This command will capture all of the packets that are traveling through interface eth0 (the first Ethernet interface) and that are for port 80 (the HTTP port). Here’s an example: tcpdump -i eth0 port 80 The “port” parameter specifies the port number that you want to filter on.

The “-i” parameter specifies the network interface that you want to listen on. The “tcpdump” tool has the following syntax: tcpdump -i If you want to filter packets that are coming in or going out on a specific port, you can use the “tcpdump” tool. Filter Packets with Specific Port in tcpdump For example, DHCP uses UDP ports 67 and 68, RIP uses UDP port 520, and HTTP uses TCP port 80.īoth Tcp and UDP use a pair of endpoints as their fundamental communication.We will take the following two protocols as examples. TCP and UDP can both multiplex using port numbers to work with multiple applications. TCP ports are used when you need to guarantee that the data will be received and processed successfully, while UDP ports are used when you don’t need to guarantee that the data will be received or processed successfully.Ĩ0 (HTTP), 443 (HTTPS), 25 (SMTP), 110 (POP3), 143 (IMAP) TCP ports are used for reliable communication, and UDP ports are used for unreliable communication. There are two types of ports: TCP and UDP. Each port is associated with a specific function or service, and each device on a network has to have a unique port number assigned to it. Our system uses ports to communicate with other devices on a network.

We will learn how to filter packets by port in tcpdump command.

It is very useful for various forms of network troubleshooting. Tcpdump is a CLI tool to capture raw network packets.

Tcpdump wireshark