A tcpdump Tutorial with Examples

tcpdump is the world's premier network analysis tool—combining both power and simplicity into a single command-line interface. This guide will show you how to use it.

tcpdump is a powerful command-line packet analyzer. It allows you to capture and inspect network traffic in real-time. This tool is invaluable for network administrators, security professionals, and anyone who needs to understand network behavior.

In this tutorial, we'll explore 150 practical examples of using tcpdump. These examples will cover a wide range of use cases, from basic traffic capture to advanced filtering and analysis.

Basic Syntax ​

The basic syntax of tcpdump is:

tcpdump [options] [expression]

• options: Modify the behavior of tcpdump, such as specifying the interface to capture on or the output format.
• expression: Defines what kind of traffic to capture. This is where you specify hostnames, IP addresses, ports, protocols, and other criteria.

Capturing Traffic on an Interface ​

To capture all traffic on a specific interface, use the -i flag followed by the interface name. For example, to capture traffic on the eth0 interface:

tcpdump -i eth0

To see a list of all available interfaces, use the command:

tcpdump -D

Capturing Traffic to/from a Specific Host ​

To capture traffic to or from a specific host, use the host keyword followed by the hostname or IP address:

tcpdump host 192.168.1.100

This will capture all traffic to and from the host with the IP address 192.168.1.100.

Capturing Traffic on a Specific Port ​

To capture traffic on a specific port, use the port keyword followed by the port number:

tcpdump port 80

This will capture all traffic on port 80 (HTTP).

Combining Filters ​

You can combine filters using and, or, and not operators. For example, to capture all traffic to or from host 192.168.1.100 on port 80, use:

tcpdump host 192.168.1.100 and port 80

To capture traffic from 192.168.1.100 on either port 80 or 443, use:

tcpdump src host 192.168.1.100 and \( port 80 or port 443 \)

Advanced Filtering ​

Filtering by Protocol ​

To filter by protocol, use the ip, tcp, udp, or other protocol keywords. For example, to capture only TCP traffic:

tcpdump tcp

To capture only UDP traffic:

tcpdump udp

Filtering by Source or Destination ​

To filter by source or destination host or port, use the src or dst keywords:

tcpdump src host 192.168.1.100

This will capture all traffic from the host 192.168.1.100.

tcpdump dst port 443

This will capture all traffic destined for port 443.

Filtering by Network ​

To capture traffic within a specific network, use the net keyword:

tcpdump net 192.168.1.0/24

This will capture all traffic within the 192.168.1.0/24 network.

Saving Captured Traffic to a File ​

To save captured traffic to a file, use the -w flag followed by the filename:

tcpdump -w capture.pcap -i eth0

This will save all captured traffic on the eth0 interface to the file capture.pcap.

You can later analyze this file using tcpdump or another packet analyzer like Wireshark.

Reading Captured Traffic from a File ​

To read captured traffic from a file, use the -r flag followed by the filename:

tcpdump -r capture.pcap

This will read and display the traffic from the file capture.pcap.

Verbosity ​

You can control the verbosity of tcpdump output using the -v, -vv, or -vvv flags.

• -v: Verbose output.
• -vv: More verbose output.
• -vvv: Most verbose output.

For example:

tcpdump -vv -i eth0

150 tcpdump Examples ​

Here are 150 tcpdump examples to help you isolate traffic in various situations:

