tcpdump is the most important network diagnostic tool on servers.
Basics¶
sudo tcpdump -i any port 80 sudo tcpdump -i any host 10.0.1.50 sudo tcpdump -c 100 -i any
Filters¶
sudo tcpdump ‘src host 10.0.1.50 and dst port 5432’ sudo tcpdump ‘not port 22’ sudo tcpdump udp port 53
Output¶
sudo tcpdump -A port 80 # ASCII sudo tcpdump -w capture.pcap # for Wireshark tcpdump -r capture.pcap
Examples¶
sudo tcpdump -A port 80 | grep -i ‘host:’ sudo tcpdump udp port 53 -nn sudo tcpdump ‘tcp[tcpflags] & tcp-syn != 0’
tcpdump = Network Debugging¶
Basic filters + pcap for Wireshark.
tcpdumpnetworkingpacket capture