- Version
- Download 6540
- File Size 30.83 KB
- File Count 1
- Create Date October 1, 2013
- Last Updated October 12, 2026
TCPDUMP Cheat Sheet
Before Wireshark became the de facto graphical tool for packet analysis, tcpdump was already giving network engineers a direct view of what was happening on the wire. It remains one of the most useful packet-capture tools available today, especially on Linux systems, servers, routers, firewalls, appliances, and remote systems where a graphical interface may not be available.
This updated CellStream tcpdump / BPF Cheat Sheet is designed to give you a fast, practical reference for the commands and filters you are most likely to use. It covers the core tcpdump command-line options, Berkeley Packet Filter syntax, host and port filtering, IPv4 and IPv6, TCP flags, VLANs, MPLS, Wi-Fi capture, reading and writing PCAP files, rotating captures, timestamps, and common troubleshooting workflows. It also highlights several important capture pitfalls, including checksum-offload artifacts, IPv6 extension headers, raw byte-offset filters, and the way encapsulations such as VLAN and MPLS can affect BPF expressions.
If you are new to tcpdump, BPF syntax can look cryptic at first. This cheat sheet gives you a set of working patterns you can adapt rather than having to remember the syntax from scratch. If you already use tcpdump, it works well as a quick reference when you need to build a filter, capture traffic on a remote system, save packets for later analysis, or narrow a large capture down to the traffic that matters.
Once you have captured the packets, you can open the resulting PCAP file in Wireshark for deeper protocol analysis. If you want to continue learning, you can also check out our Top 10 tcpdump Commands, our Wireshark Profile Repository, our Wireshark videos on YouTube, and our Wireshark courses on Udemy.
Did you find this useful? Would you change or modify this file in any way? If you would like to help support the continued development of independent networking, broadband, Wi-Fi, VoIP, and packet analysis content, please consider joining our Patreon community where you will gain access to exclusive technical resources, downloadable labs and PCAPs, bonus course content, troubleshooting guides, and additional member-only material. You can also leave comments at our Discord server. You can also support our work by simply buying us a coffee — every contribution helps us continue creating practical, real-world network science education for professionals and enthusiasts alike.