tcpdump -i eth0 -nn port 443

tcpdump Filter Builder

BPF filter syntax is its own small language. Pick what you want to see and get a capture command that records it without filling the disk.

any captures every interface.
Keeps your own SSH out of the capture.
Options
Generated command
Reading and rotating captures

Exclude your own SSH session

Running tcpdump over SSH without excluding port 22 captures the packets carrying its own output, which generates more output, which generates more packets. The capture becomes useless and the session may stall. Always add not port 22 when working remotely. Two other habits worth forming: -nn stops tcpdump doing DNS lookups for every address, which is both slow and generates traffic that pollutes the capture, and capture filters are far cheaper than filtering afterwards because the kernel drops non-matching packets before they are ever copied.

Build tcpdump capture filters

This tcpdump builder generates capture commands with BPF filter expressions for protocol, host, direction, and port, combined correctly with and, or, and not. It adds the flags that make captures usable: -nn to skip name resolution, -s 0 for full packets, -c to stop after a count, -w to write a file for Wireshark, and the -C and -W rotation options that stop a long capture filling the disk.

tcpdump FAQ

What is the difference between a capture filter and a display filter?

A capture filter uses BPF syntax and decides what tcpdump records; anything it excludes is gone forever. A display filter is Wireshark syntax and only decides what you see from data already captured. They are different languages, which is why a Wireshark filter pasted into tcpdump fails.

Why do I see nothing on the "any" interface?

Capturing on any works but does not support promiscuous mode and can behave differently with VLAN tags and some tunnels. If a specific interface shows traffic and any does not, name the interface explicitly. tcpdump -D lists what is available.

Can I read a tcpdump capture in Wireshark?

Yes, pcap is the shared format. Capture with -w on the server where the traffic is, copy the file, and open it locally. You can also pipe a live remote capture straight into Wireshark over SSH, which the generated commands include.

Do I need root to run tcpdump?

Packet capture needs elevated privileges, but running the tool as root is avoidable. Grant CAP_NET_RAW and CAP_NET_ADMIN to the binary, or use dumpcap and add yourself to the wireshark group. This matters because packet parsers process hostile input and have a long CVE history.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. WireGuard Config Generator Produce matching server and peer configs with AllowedIPs, DNS, keepalive, and NAT forwarding rules. Reverse Proxy Config Builder Write nginx or Caddy config for a self-hosted service, with TLS, WebSockets, and forwarded headers. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. nftables Rule Builder Generate nftables rules and a stateful starter ruleset for the inet filter table. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. GPG Command Builder Verify signed downloads, generate keys, and sign files or git commits without guessing flags. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. ssh-keygen Builder Generate Ed25519, RSA, or FIDO2 security key SSH keys, then install them with ssh-copy-id. sudoers Rule Builder Write sudoers.d rules with run-as targets, NOPASSWD, and limited command lists, validated with visudo. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →