How to use tcpdump to capture network packets on Linux

What network packet interception is and why it matters

Imagine your computer network is like an extremely busy postal system. Data travels in packets, which act like letters and parcels full of information moving from one server to another. When something goes wrong and communication fails, traditional monitoring tools often just tell you that the packet failed to reach its destination. In practice, this means you know there is a problem, but you have no idea what happened halfway through. This is precisely where traffic interception comes in, a process where we place an invisible listener on the network interface to examine every message coming in and going out. In the Linux world, the standard tool for this kind of surgical investigation is the tcpdump command, a terminal-based program that displays the exact flow of binary data converted into readable text for curious administrators.

To understand the value of this approach, think of a water pipe that has started leaking. You can try to guess where the hole is by looking at the damp wall, or you can use instruments to measure pressure at specific points. Tcpdump acts like this precision instrument for networks. It listens to the chosen network interface, such as the server's main card, and captures a faithful copy of every packet passing through it. Developers and system administrators use this capability to investigate everything from bizarre authentication failures to unexplained slowness in web applications. If you want to deepen your infrastructure knowledge, you can check our companion guide on why DHCP fails and how to track packets to see how these diagnostics save corporate applications during critical moments.

Preparing the environment and running your first basic capture

Before starting to record traffic, it is worth noting that capturing packets requires elevated permissions in the operating system. After all, having access to everything passing through the network interface means being able to read plaintext passwords, HTTP requests, and confidential data if the network is unencrypted. For security, only the root user or accounts with administrative privileges can execute tcpdump. In practice, this means you will need to use the sudo command before typing any monitoring instruction. Furthermore, it is important to choose the correct interface, as modern servers usually have several virtual and physical cards active simultaneously.

To take your first practical step, let's run a simple command that listens to the machine's general traffic. Open your Linux terminal and type the command below to see the basic listing of packets crossing the main interface. If you want to explore other ways of tracing IP packets, it is also worth checking out the tips in how to trace IP packets and routes on Linux.

sudo tcpdump -i eth0

As soon as you press Enter, the screen will quickly fill with lines of text describing each captured packet. Each line shows the timestamp, source and destination IP addresses, involved ports, and protocols used, such as TCP or UDP. Because network traffic on an active server is overwhelming, this continuous scrolling is usually chaotic and hard to read. To stop execution and return to the normal prompt, simply press Ctrl + C. The secret to mastering tcpdump is not looking at this entire sea of data at once, but rather applying intelligent filters to see only what truly matters for solving your current problem.

Applying essential filters to isolate connectivity issues

When the volume of captured data is too large, we suffer from digital visual pollution. To solve this, tcpdump uses a filtering language based on the Berkeley Packet Filter syntax, known in the technical community as BPF. In practice, this language lets you tell the program to ignore everything irrelevant and record only traffic originating from a specific IP, destined for a particular port, or belonging to a determined protocol. This turns a mountain of useless data into a clear, objective timeline of the bug you are trying to fix.

For example, if you suspect your server's web service is having trouble on the standard security port, you can restrict the capture strictly to that communication channel. See below how to structure this command to focus on traffic directed to port 443:

sudo tcpdump -i eth0 port 443

Another very common scenario in engineering day-to-day work is isolating communication with a specific IP address, whether to investigate external API behavior or debug a client that cannot connect to the database. For this, you combine simple logical operators like and, or, and not within the command. If the connection is dropping intermittently, you can also cross-reference these analyses with packet loss diagnostic tools, as explained in our article on how to use mtr to find the issue, ensuring a complete view of both the network layer and route stability.

Saving captures to a file for detailed offline analysis

Looking at the terminal while packets rush past is useful for quick diagnostics, but we often need deeper, paused analysis. To investigate complex TCP handshake failures or subtle packet loss, the best practice is to save raw traffic to a digital file for later study. Tcpdump allows you to do this using the write parameter, which stores exact binary data without discarding any temporal or structural information from the collected packets.

To record traffic generated on a specific interface into a structured, compressed file, we use the command with the write option. Check the practical example below:

sudo tcpdump -i eth0 -w network_capture.pcap

After collecting enough packets during the incident, you can stop the recording and analyze the generated file later on your own workstation. This standard-format file can be opened in advanced visual software or even read back by tcpdump itself using the read parameter. This operational flexibility protects the production server against unnecessary graphical processing overhead and allows the engineering team to calmly debate the problem based on real evidence.

Conclusion and best practices in network monitoring

Mastering the tcpdump command represents a turning point in the career of any professional dealing with infrastructure, backend development, or technical support. Instead of relying on guesswork or blindly restarting services hoping the problem will miraculously disappear, packet interception offers undeniable facts about what is happening at the transport and network layers. Knowing essential filters, how to isolate interfaces, and recording raw traffic for auditing turns hours of frustration into minutes of surgical fault resolution.

However, with great power comes great operational responsibility. Because tcpdump can expose sensitive data traveling across the corporate network, always use the tool with caution and in strict compliance with your organization's information security policies. Whenever possible, filter the capture scope to cover only the hosts and ports strictly necessary for your troubleshooting. By practicing responsibly, you gain absolute technical autonomy to navigate the most complex connectivity issues that arise in your production environment.