tcpdump You’ll Actually Use: Filters for L2–L7

Master essential tcpdump filters for analyzing traffic across all layers of the OSI model, from Ethernet frames to HTTP requests.

image from wp

Introduction: Why tcpdump is Your Go-To Network Troubleshooting Tool

If you’ve ever needed to troubleshoot network issues or inspect traffic, you’ve probably heard of tcpdump. It’s one of the most powerful tools for network analysis, providing deep insight into the packets that move across your network. But with so many options and filters available, it can be overwhelming to know where to start.

In this article, we’ll break down how you can use tcpdump to filter network traffic across different layers of the OSI model — from the raw L2 Ethernet frames to the higher-level L7 application protocols like HTTP and DNS. By understanding how to apply these filters, you’ll be equipped to capture exactly what you need for troubleshooting, security analysis, or network optimization.

Whether you’re just getting started with tcpdump or you’re already familiar with the basics, this guide will help you unlock the full potential of packet capturing and analysis.

Section 1: The Basics of tcpdump and Packet Filtering

Before diving into advanced filters, let’s quickly cover the basics of using tcpdump:

1.1 What is tcpdump?

tcpdump is a command-line packet analyzer that allows you to capture network traffic in real-time. It’s one of the oldest and most reliable tools available for network diagnostics.

1.2 Why Use Filters?

Filters allow you to focus on specific traffic, making your packet captures more efficient and less cluttered. Instead of capturing everything, you can limit your capture to the exact data you need. This is especially important in busy networks where excessive traffic can quickly overwhelm your capture file.

1.3 The Structure of tcpdump Filters

A typical tcpdump command structure looks like this:

tcpdump -i <interface> <filter_expression>

For example, to capture traffic on interface eth0, you would run:

tcpdump -i eth0

To apply filters, you can use expressions that target specific protocols, IP addresses, ports, and even specific packet contents.

Section 2: Filters for Layer 2 (L2) — The Data Link Layer

The Data Link Layer (Layer 2) handles the transfer of data frames between devices on the same network. Capturing traffic at this level can be useful for debugging issues related to physical networking, such as Ethernet and MAC addresses.

2.1 Capturing Ethernet Traffic

To filter by Ethernet (Layer 2) frames, you can use ether filters. Here’s an example:

tcpdump ether

This command captures all Ethernet frames, regardless of the underlying protocol. However, you’ll often want to filter it further.

2.2 Filtering by MAC Address

To capture traffic for a specific source or destination MAC address, use the following:

tcpdump ether src <MAC_address>

For example:

tcpdump ether src 00:1a:2b:3c:4d:5e

This will capture all packets from the device with the specified source MAC address.

You can also filter by the destination MAC address using ether dst:

tcpdump ether dst 00:1a:2b:3c:4d:5e

2.3 Filtering for ARP Requests

ARP (Address Resolution Protocol) is used to map IP addresses to MAC addresses. To capture all ARP traffic on your network:

tcpdump arp

Section 3: Filters for Layer 3 (L3) — The Network Layer

Layer 3, the Network Layer, is responsible for routing packets across different networks. IP addresses are handled at this layer, making it one of the most commonly filtered layers.

3.1 Capturing IPv4 and IPv6 Traffic

To capture all IPv4 traffic:

tcpdump ip

For IPv6, use:

tcpdump ip6

3.2 Filtering by Source or Destination IP

You can filter traffic based on source or destination IP addresses:

tcpdump src host 192.168.1.1
tcpdump dst host 192.168.1.1

This will capture packets either coming from or going to the specified IP address.

To capture traffic between two specific IP addresses:

tcpdump host 192.168.1.1 and 192.168.2.1

3.3 Filtering by Network Subnet

If you want to capture traffic from a specific subnet:

tcpdump net 192.168.1.0/24

This will capture all packets from any device on the 192.168.1.0/24 subnet.

Section 4: Filters for Layer 4 (L4) — The Transport Layer

The Transport Layer (Layer 4) is responsible for ensuring that data is transferred reliably between devices, with protocols like TCP, UDP, and SCTP.

4.1 Capturing TCP Traffic

To capture all TCP packets, simply run:

tcpdump tcp

4.2 Filtering by Port

You can filter traffic based on specific ports. For example, to capture traffic on port 80 (HTTP):

tcpdump port 80

To capture only incoming traffic to port 80:

tcpdump dst port 80

For outgoing traffic:

tcpdump src port 80

4.3 Filtering for Specific TCP Flags

You can also capture packets with specific TCP flags. For instance, to capture SYN packets (used during the TCP handshake):

tcpdump 'tcp[tcpflags] == tcp-syn'

Section 5: Filters for Layer 7 (L7) — The Application Layer

Layer 7, the Application Layer, deals with high-level protocols like HTTP, DNS, and FTP. Filtering traffic at this layer can provide deep insights into the actual data being transferred.

5.1 Capturing HTTP Traffic

To filter for HTTP traffic on port 80:

tcpdump port 80

If you’re looking for HTTPS traffic, which uses port 443:

tcpdump port 443

5.2 Inspecting DNS Queries

DNS operates on port 53. To capture DNS queries:

tcpdump port 53

To filter specifically for DNS requests:

tcpdump 'udp[10] & 0x80 = 0'

This filter only shows DNS queries (as opposed to DNS responses).

5.3 Filtering HTTP GET Requests

To capture HTTP GET requests specifically:

tcpdump -i eth0 -A 'tcp port 80 and (((ip[2:2] - (ip[0] & 0xf)) - (ip[2:2] & 0xff)) & 0x01 != 0)'

This command will capture HTTP GET requests by filtering based on TCP packets containing “GET” in the payload.

Section 6: Advanced Filters and Tips

Now that we’ve covered the basic filters for each layer, let’s explore some more advanced tips:

6.1 Combine Multiple Filters

You can combine multiple conditions using logical operators:

tcpdump src host 192.168.1.1 and dst port 80

This will capture traffic from a specific host on a specific port.

6.2 Using “not” to Exclude Traffic

To exclude specific traffic, use the not operator. For example:

tcpdump not port 22

This excludes all traffic on port 22 (SSH).

6.3 Capture Traffic from Multiple Interfaces

To capture traffic on multiple interfaces at once:

tcpdump -i eth0 -i wlan0

Conclusion: Mastering tcpdump for Network Troubleshooting

Mastering tcpdump filters can significantly enhance your ability to troubleshoot and monitor network traffic effectively. By leveraging the right filters for different OSI layers, you can isolate specific types of traffic, monitor protocols, and diagnose issues quickly. Whether you’re debugging network problems, performing security analysis, or optimizing traffic flows, tcpdump is an invaluable tool for any network professional.

The next time you’re capturing packets, try applying some of these filters, and watch as your tcpdump output becomes more focused and useful. Happy packet sniffing!