Quick Tip: Use tcpdump in Linux to capture network packets and view in wireshark

Important note to remember:
a. capture it in full length, using the -s 0 options
b. save it in a file, better to make the extension as .pcap so wireshark can associate directly

1.Identify which interface you want to listen to

[root@freelinux tmp]# ifconfig 

eth0 Link encap:Ethernet HWaddr 08:00:27:72:24:E6
inet addr: Bcast: Mask:
inet6 addr: fe80::a00:27ff:fe72:24e6/64 Scope:Link
RX packets:942 errors:0 dropped:0 overruns:0 frame:0
TX packets:612 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:78095 (76.2 KiB) TX bytes:198882 (194.2 KiB)
Interrupt:10 Base address:0xd020

2. Run “tcpdump” command with the following options. For instance, you want to monitor the DNS packets.Run:

tcpdump -ni eth0 -Xvvv -w freelinux.pcap -s 0 port 53 

[root@freelinux tmp]# tcpdump -ni eth0 -Xvvv -w freelinux.pcap -s 0 port 53
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
2657 packets captured
2938 packets received by filter
0 packets dropped by kernel


# ls -l /tmp
-rw-r--r-- 1 root wheel 1386926 Sep 24 14:39 freelinux.pcap

where as:

-s 0 –> capture byte to its maximum (65535) or it’s full lenght
-ni –> listen on which interface. Then -n option is used so not to convert host addresses to names.
-w –> create the file
port –> to indicate the port number, e.g. 53 which pertains to dns
-X –> Print each packet (minus its link level header) in hex and ASCII
-vvv –> Even more verbose output

Other samples:
[root@freelinux tmp]# tcpdump -ni eth0 -Xvvv -w freelinux.pcap -s 0 portrange 67-68
[root@freelinux tmp]# tcpdump -ni eth1 -s0 -w hostlinux.pcap host &

Note: you can do Ctrl+C to terminate the task, or if run in background, kill the process if finished as it will consume some hard disk space and some CPU resources.

3. Now open the wireshark program. It’s a GUI-based program, so viewing is easier and flexible.


About the author

Free Linux Tutorials

View all posts


  • I’ll try this. This will be really useful.


  • Very good blog! Do you have any helpful hints for aspiring
    writers? I’m hoping to start my ownn website soon but I’m a ittle lost oon everything.
    Would you recommend starting with a free platform like
    Wordpress orr go for a paid option? There are so many options out there thst I’m completely confused ..
    Any ideas? Kudos!

  • An outstanding share! I have just forwarded this onto a co-worker who wass
    doing a little researfch on this. Andd he in fact ordered me lunch because I stumbled upon it for him…
    lol. So allow me to reword this…. Thanks for tthe meal!!
    But yeah, thanx for spending the time to discuss this subjkect here on your blog.

  • There is certainly a lot to know about this topic.
    I love all of tthe poits you made.

  • I’m amazed, I must say. Rafely do I encounter a blog that’s equally educative and interesting, and without a
    doubt, you have hit the nail on thhe head. The problem iis
    soomething which too few men and women are speaking ihtelligently about.
    I’m very happy I found this during my seaarch for something relating to this.

  • certainly like your web-site but youu have to test the spelling on quite a few of your posts.
    Several of them are riffe with spelling problems and I in finding it very
    troublesome to ell the realiy then again I will surely come
    back again.

  • First of all I want to say fantastic blog! I had a quick quetion which
    I’d like to askk if you do not mind. I was curious to know how
    you center yourself and clear your head before writing.
    I’ve had a hard time clearing myy thoughts in getting my thoughts out.
    I do take pleasure in writing but it just seems like the first 10 to 15 minutes tend to be wasted simply just trying to figure oout how to begin. Any ideas or tips?
    Appreciate it!

  • I go too see each day a few web pages and blogs to readd articles,
    however thius web site gives feature based writing.

Leave a Reply