/usr/bin/tcpdump --help — Chainguard OS Manuals

From tcpdump 4.99.7-r2 (os), captured 2026-11-05 by running tcpdump --help (exit 0). permalink

tcpdump version 4.99.7
libpcap version 1.11.0 (64-bit time_t, with TPACKET_V3)
OpenSSL 4.0.3 29 Sep 2026
64-bit build, 64-bit time_t
Usage: tcpdump [-AbdDefghHIJKlLnNOpqStuUvxX#] [ -B size ] [ -c count ] [--count]
		[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
		[ -i interface ] [ --immediate-mode ] [ -j tstamptype ]
		[ --list-remote-interfaces remote-source ]
		[ -M secret ] [ --number ] [ --print ] [ -Q in|out|inout ]
		[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]
		[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]
		[ --time-stamp-precision precision ] [ --micro ] [ --nano ]
		[ -z postrotate-command ] [ -Z user ] [ expression ]

Options (83)

Option	Description	Source
`-A`	Print each packet (minus its link level header) in ASCII.	man
`-b`	Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN notation.	man
`-B` buffer_size		man
`--buffer-size` buffer_size	Set the operating system capture buffer size to buffer_size, in units of KiB (1024 bytes).	man
`-c` count	Exit after receiving count packets.	man
`--count`	Print only on stdout the packet count when reading capture file(s) instead of parsing/printing the packets.	man
`-C` file_size	Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one.	man
`-d`	Dump the compiled packet-matching code in a human readable form to standard output and stop.	man
`-dd`	Dump packet-matching code as a C program fragment.	man
`-ddd`	Dump packet-matching code as decimal numbers (preceded with a count).	man
`-D`		man
`--list-interfaces`	Print the list of the network interfaces available on the system and on which tcpdump can capture packets.	man
`-e`	Print the link-level header on each dump line.	man
`-E`	Use spi@ipaddr algo:secret for decrypting IPsec ESP packets that are addressed to addr and contain Security Parameter Index value spi.	man
`-f`	Print foreign' IPv4 addresses numerically rather than symbolically (this option is intended to get around serious brain damage in Sun's NIS server — usually it hangs forever translating non-local…	man
`-F` file	Use file as input for the filter expression.	man
`-g`		man
`--ip-oneline`	Do not insert a line break after the IP header in verbose mode.	man
`-G` rotate_seconds	If specified, rotates the dump file specified with the -w option every rotate_seconds seconds.	man
`-h`		man
`--help`	Print the tcpdump and libpcap version strings, print a usage message, and exit.	man
`--version`	Print the tcpdump and libpcap version strings and exit.	man
`-H`	Attempt to detect 802.11s draft mesh headers.	man
`-i` interface		man
`--interface` interface	Listen, report the list of link-layer types, report the list of time stamp types, or report the results of compiling a filter expression on interface.	man
`-I`		man
`--monitor-mode`	Put the interface in "monitor mode";	man
`--immediate-mode`	Capture in "immediate mode".	man
`-j` tstamp_type		man
`--time-stamp-type` tstamp_type	Set the time stamp type for the capture to tstamp_type.	man
`-J`		man
`--list-time-stamp-types`	List the supported time stamp types for the interface and exit.	man
`--time-stamp-precision` tstamp_precision	When capturing, set the time stamp precision for the capture to tstamp_precision.	man
`--micro`		man
`--nano`	Shorthands for --time-stamp-precision=micro or --time-stamp-precision=nano, adjusting the time stamp precision accordingly.	man
`-K`		man
`--dont-verify-checksums`	Don't attempt to verify IP, TCP, or UDP checksums.	man
`-l`	Make stdout line buffered.	man
`-L`		man
`--list-data-link-types`	List the known data link types for the interface, in the specified mode, and exit.	man
`-m` module	Load SMI MIB module definitions from file module.	man
`-M` secret	Use secret as a shared secret for validating the digests found in TCP segments with the TCP-MD5 option (RFC 2385), if present.	man
`-n`	Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.	man
`-N`	Don't print domain name qualification of host names.	man
`-#`		man
`--number`	Print a packet number at the beginning of the line.	man
`-O`		man
`--no-optimize`	Do not run the packet-matching code optimizer.	man
`-p`		man
`--no-promiscuous-mode`	Don't put the interface into promiscuous mode.	man
`--print`	Print parsed packet output, even if the raw packets are being saved to a file with the -w flag.	man
`-Q` direction		man
