tcpdump and Wireshark CLI Packet Analysis Cheat Sheet

Updated 2026-05-21

🧠Study flashcards on this topic107 cards · spaced repetition→

tcpdump and Wireshark are the two dominant packet analysis tools in networking and security work. tcpdump (v5.0, powered by libpcap) is a lightweight CLI sniffer using Berkeley Packet Filter (BPF) syntax for capture filters. tshark is Wireshark's headless CLI counterpart and supports both BPF capture filters and Wireshark's rich display filter language. Together they cover everything from quick triage on remote servers to deep forensic analysis of pcap files. This cheat sheet covers basic capture, BPF filters, file I/O, tshark output formats, display filters, TLS decryption, remote capture, statistics, profiles, expert info, export objects, and tool selection guidance — ordered from foundational to advanced.

What This Cheat Sheet Covers

This topic spans 17 focused tables and 219 indexed concepts, 107 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: tcpdump Basic Capture SyntaxTable 2: tcpdump Output and Display OptionsTable 3: BPF Capture Filter PrimitivesTable 4: BPF Boolean Logic and Advanced ExpressionsTable 5: tcpdump File I/O and Ring BufferTable 6: Common Protocol Capture FiltersTable 7: tshark Capture and Basic OptionsTable 8: tshark Output Formats and Field ExtractionTable 9: Wireshark and tshark Display Filter LanguageTable 10: tshark Statistics (-z option)Table 11: TLS DecryptionTable 12: Remote Capture via SSH PipeTable 13: Export Objects and Stream FollowingTable 14: Wireshark Expert Info and Protocol HierarchyTable 15: Wireshark Configuration ProfilesTable 16: Companion Tools (editcap, mergecap, capinfos, dumpcap)Table 17: Performance and Tool Selection

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: tcpdump Basic Capture Syntax

The flags that get you sniffing in the first place — picking an interface, capping how many packets you grab, and turning off the slow DNS and port-name lookups that otherwise stall the output. Reach for -nn and a packet count almost every time you run tcpdump for a quick look.

Concept	Example	Description
Capture on specific interface	`tcpdump -i eth0`	• Sniff on interface eth0 • use `any` to capture on all interfaces
List available interfaces	`tcpdump -D`	Print numbered list of interfaces available for capture
Limit packet count	`tcpdump -i eth0 -c 100`	Stop capture after receiving 100 packets
Suppress DNS and port resolution	`tcpdump -nn`	• `-n` skips hostname lookup • `-nn` also skips port name lookup
Verbose output levels	`tcpdump -v` / `-vv` / `-vvv`	• Each level adds more decoded fields • `-vvv` shows maximum detail
Quiet / summary mode	`tcpdump -q`	Print less protocol information per line
Run as non-root user	`tcpdump -Z tcpdumpuser`	Drop privileges to specified user after opening capture interface
Print absolute TCP sequence numbers	`tcpdump -S`	Show raw sequence numbers instead of relative ones
Capture in promiscuous mode off	`tcpdump -p`	• Disable promiscuous mode • only capture frames sent to this host
Monitor mode (802.11)	`tcpdump -I -i wlan0`	Enable monitor mode on wireless interface (requires driver support)
Specify data link type	`tcpdump -y EN10MB -i eth0`	• Force capture with specified data link type • list with `-L`
Set buffer size	`tcpdump -B 4096 -i eth0`	Set OS capture buffer size in KiB to reduce drops
Immediate mode (unbuffered)	`tcpdump -l -i eth0`	• Flush stdout after each packet • useful for piping to grep live
Print packet count on exit	`tcpdump --print-data-length`	(use `-q` and examine stderr) — tcpdump prints stats to stderr on exit

Table 2: tcpdump Output and Display Options

Once packets are flowing, these options decide how much of each one you actually see — from a terse one-liner to the full hex-and-ASCII dump of the payload. The timestamp variants matter more than they look: -tttt gives you wall-clock dates for correlating against logs, while -ttt shows the gap between packets when you're chasing latency.

Concept	Example	Description
ASCII payload display	`tcpdump -A -i eth0`	• Print each packet in ASCII • useful for HTTP/plain-text protocols

The rest of this section is part of the full cheat sheet

Table 3: BPF Capture Filter Primitives

BPF primitives are the building blocks of every capture filter — the bare nouns like host, net, port, and proto that say which packets the kernel should even hand to tcpdump. Because the filter runs before capture, getting these right keeps your pcaps small and your dropped-packet count low.

Concept	Example	Description
Filter by host	`host 192.168.1.1`	Match packets where source or destination IP is 192.168.1.1

The rest of this section is part of the full cheat sheet

Table 4: BPF Boolean Logic and Advanced Expressions

Chain the primitives together with and, or, and not, group them with parentheses, and — when you need surgical precision — reach down into raw header bytes. The byte-offset accessors and named TCP flags here are how you isolate things like bare SYN packets or HTTP GET requests that no simple port filter could pin down.

Concept	Example	Description
AND combinator	`host 10.0.0.1 and port 80`	• Both conditions must be true • `and` and `&&` are equivalent

The rest of this section is part of the full cheat sheet

Table 1: tcpdump Basic Capture Syntax

Concept	Example	Description
Capture on specific interface	`tcpdump -i eth0`	• Sniff on interface eth0 • use `any` to capture on all interfaces
List available interfaces	`tcpdump -D`	Print numbered list of interfaces available for capture
Limit packet count	`tcpdump -i eth0 -c 100`	Stop capture after receiving 100 packets
Suppress DNS and port resolution	`tcpdump -nn`	• `-n` skips hostname lookup • `-nn` also skips port name lookup
Verbose output levels	`tcpdump -v` / `-vv` / `-vvv`	• Each level adds more decoded fields • `-vvv` shows maximum detail
Quiet / summary mode	`tcpdump -q`	Print less protocol information per line
Run as non-root user	`tcpdump -Z tcpdumpuser`	Drop privileges to specified user after opening capture interface
Print absolute TCP sequence numbers	`tcpdump -S`	Show raw sequence numbers instead of relative ones
Capture in promiscuous mode off	`tcpdump -p`	• Disable promiscuous mode • only capture frames sent to this host
Monitor mode (802.11)	`tcpdump -I -i wlan0`	Enable monitor mode on wireless interface (requires driver support)
Specify data link type	`tcpdump -y EN10MB -i eth0`	• Force capture with specified data link type • list with `-L`
Set buffer size	`tcpdump -B 4096 -i eth0`	Set OS capture buffer size in KiB to reduce drops
Immediate mode (unbuffered)	`tcpdump -l -i eth0`	• Flush stdout after each packet • useful for piping to grep live
Print packet count on exit	`tcpdump --print-data-length`	(use `-q` and examine stderr) — tcpdump prints stats to stderr on exit

Table 2: tcpdump Output and Display Options

Concept	Example	Description
ASCII payload display	`tcpdump -A -i eth0`	• Print each packet in ASCII • useful for HTTP/plain-text protocols

Table 3: BPF Capture Filter Primitives

Concept	Example	Description
Filter by host	`host 192.168.1.1`	Match packets where source or destination IP is 192.168.1.1

Table 4: BPF Boolean Logic and Advanced Expressions

Concept	Example	Description
AND combinator	`host 10.0.0.1 and port 80`	• Both conditions must be true • `and` and `&&` are equivalent