PWNMI

Cheatsheets

Tcpdump Cheat Sheet

Updated August 11, 2026 · Written by PWNMI — see About.

Tcpdump captures traffic at the packet level — useful when you need to see exactly what's actually happening on the wire, not what a higher-level tool tells you is happening.

Red Team / Offensive Use

Tcpdump is less about initial access and more about verification and troubleshooting during an engagement: confirming a reverse shell payload actually sent traffic, watching for a callback that never arrived, or capturing credentials sent in cleartext over a protocol that shouldn't still be in use on the network. It's also the tool you reach for when something "isn't working" and you need to see whether traffic is leaving the box at all before debugging further up the stack.

Bitwise Filters: When host/port Isn't Precise Enough

Tcpdump's primitives (host, port, tcp, and so on) cover most of what you need, but they can't express "SYN set, ACK not set" or "this packet has IP options" — there's no keyword for that. BPF's proto[offset:size] syntax fills the gap: it reaches directly into any byte (or 2- or 4-byte word) of a packet header and lets you mask it with the same bitwise operators (&, |, ^) you'd use in C. size is optional and defaults to 1 byte.

TCP's flags all live in a single byte — reachable by name as tcp[tcpflags], or numerically at tcp[13] — one bit per flag: tcp-fin, tcp-syn, tcp-rst, tcp-push, tcp-ack, tcp-urg, tcp-ece, tcp-cwr. Once you can mask individual bits, flag combinations that basic filters have no keyword for — SYN without ACK, RST and ACK together — become a one-liner instead of a trip into Wireshark.

Where this actually earns its keep on an engagement:

  • Isolating true SYN-only packets (a new connection attempt) from SYN-ACK replies, which also carry the SYN bit — useful for confirming your own scan traffic is shaped the way you expect, or noticing something scanning back
  • Skipping every pure-ACK packet in a busy capture so you land on packets carrying actual data — the fast path to the cleartext creds the -A flag below is for, without scrolling past an entire TCP handshake first
  • Flagging edge cases with no dedicated keyword at all — IPv4 packets carrying options, or a packet's raw fragmentation state — both are a single masked byte, not a feature tcpdump's primitives expose directly

It scales further than this — the official manpage's own example matches a literal HTTP GET request by computing the TCP payload offset from the IP and TCP header lengths and comparing raw bytes against 0x47455420 (ASCII "GET "). That's a real, working filter, but past a certain point it's genuinely easier to just capture with -w and open the result in Wireshark instead of hand-rolling more arithmetic.

Established Cheatsheet

SANS — TCP/IP and tcpdump — the standard reference poster, covers filter syntax alongside the underlying TCP/IP/ICMP header structure that makes the filters make sense. For the bitwise syntax specifically, the pcap-filter(7) manpage is the canonical source — every named flag value and byte-offset example above comes straight from it.

PWNMI's Top 8 Use Cases

  • tcpdump -i eth0 -n — capture on a specific interface, -n to skip DNS resolution (faster, and doesn't leak your lookups)
  • tcpdump -i eth0 port 4444 — capture only traffic on a specific port; the fast way to confirm whether a reverse shell callback actually arrived
  • tcpdump -i eth0 host <ip> — capture only traffic to/from a specific host, filtering out everything else on a busy interface
  • tcpdump -i eth0 -w capture.pcap — write to a file instead of printing to screen, for deeper analysis in Wireshark afterward
  • tcpdump -i eth0 -A port 80 — print packet contents in ASCII; useful for spotting cleartext credentials or interesting request/response content on unencrypted traffic
  • tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0' — show only the SYN and FIN packets of every TCP conversation, straight from the manpage's own example; the fastest way to see connections opening and closing without the noise in between
  • tcpdump 'tcp[13] & 0x12 = 0x02' — the raw-byte equivalent of "SYN set, ACK not set": a genuinely new outbound connection attempt, not a reply to one (byte 13 is the TCP flags byte; 0x12 masks the SYN and ACK bits, 0x02 requires only SYN to be set)
  • tcpdump 'tcp[tcpflags] & tcp-push != 0' — only packets carrying actual application data (the PSH flag), skipping past the handshake and pure ACKs when hunting for cleartext creds

Next step

For deeper analysis than a live terminal capture allows, open the .pcap in Wireshark — see why I run every engagement through tmux for where a capture window fits into a normal session layout.