tcpdump Filter Builder

Assemble a tcpdump capture command and its BPF filter from protocol, host, port, and direction — with a flag reference and copy button.

Choose what to capture — the tcpdump command and its BPF filter assemble live below. That filter is standard BPF, so it also works as a Wireshark capture filter.

examples

interface

protocol

host

port

network

extra filter

verbosity

flags

numeric — no name/port lookups (-nn) ASCII payload (-A) hex + ASCII (-X) link-layer header (-e) no promiscuous mode (-p)

capture

tcpdump

BPF filter

Capturing normally needs root (sudo tcpdump …). Writing to a .pcap with -w stores raw packets to open later in Wireshark; the BPF filter above is a Wireshark capture filter (its display-filter syntax differs).

tcpdump & BPF 101

tcpdump and BPF

tcpdump captures packets off a network interface and prints or saves them. What to capture is described by a BPF (Berkeley Packet Filter) expression — the same filter language Wireshark uses for its capture filters. The builder assembles both the command and the bare filter.

Filter primitives

A BPF expression is primitives joined by and, or, and not:

primitive	matches
`tcp` / `udp` / `icmp` / `arp`	a protocol
`host 10.0.0.5`	traffic to or from an address
`src host X` / `dst host X`	one direction only
`port 443`	a port in either direction (`src port` / `dst port` to pin it)
`portrange 8000-8100`	a range of ports
`net 192.168.1.0/24`	a subnet

So tcp and dst port 443 and host 10.0.0.5 captures HTTPS traffic to that host. The whole expression is a single shell argument, which is why the builder wraps it in quotes.

The flags this tool sets

flag	meaning
`-i eth0`	the interface to listen on (`any` captures on all of them)
`-n` / `-nn`	don't resolve hostnames (`-n`), and don't translate port numbers to service names (`-nn`) — faster and clearer
`-v` / `-vv` / `-vvv`	increasingly verbose per-packet detail
`-c 100`	stop after N packets
`-s 0`	snaplen — bytes captured per packet; `0` means the whole packet
`-A` / `-X`	print the payload as ASCII, or as hex + ASCII
`-e`	include the link-layer (Ethernet/MAC) header
`-p`	don't put the interface into promiscuous mode — see below
`-w file.pcap`	write raw packets to a file instead of printing (read back with `-r`)

Promiscuous mode

By default tcpdump switches the interface into promiscuous mode, telling the NIC to hand up every frame it sees — not just those addressed to this host. On a hub, a mirror/SPAN port, or a tap that's what lets you watch other hosts' traffic. On an ordinary switched network you'll mostly see your own traffic plus broadcasts either way, because the switch only forwards frames to the ports that need them.

Pass -p to leave the interface alone. Reach for it when enabling promiscuous mode would be disruptive or noticeable, when a policy or driver forbids it, or when you only care about this host's own traffic. (Promiscuous mode is not the same as Wi-Fi monitor mode, -I, which captures 802.11 management frames.)

Advanced: byte matching

The extra filter field takes any BPF, including byte offsets. A classic is matching TCP SYN packets (new connection attempts):

tcp[tcpflags] & tcp-syn != 0

This reads the flags byte of the TCP header and keeps packets whose SYN bit is set.

Permissions

Reading raw packets requires elevated privileges, so real captures run under sudo (or with the CAP_NET_RAW capability). Only capture on networks you're authorized to monitor.