`--direction` direction	Choose send/receive direction direction for which packets should be captured.	man
`-q`	Quick (quiet?) output.	man
`-r` file	Read packets from file (which was created with the -w option or by other tools that write pcap or pcapng files).	man
`-S`		man
`--absolute-tcp-sequence-numbers`	Print absolute, rather than relative, TCP sequence numbers.	man
`-s` snaplen		man
`--snapshot-length` snaplen	Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes.	man
`-T` type	Force packets selected by "expression" to be interpreted the specified type.	man
`-t`	Don't print a timestamp on each dump line.	man
`-tt`	Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and fractions of a second since that time, on each dump line.	man
`-ttt`	Print a delta (microsecond or nanosecond resolution depending on the --time-stamp-precision option) between current and previous line on each dump line.	man
`-tttt`	Print a timestamp, as hours, minutes, seconds, and fractions of a second since midnight, preceded by the date, on each dump line.	man
`-ttttt`	Print a delta (microsecond or nanosecond resolution depending on the --time-stamp-precision option) between current and first line on each dump line.	man
`-u`	Print undecoded NFS handles.	man
`-U`		man
`--packet-buffered`	If the -w option is not specified, or if it is specified but the --print flag is also specified, make the printed packet output packet-buffered'';	man
`-v`	When parsing and printing, produce (slightly more) verbose output.	man
`-vv`	Even more verbose output.	man
`-vvv`	Even more verbose output.	man
`-V` file	Read a list of filenames from file.	man
`-w` file	Write the raw packets to file rather than parsing and printing them out.	man
`-W` filecount	Used in conjunction with the -C option, this will limit the number of files created to the specified number, and begin overwriting files from the beginning, thus creating a 'rotating' buffer.	man
`-x`	When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header) in hex.	man
`-xx`	When parsing and printing, in addition to printing the headers of each packet, print the data of each packet, including its link level header, in hex.	man
`-X`	When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header) in hex and ASCII.	man
`-XX`	When parsing and printing, in addition to printing the headers of each packet, print the data of each packet, including its link level header, in hex and ASCII.	man
`-y` datalinktype		man
`--linktype` datalinktype	Set the data link type to use while capturing packets (see -L) or just compiling and dumping packet-matching code (see -d) to datalinktype.	man
`-z` postrotate-command	Used in conjunction with the -C or -G options, this will make tcpdump run " postrotate-command file " where file is the savefile being closed after each rotation.	man
`-Z` user		man
`--relinquish-privileges` user	If tcpdump is running as root, after opening the capture device or input savefile, but before opening any savefiles for output, change the user ID to user and the group ID to the primary group of…	man

Examples (12) from the manual page, untested

tcpdump host sundown
To print all packets arriving at or departing from sundown:
tcpdump host helios and \( hot or ace \)
To print traffic between helios and either hot or ace:
tcpdump ip host ace and not helios
To print all IP packets between ace and any host except helios:
tcpdump net ucb-ether
To print all traffic between local hosts and hosts at Berkeley:
tcpdump 'gateway snup and (port ftp or ftp-data)'
To print all ftp traffic through internet gateway snup: (note that the expression is quoted to prevent the shell from (mis-)interpreting the parentheses):
tcpdump ip and not net localnet
To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net).
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host.
tcpdump 'tcp[tcpflags] & (tcp-rst|tcp-ack) == (tcp-rst|tcp-ack)'
To print the TCP packets with flags RST and ACK both set.
tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets.
tcpdump 'gateway snup and ip[2:2] > 576'
To print IP packets longer than 576 bytes sent through gateway snup:
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
To print IP broadcast or multicast packets that were not sent via Ethernet broadcast or multicast:
tcpdump 'icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply'
To print all ICMP packets that are not echo requests/replies (i.e., not ping packets):

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.