---
title: tcpdump — packet capture analysis
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A tool that captures network packets to analyze communication issues. Use carefully and briefly.
tags: program, Network and Firewall, tcpdump
---

**💬 "tcpdump command"**

tcpdump **captures packets directly** to see actual traffic. It finds problems that are not visible with ping/curl.

Capturing briefly (-c) and saving to a file for analysis is a safe approach.

- **Concept**: Captures and prints packets on an interface.
- **Filter**: Narrows down with expressions such as host/port/tcp.
- **-c**: Limits the count to capture safely.
- **File**: Save with -w and analyze later.
## Commonly used options

| Option | Description |
| --- | --- |
| -i <interface> | Specifies the interface to capture |
| -n | Displays numeric values without name resolution |
| -c <count> | Captures only the specified number and exits |
| -w <file> | Saves the capture to a file |
| -A / -X | Displays contents as ASCII/HEX |

## Three essential command combinations

- `tcpdump -i ens3 -n -c 50 'port 443'` — Captures only 50 packets of 443 traffic
- `tcpdump -i any -n -c 20 'host 10.0.0.9 and port 5432'` — Checks traffic for a specific host and port
- `tcpdump -i ens3 -n -w /tmp/cap.pcap -c 200` — Saves to a file for later analysis
**💬 "Show me an example of comparing the output differences of this command"**

Here are common situations on production servers, organized in order.

### Step 1 · Check the interface

First check the interface to capture.

```
ip -br link
```

### Step 2 · Capture

Capture with a filter and a limited count.

```
tcpdump -i ens3 -n -c 50 'host 10.0.0.9 and port 5432'
```

### Step 3 · Interpret

Determine the issue based on SYN/ACK retransmissions.

```
tcpdump -i ens3 -n -r /tmp/cap.pcap | head -20
```

## How it is used in practice

### 1. Analyzing DB connection failures

**Situation** — The app cannot connect to the DB.

```
tcpdump -i any -n -c 30 'host 10.0.0.7 and port 5432'
```

**Result** — If only SYN packets repeat and there is no SYN/ACK, suspect a firewall or that the service is not running.

**Key point** — Confirming connectivity at the packet level speeds up layer diagnosis.

### 2. Intermittent retransmissions

**Situation** — Responses are slow in a particular segment.

```
tcpdump -i ens3 -n -w /tmp/slow.pcap -c 500 'host 10.0.0.9'
```

**Result** — Check the capture file for retransmissions and duplicate ACKs.

**Key point** — Saving the capture makes it easy to share with the network team.

## Things to watch out for

- Captures may contain sensitive information, so be careful when storing files.
- Unlimited capture can fill up the disk and affect performance. Limit it with -c/-w.
- It requires privileges, so it is usually run as root.
## Actual execution output

This shows the TCP 3-way handshake on the DB port and the first request packet.

![tcpdump command execution result: DB connection packet capture](https://games.aidebatehub.com/assets/tcpdump-demo.png)

An actual production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/network/tcpdump.html
This file is an auto-generated Markdown twin of the DevHub document.