tcpdump — packet capture analysis

💬 "tcpdump command"

tcpdump captures packets directly to see actual traffic. It finds problems that are not visible with ping/curl.

Capturing briefly (-c) and saving to a file for analysis is a safe approach.

• Concept: Captures and prints packets on an interface.
• Filter: Narrows down with expressions such as host/port/tcp.
• -c: Limits the count to capture safely.
• File: Save with -w and analyze later.

Commonly used options

Three essential command combinations

• tcpdump -i ens3 -n -c 50 'port 443' — Captures only 50 packets of 443 traffic
• tcpdump -i any -n -c 20 'host 10.0.0.9 and port 5432' — Checks traffic for a specific host and port
• tcpdump -i ens3 -n -w /tmp/cap.pcap -c 200 — Saves to a file for later analysis

💬 "Show me an example of comparing the output differences of this command"

Here are common situations on production servers, organized in order.

Step 1 · Check the interface

First check the interface to capture.

ip -br link

Step 2 · Capture

Capture with a filter and a limited count.

tcpdump -i ens3 -n -c 50 'host 10.0.0.9 and port 5432'

Step 3 · Interpret

Determine the issue based on SYN/ACK retransmissions.

tcpdump -i ens3 -n -r /tmp/cap.pcap | head -20

How it is used in practice

1. Analyzing DB connection failures

Situation — The app cannot connect to the DB.

tcpdump -i any -n -c 30 'host 10.0.0.7 and port 5432'

Result — If only SYN packets repeat and there is no SYN/ACK, suspect a firewall or that the service is not running.

Key point — Confirming connectivity at the packet level speeds up layer diagnosis.

2. Intermittent retransmissions

Situation — Responses are slow in a particular segment.

tcpdump -i ens3 -n -w /tmp/slow.pcap -c 500 'host 10.0.0.9'

Result — Check the capture file for retransmissions and duplicate ACKs.

Key point — Saving the capture makes it easy to share with the network team.

Things to watch out for

• Captures may contain sensitive information, so be careful when storing files.
• Unlimited capture can fill up the disk and affect performance. Limit it with -c/-w.
• It requires privileges, so it is usually run as root.

Actual execution output

This shows the TCP 3-way handshake on the DB port and the first request packet.

!tcpdump command execution result: DB connection packet capture

An actual production server

Source (HTML): https://games.aidebatehub.com/programs/linux/network/tcpdump.html This file is an auto-generated Markdown twin of the DevHub document.