Security article

HTB Academy TCP-dump

HTB Academy TCP-dump: TCPDump Quick Reference • HTB Academy • htb-academy, module81

2022-09-223 tags

TCPDump Quick Reference

A compact cheat‑sheet of useful tcpdump commands and filters.

Start a capture (no resolution, verbose, hex+ASCII, first 100 pkts)

sudo tcpdump -nnvX -c 100 -i <iface>

Read a pcap and show hex+ASCII

sudo tcpdump -X -r /path/to/capture.pcap
# Include link-layer headers:
sudo tcpdump -nnXX -r /path/to/capture.pcap

Increase verbosity

-v
-vv
-vvv

Validate tcpdump installed

which tcpdump
tcpdump --version

List all capture interfaces

tcpdump -D

Save a capture to PCAP

sudo tcpdump -nn -i <iface> -w /path/out.pcap

Read from a PCAP

sudo tcpdump -nn -r /path/out.pcap

Pipe readable output to grep

tcpdump -r file.pcap -nl | grep 'string'

Common Filters

Source / Destination / Host / Net / Port

# Source host
sudo tcpdump -i <iface> src host 172.16.146.2

# Destination network
sudo tcpdump -i <iface> dst net 172.16.146.0/24

# Specific TCP port
sudo tcpdump -i <iface> tcp port 443

# Port range
sudo tcpdump -i <iface> portrange 0-1024

Protocol

# By name
sudo tcpdump -i <iface> udp

# By protocol number (UDP = 17)
sudo tcpdump -i <iface> proto 17

Packet size

# < 64 bytes
sudo tcpdump -i <iface> less 64

# > 500 bytes
sudo tcpdump -i <iface> greater 500

Boolean operators

# AND: traffic from host AND on port 23
sudo tcpdump -i <iface> host 192.168.0.1 and port 23

# OR: ICMP OR traffic involving specific host
sudo tcpdump -i <iface> icmp or host 172.16.146.1

# NOT: exclude ICMP
sudo tcpdump -i <iface> not icmp

TCP flag hunting (SYN)

sudo tcpdump -i <iface> 'tcp[13] & 2 != 0'

Byte 13 of the TCP header & bit mask 0x02 (SYN).

Handy Tips

-S — show absolute TCP sequence numbers (instead of relative).
-A — show only ASCII payload (no hex).
-X — show hex and ASCII payload.
-e — include link-layer header on each line.
-l — line-buffered output (useful for piping to tools like grep).
-n / -nn — disable name & service resolution (faster, cleaner).

Mini Examples

# Quick live peek at HTTPS traffic (headers only)
sudo tcpdump -nn -i <iface> tcp port 443

# Watch DNS (TCP or UDP)
sudo tcpdump -nn -i <iface> port 53

# Grep HTTP payload for email-like strings from a pcap
tcpdump -Ar http.cap -l | grep -E '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+'

Remember: Pre-capture filters drop non-matching traffic (smaller files but risk losing data). Post-capture filters (with -r) are safer for analysis.

← Back to overview