Basic Capture ​

1. Capture all traffic on interface eth0:
   bash

   tcpdump -i eth0

   1
   
2. Capture all traffic on interface wlan0:
   bash

   tcpdump -i wlan0

   1
   
3. Capture all traffic on all interfaces:
   bash

   tcpdump -i any

   1
   
4. Capture only the first 100 packets:
   bash

   tcpdump -c 100

   1
   
5. List all available capture interfaces:
   bash

   tcpdump -D

   1
   

Output Formatting ​

6. Don't resolve hostnames:
   bash

   tcpdump -n -i eth0

   1
   
7. Don't resolve hostnames or port names:
   bash

   tcpdump -nn -i eth0

   1
   
8. Show packet contents in ASCII:
   bash

   tcpdump -A -i eth0

   1
   
9. Show packet contents in hex and ASCII:
   bash

   tcpdump -X -i eth0

   1
   
10. Show human-readable timestamps:
    bash

    tcpdump -tttt -i eth0

    1
    
11. Increase verbosity:
    bash

    tcpdump -v -i eth0

    1
    
12. Maximum verbosity:
    bash

    tcpdump -vvv -i eth0

    1
    
13. Capture full packets (no truncation):
    bash

    tcpdump -s 0 -i eth0

    1
    
14. Line-buffered output (useful for piping):
    bash

    tcpdump -l -i eth0 | tee capture.txt

    1
    

Host Filters ​

15. Capture traffic to or from a specific IP:
    bash

    tcpdump host 192.168.1.100

    1
    
16. Capture traffic to or from a hostname:
    bash

    tcpdump host example.com

    1
    
17. Capture traffic from a specific source host:
    bash

    tcpdump src host 192.168.1.100

    1
    
18. Capture traffic to a specific destination host:
    bash

    tcpdump dst host 192.168.1.100

    1
    
19. Capture traffic between two specific hosts:
    bash

    tcpdump host 192.168.1.100 and host 192.168.1.200

    1
    

Port Filters ​

20. Capture traffic on port 80 (HTTP):
    bash

    tcpdump port 80

    1
    
21. Capture traffic on port 443 (HTTPS):
    bash

    tcpdump port 443

    1
    
22. Capture traffic on port 22 (SSH):
    bash

    tcpdump port 22

    1
    
23. Capture traffic on port 53 (DNS):
    bash

    tcpdump port 53

    1
    
24. Capture traffic on port 25 (SMTP):
    bash

    tcpdump port 25

    1
    
25. Capture traffic on port 21 (FTP):
    bash

    tcpdump port 21

    1
    
26. Capture traffic from a specific source port:
    bash

    tcpdump src port 80

    1
    
27. Capture traffic to a specific destination port:
    bash

    tcpdump dst port 443

    1
    
28. Capture traffic on a range of ports:
    bash

    tcpdump portrange 8000-9000

    1
    

Protocol Filters ​

29. Capture all TCP traffic:
    bash

    tcpdump tcp

    1
    
30. Capture all UDP traffic:
    bash

    tcpdump udp

    1
    
31. Capture all ICMP traffic:
    bash

    tcpdump icmp

    1
    
32. Capture all ARP traffic:
    bash

    tcpdump arp

    1
    
33. Capture all IPv6 traffic:
    bash

    tcpdump ip6

    1
    

Network Filters ​

34. Capture traffic to or from a network:
    bash

    tcpdump net 192.168.1.0/24

    1
    
35. Capture traffic from a specific network:
    bash

    tcpdump src net 192.168.1.0/24

    1
    
36. Capture traffic to a specific network:
    bash

    tcpdump dst net 192.168.1.0/24

    1
    

Combination Filters ​

37. Capture traffic to a host on a specific port:
    bash

    tcpdump dst host 192.168.1.100 and dst port 80

    1
    
38. Capture traffic from a host on a specific port:
    bash

    tcpdump src host 192.168.1.100 and src port 443

    1
    
39. Capture traffic to or from a host on port 80 or 443:
    bash

    tcpdump host 192.168.1.100 and \( port 80 or port 443 \)

    1
    
40. Capture all traffic except ICMP:
    bash

    tcpdump not icmp

    1
    
41. Capture all traffic except SSH (port 22):
    bash

    tcpdump not port 22

    1
    
42. Exclude your own SSH session while capturing:
    bash

    tcpdump -i eth0 not \( src host 192.168.1.50 and dst port 22 \)

