UNIX – Tcpdump

Tcpdump is a packet capture for the Linux command line. This is by no means a full guide but a quick overview of some of the main commands.

The syntax below will capture all traffic with IP address of and and IP in the network with a port of udp/53. This will write it to a capture file for viewing in wireshark, with double verbosity.

tcpdump -vvi eth2 -s 1500 -w test.cap host and net and udp port 53

This will read the capture test.cap

tcpdump -r test.cap

To view the payload of the packet use the following commands :

  • -X – Displays the in but ASCII and HEX.
  • -A – Displays just the payload in ASCII

Tcpdump for windows can be downloaded here

Rick Donato

Want to become a UNIX expert?

Here is our hand-picked selection of the best courses you can find online:
UNIX Administration Fundamentals
Vim Masterclass
and our recommended certification practice exams:
AlphaPrep Practice Tests - Free Trial