tcpdump to a PCAP file: write, rotate and fix the usual errors

By default tcpdump prints one summary line per packet to the terminal, and a scrolling screen is not evidence you can hand over. Writing tcpdump to a PCAP file takes one flag, -w, and gives you a file that Wireshark, tshark or A-Packets can read later. The flag is the easy part. Choosing the interface, keeping each file under an upload limit and making sense of the error tcpdump prints when it refuses are where captures go wrong, so this guide covers those too. The commands work the same on Linux and macOS unless a step says otherwise.

Find the interface the traffic crosses

sudo tcpdump -D

-D lists the interfaces tcpdump can open, numbered, with flags such as Up, Running and Wireless. On a Linux server the one with the default route is usually eth0 or a name like ens160; ip route shows which. On a Mac, Wi-Fi is usually en0. Linux also offers -i any, which records every interface at once. The file then uses the Linux cooked format instead of Ethernet: tcpdump 4.99 reports it as LINUX_SLL2, A-Packets reads it, and each packet keeps one link-layer address, the sender's, instead of both MAC addresses. That loss matters only for layer-2 questions such as ARP spoofing, where you want a real Ethernet interface.

Write packets to a file, not the screen

sudo tcpdump -i eth0 -w capture.pcap

tcpdump answers with a line such as listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes and then stays quiet, because the packets go to the file. The snapshot length is the most it keeps of each packet, and on current versions that is the whole packet. Older releases cut packets short by default; on those, add -s 0. Stop with Ctrl+C. tcpdump then flushes its buffer, closes the file and prints three counters: packets captured, packets received by the filter and packets dropped by the kernel. Add -c 50000 to stop by itself after that many packets.

Keep only the traffic you need

sudo tcpdump -i eth0 -w web.pcap 'host 10.0.0.5 and port 443'
sudo tcpdump -i eth0 -w capture.pcap 'not port 22'

The expression at the end is a capture filter in BPF syntax, and anything it rejects is gone for good. The first command keeps one host's HTTPS traffic. The second keeps everything except SSH, which matters when you run tcpdump over an SSH session on the same interface: otherwise the file fills with the packets of your own terminal. When you are not sure what the question needs, capture wider and cut the file later; the guide on how to split a large PCAP shows the commands.

Rotate files under an upload limit

sudo tcpdump -i eth0 -C 20 -W 10 -w ring.pcap
sudo tcpdump -i eth0 -G 600 -w 'cap-%H%M%S.pcap'

-C 20 closes the file once it passes 20 million bytes and opens the next, so every part fits the 25 MB public upload limit. With -W 10 tcpdump keeps ten files named ring.pcap0 to ring.pcap9 and then overwrites the oldest, a ring buffer you can leave running until the fault comes back. Without -W the files are ring.pcap, ring.pcap1, ring.pcap2 and so on, until the disk fills. -G 600 starts a new file every ten minutes; the file name needs a time format, or each new file overwrites the last one.

Errors and what they mean

The messages above are what tcpdump 4.99.5 printed in our tests on Debian, with the file and interface names of those tests; macOS prints the same text for a wrong interface name. A truncated file is not lost: editcap capture.pcap repaired.pcap warns that the file was cut short and writes every complete packet to the new file, which then reads cleanly and uploads like any other.