How to use tcpdump to troubleshoot network latency and errors

What is tcpdump and why it remains indispensable

When a web application hangs mysteriously or a microservice drops its database connection, developers often face an invisible wall. That is precisely where tcpdump steps in as a Swiss Army knife on the Linux command line. It is a packet capture utility that listens to the traffic flowing through a server's network interface, allowing you to inspect every data packet entering or leaving the machine. In practice, this means opening the network's black box and seeing exactly what messages computers are exchanging behind the scenes.

Unlike complex graphical tools, tcpdump runs directly in the terminal, making it essential for remote servers where graphical interfaces are unavailable. It operates by placing the network card into a special monitoring mode or intercepting local host traffic. For anyone who has previously investigated blocked ports using the netstat command to track open ports, tcpdump represents the natural next step: instead of just seeing who is listening, you get to read the exact text of the conversation.

Preparing the environment and capturing basic traffic

Before diving into complex troubleshooting, we need to understand the fundamental command syntax and how to prevent data overload on the screen. By default, typing just the tool name will cause it to dump thousands of lines per second into the terminal, making human reading impossible. To prevent this chaos, we always specify a target network interface using the -i flag and limit the packet volume with the -c flag.

Let us examine the first practical command to listen to traffic on the system's primary interface:

sudo tcpdump -i eth0 -c 10

In this example, the parameter -i eth0 indicates that we want to monitor the network card named eth0, while -c 10 forces the program to exit as soon as it captures exactly ten packets. In practice, you will notice that each displayed line represents an individual network frame containing timestamps, source and destination IP addresses, and protocol details. If your connection remains unstable after an infrastructure change, ensure the issue is not name resolution by reviewing our guide on how to flush DNS cache on Linux and fix errors before blaming the transport layer.

Mastering packet filters to isolate the issue

The true power of tcpdump lies in its filtering engine based on BPF (Berkeley Packet Filter) syntax. Instead of trying to read all corporate traffic, you can build mathematical expressions that tell the tool to ignore everything irrelevant. You can filter by specific IP addresses, port numbers, or protocol types such as TCP or UDP.

To capture only traffic directed to port 443, used in secure HTTPS connections, we use the following terminal instruction:

sudo tcpdump -i any port 443

When combining multiple criteria using logical operators like and, or, and not, we can isolate the exact troublesome flow. For example, to investigate exclusive communication with a remote database on a specific IP, we would write a filter combining the address and service port. This surgical precision prevents generated log files from growing uncontrollably and simplifies subsequent analysis in graphical protocol analyzers.

Diagnosing TCP handshake failures

The TCP protocol uses an initial negotiation mechanism known as the three-way handshake to establish a reliable connection between two endpoints. This process consists of the sequential exchange of packets with specific flags called SYN, SYN-ACK, and ACK. When an application suffers from extreme latency during connection setup or hangs with connection refused errors, tcpdump lets you see precisely where this negotiation failed.

To specifically monitor packets that initiate a new network conversation, we filter by TCP flags using the command below:

sudo tcpdump 'tcp[tcpflags] & (tcp-syn) != 0'

In practice, if you see multiple SYN packets sent by your server but no answering SYN-ACK packets coming from the destination, the diagnosis is immediate: a firewall is blocking traffic midway or the remote service is down. This clarity eliminates hours of guesswork and directs the engineering team straight to fixing the security rule or affected service.

Identifying latency bottlenecks and retransmissions

Application latency often stems not from the code itself, but from micro-packet losses on the network that force the TCP protocol to resend dropped data. Tcpdump makes identifying these events easy by exposing sequence numbers and warnings about out-of-order or duplicate packets. When a packet goes missing in transit, the sender must wait for a timeout to expire before retransmitting, causing that frustrating pause in the end-user experience.

To save the capture to a file for subsequent detailed analysis or sharing with other engineers, we use the write flag:

sudo tcpdump -i eth0 -w network_diag.pcap port 80

The generated file with the .pcap extension can be opened in advanced graphical tools or processed by automated scripts to calculate the exact response time between request transmission and acknowledgment arrival. If the network experiences drastic performance drops accompanied by anomalous broadcast traffic bursts, physical or data link layer interventions may be required, as explained in our guidance on how to use storm control on switches to stabilize the environment.

Final considerations on network monitoring

Mastering tcpdump transforms any technology professional into a relentless problem solver when facing complex infrastructure and connectivity failures. By learning to filter out raw traffic noise and interpret TCP protocol states, you gain the autonomy to audit systems without relying on proprietary tools or guesswork. Constant practice in staging environments and careful reading of captured packets consolidate a technical intuition that is indispensable for keeping applications fast, secure, and highly available in daily operations.