    1
    
43. Capture HTTP or HTTPS traffic:
    bash

    tcpdump port 80 or port 443

    1
    
44. Capture non-HTTP and non-HTTPS traffic:
    bash

    tcpdump not port 80 and not port 443

    1
    

TCP Flag Filters ​

45. Capture TCP SYN packets:
    bash

    tcpdump 'tcp[tcpflags] & tcp-syn != 0'

    1
    
46. Capture TCP ACK packets:
    bash

    tcpdump 'tcp[tcpflags] & tcp-ack != 0'

    1
    
47. Capture TCP RST packets:
    bash

    tcpdump 'tcp[tcpflags] & tcp-rst != 0'

    1
    
48. Capture TCP FIN packets:
    bash

    tcpdump 'tcp[tcpflags] & tcp-fin != 0'

    1
    
49. Capture TCP URG packets:
    bash

    tcpdump 'tcp[tcpflags] & tcp-urg != 0'

    1
    
50. Capture TCP PSH packets:
    bash

    tcpdump 'tcp[tcpflags] & tcp-push != 0'

    1
    
51. Capture SYN-only packets (new connection attempts):
    bash

    tcpdump 'tcp[tcpflags] = tcp-syn'

    1
    
52. Capture SYN/ACK packets (connection accepted):
    bash

    tcpdump 'tcp[tcpflags] = 0x12'

    1
    
53. Capture RST/ACK packets (connection refused or reset):
    bash

    tcpdump 'tcp[tcpflags] = 0x14'

    1
    
54. Capture FIN/ACK packets (connection closing):
    bash

    tcpdump 'tcp[tcpflags] = 0x11'

    1
    
55. Capture PSH/ACK packets (data transfer):
    bash

    tcpdump 'tcp[tcpflags] = 0x18'

    1
    
56. Capture null scan packets (no flags set):
    bash

    tcpdump 'tcp[tcpflags] = 0x00'

    1
    
57. Capture Xmas tree scan packets (FIN+PSH+URG):
    bash

    tcpdump 'tcp[tcpflags] & 0x29 = 0x29'

    1
    

Saving and Reading Captures ​

58. Write captured traffic to a file:
    bash

    tcpdump -w capture.pcap -i eth0

    1
    
59. Read captured traffic from a file:
    bash

    tcpdump -r capture.pcap

    1
    
60. Read from a file with a filter applied:
    bash

    tcpdump -r capture.pcap tcp port 80

    1
    
61. Rotate capture files every 100MB:
    bash

    tcpdump -w capture.pcap -C 100 -i eth0

    1
    
62. Rotate capture files every hour:
    bash

    tcpdump -w capture-%Y%m%d%H%M%S.pcap -G 3600 -i eth0

    1
    
63. Keep only the last 10 rotated capture files:
    bash

    tcpdump -w capture.pcap -C 100 -W 10 -i eth0

    1
    

IP Header Filters ​

64. Capture IP fragments:
    bash

    tcpdump 'ip[6:2] & 0x1fff != 0'

    1
    
65. Capture packets with TTL of 128 (typical Windows default):
    bash

    tcpdump 'ip[8] = 128'

    1
    
66. Capture packets with TTL of 64 (typical Linux default):
    bash

    tcpdump 'ip[8] = 64'

    1
    
67. Capture packets with DSCP value EF (46):
    bash

    tcpdump 'ip[1] & 0xfc = 0xb8'

    1
    
68. Capture packets with ECN Congestion Experienced:
    bash

    tcpdump 'ip[1] & 0x03 = 3'

    1
    
69. Capture packets larger than 500 bytes:
    bash

    tcpdump greater 500

    1
    
70. Capture packets smaller than 100 bytes:
    bash

    tcpdump less 100

    1
    

Payload and Content Inspection ​

71. Capture HTTP GET requests:
    bash

    tcpdump -s 0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

    1
    
72. Capture HTTP POST requests:
    bash

    tcpdump -s 0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

    1
    
73. Capture DNS query traffic:
    bash

    tcpdump -n 'udp dst port 53'

