TCPDUMP expressions

TCPDUMP expressions are also known as BPF, or Berkeley Packet Filters. On a TCPDUMP command line it is recommended to place them inside single quotes (UNIX) or double quotes (Windows) to avoid confusion and possible parsing errors.

Expressions

tcpdump host profl
dumps all packets to or from host profl
tcpdump ether host 11:22:33:44:55:66
dumps all packets to or from that MAC address
tcpdump net 192.168.12.4/30
dumps all packets to or from a network, specified using CIDR notation
tcpdump net 192.168.12.4 mask 255.255.255.252
dumps all packets to or from a network, specified using a mask
tcpdump tcp src port 53
dumps all packets with source port 22/tcp
tcpdump host {thisIP}
Show only IP traffic to or from thisIP
tcpdump host {thisIP} && host {thatIP}
Show only IP traffic between thisIP and thatIP
tcpdump !(host {myIP}) && {remainder of expression}
Ignore traffic from myIP (necessary if you're running TCPDUMP on a remote machine to stop it from capturing the terminal session with your machine)

Primitives

icmp[0]
Show only echo reply
tcp[13] & 3 != 0
tcp[tcpflags] & (tcp-syn | tcp-fin) != 0
show only SYN or FIN packets
tcp[13] & 0x12 != 0
tcp[tcpflags] & (tcp-syn & tcp-ack) != 0
show only SYN/ACK packets
tcp[tcpflags] & (tcp-syn | tcp-fin | tcp-rst) != 0
show SYN, FIN, and RST packets
ip[2,2] > 576
show only packets longer than 576 bytes
icmp[0] = 3 and icmp[1] = 4
Show ICMP type 3, code 4 (Needs fragmenting but DF bit set)
ip[6] & 0x40 = 0x40
Show only IP packets with DF bit set
vlan && ip
Show only IEEE 802.1q IP packets. Changes the decoding offsets for the remainder of the expression, as if the VLAN header had been stripped away.
vlan 186 && ip
Show only IP packets in IEEE 802.1q VLAN number 186.

Assorted

ip proto 50
Show only ESP packets (IP protocol 50)
ip proto 112
show only VRRP packets (IP protocol 112)
proto vrrp
all VRRP packets (works on IPSO)