tcpdump: Some filter examples


here are some command line examples for often requested packet filter strings

Filter for a MAC address

tcpdump ether host 12:34:56:78:90:ab

Layer 2 broadcasts

tcpdump ether dst ff:ff:ff:ff:ff:ff

Filter icmp packets. For example on interface eth0

tcpdump -i eth0 icmp

All packets to or from a TCP port

tcpdump -i eth0 port 22

All packets to or from an IP Address

tcpdump -i eth0 host

And combined

tcpdump -i eth0 host and port 22

Filter for the TCP Flags SYN or FIN

tcpdump tcp[tcpflags] & (tcp-syn|tcp-fin) != 0

Filter for Packets where SYN and ACK is set

tcpdump tcp[tcpflags] & tcp-syn|tcp-ack) == (tcp-syn|tcp-ack)


ether dst 01:00:0c:cc:cc:cc and (ether[24:2] = 0x2000 or ether[20:2] = 0x2000)


Futher details could be found in the pcap man page.

Advertisment to support

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.