Tcpdump little book

Tcpdump is a very powerful command line tool to analyze network packets on Unix-like Operating Systems; it is indispensable for debugging network related issues. Run tcpdump in your terminal: 

  1. # tcpdump
  2. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  3. listening on enp0s25, link-type EN10MB (Ethernet), capture size 262144 bytes
  4. 08:57:41.148740 IP6 fe80::846b:2555:fb41:1fa8.dhcpv6-client > ff02::1:2.dhcpv6-server: dhcp6 solicit
  5. 08:57:41.208960 IP archlinux.ssh > 10.217.133.206.55977: Flags [P.], seq 687245846:687246034, ack 4010852751, win 501, length 188
  6. ......

Without any options and expression, tcpdump works in a live-capture mode (the source code is here): 

  1. ......
  2.         /*
  3.          * We're doing a live capture.
  4.          */
  5.         if (device == NULL) {
  6.             /*
  7.              * No interface was specified.  Pick one.
  8.              */
  9. #ifdef HAVE_PCAP_FINDALLDEVS
  10.             /*
  11.              * Find the list of interfaces, and pick
  12.              * the first interface.
  13.              */
  14.             if (pcap_findalldevs(&devlist, ebuf) == -1)
  15.                 error("%s", ebuf);
  16.             if (devlist == NULL)
  17.                 error("no interfaces available for capture");
  18.             device = strdup(devlist->name);
  19.             pcap_freealldevs(devlist);
  20. #else /* HAVE_PCAP_FINDALLDEVS */
  21.             /*
  22.              * Use whatever interface pcap_lookupdev()
  23.              * chooses.
  24.              */
  25.             device = pcap_lookupdev(ebuf);
  26.             if (device == NULL)
  27.                 error("%s", ebuf);
  28. #endif
  29.         }
  30. ......

Depends on whether HAVE_PCAP_FINDALLDEVS macro is defined, tcpudmp will pick a “default” network interface to do capture work. Interesting, right? Since all is set, let’s begin this whirlwind tour of tcpdump.

P.S., this manual refers code and documents heavily from tcpdump website, and kudos to tcpdump guys! If the small booklet gives you some help, please give it a star in github. :-)