Capture and analyse network traffic with tcpdump

When an app says it cannot connect and the logs say nothing, tcpdump shows what is really on the wire: whether packets arrive, whether the server answers and where a handshake stops. This tcpdump tutorial covers the filters and flags you need on a Linux VPS.

Before you start

• Root or sudo access (capturing packets needs privileges).
• Install tcpdump: apt install tcpdump or dnf install tcpdump.
• Capture only what you need; traffic can contain passwords and personal data. Delete capture files when done.

Pick the interface

tcpdump -D

Lists interfaces. The public one is usually eth0, ens3 or similar (ip -br a shows which has your IP). Use -i any to capture on all interfaces.

Basic capture

tcpdump -i eth0 -nn -c 20

• -nn do not resolve hostnames or port names (faster, clearer).
• -c 20 stop after 20 packets.
• -v more detail, -A print payload as text (useful for plain HTTP), -X hex and ASCII.

If you are connected over SSH, exclude your own session or the output floods: add not port 22.

Filter expressions

Example: does anything reach the database port?

tcpdump -i eth0 -nn port 3306

Read the output

10:21:04.112 IP 203.0.113.50.51544 > 198.51.100.10.443: Flags [S], seq 1001, length 0
10:21:04.112 IP 198.51.100.10.443 > 203.0.113.50.51544: Flags [S.], seq 2002, ack 1002, length 0
10:21:04.140 IP 203.0.113.50.51544 > 198.51.100.10.443: Flags [.], ack 1, length 0

• [S] SYN (connection request), [S.] SYN-ACK (server accepts), [.] ACK, [P.] data, [F.] close, [R] reset.
• SYN arrives but no SYN-ACK: the port is closed locally or a firewall drops it.
• SYN arrives, server replies [R]: nothing listens on that port.
• No SYN at all: traffic never reaches the server (upstream firewall, DNS pointing elsewhere, wrong IP).

Save a capture for Wireshark

tcpdump -i eth0 -nn -w /root/capture.pcap port 443 and host 203.0.113.50

Stop with Ctrl+C, download the file with scp or SFTP and open it in Wireshark for a graphical view. Read it back on the server with tcpdump -nn -r /root/capture.pcap. For long captures, rotate files with -C 100 -W 5 (five files of 100 MB).

Practical examples

• Is DNS answering? tcpdump -i any -nn port 53
• Are pings arriving? tcpdump -i eth0 -nn icmp
• Is mail being sent out? tcpdump -i eth0 -nn dst port 25 or dst port 587
• Who is hammering the web server? tcpdump -i eth0 -nn -c 2000 dst port 443 | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -nr | head

Troubleshooting

• You don't have permission to capture: run with sudo.
• No packets at all: wrong interface. Try -i any.
• HTTPS payload is unreadable: it is encrypted, as it should be. tcpdump still shows whether connections succeed.
• Packets dropped by kernel in the summary: use a tighter filter and -w to write to a file instead of printing.

tcpdump FAQ

Does tcpdump see traffic blocked by the firewall?

Yes for incoming packets: tcpdump captures before the local iptables/nftables INPUT rules. That is why it is great for telling firewall drops apart from routing problems.

Can I use tcpdump on cPanel shared hosting?

No, it needs root. On shared hosting ask support to check connectivity for you.

What is the Windows equivalent?

Wireshark with Npcap, or the built-in pktmon command on Windows Server.

Next steps

• Network troubleshooting with ping, traceroute, dig and curl
• Read an MTR report
• TCP vs UDP explained