tcpdump Cheatsheet

Output Options

Use this tcpdump reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

The flag table

Every flag people actually reach for, in one place.

Flag	Effect
`-i iface`	Capture on this interface
`-n`	No name resolution for addresses
`-nn`	No name resolution for addresses or ports and protocols
`-N`	Strip the domain from host names (`nic`, not `nic.example.com`)
`-v`	More protocol detail, plus IP TTL, ID, total length, options
`-vv`	Even more, full NFS and SMB decode, TCP option detail
`-vvv`	Maximum verbosity
`-q`	Quick, short one-line output, less protocol info
`-e`	Print the link-level header (MAC addresses, VLAN tags)
`-A`	Print payload as ASCII, minus the link-level header
`-x`	Payload as hex
`-xx`	Payload as hex, including the link-level header
`-X`	Payload as hex and ASCII side by side
`-XX`	Same as `-X` plus the link-level header
`-s len`	Snapshot length, bytes captured per packet
`-c n`	Exit after n packets
`-w file`	Write raw packets to a pcap file instead of printing
`-r file`	Read from a pcap file instead of an interface
`-Q dir`	Direction: `in`, `out`, or `inout`
`-l`	Line-buffer stdout, so pipes work live
`-U`	Packet-buffer stdout, flush per packet with `-w -`
`-t`	No timestamp
`-tt`	Timestamp as an unsigned Unix epoch seconds value
`-ttt`	Delta since the previous line
`-tttt`	Human-readable date and time
`-ttttt`	Delta since the first line
`-#`	Print a packet number on each line
`-B kib`	Kernel capture buffer size in KiB
`-Z user`	Drop privileges to `user` after opening the socket
`-d`	Dump the compiled BPF program and exit, do not capture

Reading a default output line

14:22:07.109233 IP 10.0.0.5.54321 > 93.184.216.34.443:
  Flags [S], seq 2847193, win 65535, options [mss 1460,sackOK,
  TS val 12345 ecr 0,nop,wscale 7], length 0

Piece	Meaning
`14:22:07.109233`	Capture timestamp, local time, microseconds
`10.0.0.5.54321`	Source. The last dotted field is the port
`>`	Direction of this packet
`Flags [S]`	TCP flags, see the table below
`seq` / `ack`	Sequence and acknowledgement numbers
`win 65535`	Advertised receive window
`length 0`	Payload bytes, not frame size

Flag letters in Flags [...]:

Letter	Flag
`S`	SYN
`.`	ACK, on its own means a bare ack
`P`	PSH
`F`	FIN
`R`	RST
`U`	URG
`W`	CWR
`E`	ECE
`none`	No flags set at all

So [S] is a connection open, [S.] is the SYN-ACK, [P.] is data with an ack riding along, and [R.] is a reset.

Verbosity levels compared

sudo tcpdump -i eth0 -nn -q port 443       # shortest useful line
sudo tcpdump -i eth0 -nn port 443          # default
sudo tcpdump -i eth0 -nn -v port 443       # adds TTL, IP id, length
sudo tcpdump -i eth0 -nn -vv port 443      # adds full option decode

-v is where the IP TTL shows up, which is what you want when you are guessing hop counts or spotting a spoofed source.

Seeing the payload

# Hex and ASCII together, the usual choice
sudo tcpdump -i eth0 -nn -X port 80

# ASCII only, readable for text protocols
sudo tcpdump -i eth0 -nn -A -s 0 'tcp port 80'

# Include the Ethernet header so you can read MACs and VLAN tags
sudo tcpdump -i eth0 -nn -e -XX port 80

-s 0 means the default full snaplen (262144 bytes in tcpdump 4.99), not "zero bytes". Older tcpdump defaulted to 68 or 96 bytes, which is why so many old recipes carry -s 0. On any modern build it is a no-op.

Timestamps you can correlate

Default relative-looking times are actually wall clock local time. Two formats matter when you cross-reference logs:

# Absolute date and time, for matching against application logs
sudo tcpdump -i eth0 -nn -tttt port 443

# Epoch seconds, for feeding into a script
sudo tcpdump -i eth0 -nn -tt port 443

# Delta between consecutive packets, for spotting stalls
sudo tcpdump -nn -ttt -r capture.pcap 'tcp port 443'

-ttt is the fastest way to see a one-second retransmission gap or a 30-second idle timeout without doing arithmetic in your head.

Direction and quiet capture

# Only inbound packets, useful when your own replies are noise
sudo tcpdump -i eth0 -nn -Q in port 8080

# Only what this host sends
sudo tcpdump -i eth0 -nn -Q out port 8080

-Q is not supported on every platform and silently matters: if the OS does not implement it, tcpdump tells you rather than filtering wrongly. The portable fallback is an address-based filter, src host <me>.

Piping to another tool? tcpdump -l -nn ... | grep --line-buffered RST. Without -l on the tcpdump side and --line-buffered on grep, you get nothing for minutes and assume the filter is broken.