G(time) and limit their number with-W.
FAQ
How do I save a capture for Wireshark?
Enter a file name under Options in “Write to file (-w)”, e.g. capture.pcap. tcpdump then writes the raw packets to that file, which you can open directly in Wireshark.
Why does tcpdump say “syntax error”?
Usually the shell interprets parentheses or special characters because the filter is not quoted. The generator therefore always wraps the filter in single quotes. Other causes are typos in keywords or unbalanced parentheses.
Does the filter work in Wireshark too?
Yes, as a capture filter, because Wireshark also uses libpcap for that. Wireshark display filters use a different syntax, e.g. ip.addr == 10.0.0.5 instead of host 10.0.0.5.
Why does my filter find nothing on VLAN traffic?
With a VLAN tag, the IP header moves by 4 bytes. Put the VLAN rule first, e.g. vlan 100 and host 10.0.0.5. On some Linux systems the network card strips the tag beforehand, in which case you do not need vlan.
Is my input sent anywhere?
No. The generator runs entirely in your browser. The share link stores the filter in the part after the #, and browsers do not send that part to the server.