How to Use tcpdump for Network Troubleshooting

tcpdump captures and analyzes network packets for debugging connectivity issues.

Install

apt install tcpdump -y

Capture All Traffic

tcpdump -i eth0

Filter by Port

tcpdump -i eth0 port 80\ntcpdump -i eth0 port 22

Filter by Host

tcpdump -i eth0 host 203.0.113.50

Save to File

tcpdump -i eth0 -w capture.pcap

Read Capture File

tcpdump -r capture.pcap

Useful Filters

# HTTP requests only\ntcpdump -i eth0 'tcp port 80 and tcp[32:4] = 0x47455420'\n\n# DNS queries\ntcpdump -i eth0 port 53\n\n# Show packet contents\ntcpdump -i eth0 -X port 80