    1
    
74. Capture DHCP discover and request packets:
    bash

    tcpdump -n 'udp port 67 or udp port 68'

    1
    
75. Capture TLS Client Hello packets (new HTTPS connections):
    bash

    tcpdump 'tcp port 443 and tcp[((tcp[12:1] & 0xf0) >> 2)] = 0x16 and tcp[((tcp[12:1] & 0xf0) >> 2)+5] = 0x01'

    1
    

Security Engineer Use Cases ​

76. Capture cleartext FTP credentials:
    bash

    tcpdump -nn -A -i eth0 'port 21'

    1
    
77. Capture HTTP Basic Authentication headers:
    bash

    tcpdump -nn -A -s 0 -i eth0 'tcp dst port 80'

    1
    
78. Capture cleartext SMTP authentication:
    bash

    tcpdump -nn -A -i eth0 'tcp port 25 or tcp port 587'

    1
    
79. Capture cleartext POP3/IMAP credentials:
    bash

    tcpdump -nn -A -i eth0 'tcp port 110 or tcp port 143'

    1
    
80. Detect ARP spoofing (excessive ARP replies):
    bash

    tcpdump -nn -e -i eth0 'arp[6:2] = 2'

    1
    
81. Identify DNS exfiltration (unusually large DNS packets):
    bash

    tcpdump -nn -i eth0 'udp port 53 and greater 512'

    1
    
82. Detect DNS tunnel responses (oversized replies):
    bash

    tcpdump -nn -i eth0 'udp src port 53 and greater 300'

    1
    
83. Detect rogue DHCP servers:
    bash

    tcpdump -nn -e -i eth0 'udp src port 67'

    1
    
84. Detect brute force attacks on authentication services:
    bash

    tcpdump -nn -i eth0 'tcp[tcpflags] = tcp-syn and (dst port 22 or dst port 3389 or dst port 445)'

    1
    
85. Capture SSH connection attempts with timestamps:
    bash

    tcpdump -nn -tttt -i eth0 'tcp dst port 22 and tcp[tcpflags] = tcp-syn' -c 200

    1
    
86. Capture LDAP authentication traffic:
    bash

    tcpdump -nn -A -i eth0 'tcp port 389 or tcp port 636'

    1
    
87. Capture Kerberos authentication traffic:
    bash

    tcpdump -nn -i eth0 'tcp port 88 or udp port 88'

    1
    
88. Detect cleartext Telnet sessions:
    bash

    tcpdump -nn -A -i eth0 'tcp port 23'

    1
    
89. Capture TLS handshake records for certificate analysis:
    bash

    tcpdump -nn -s 0 -w tls-handshakes.pcap -i eth0 'tcp port 443 and (tcp[((tcp[12:1] & 0xf0) >> 2)] = 0x16)'

    1
    
90. Spot VLAN tagging anomalies:
    bash

    tcpdump -nn -e -i eth0 'vlan'

    1
    
91. Monitor outbound connections to non-standard ports:
    bash

    tcpdump -nn -i eth0 'tcp[tcpflags] = tcp-syn and dst portrange 1-1023 and not (dst port 80 or dst port 443 or dst port 22 or dst port 53 or dst port 25)'

    1
    
92. Detect unauthorized external DNS usage:
    bash

    tcpdump -nn -i eth0 'udp dst port 53 and not dst host 10.0.0.1'

    1
    
93. Detect lateral movement via SMB:
    bash

    tcpdump -nn -i eth0 'tcp dst port 445 and src net 10.0.0.0/8 and dst net 10.0.0.0/8'

    1
    
94. Detect lateral movement via WinRM:
    bash

    tcpdump -nn -i eth0 'tcp dst port 5985 or tcp dst port 5986'

    1
    
95. Detect lateral movement via RDP between internal hosts:
    bash

    tcpdump -nn -i eth0 'tcp dst port 3389 and src net 192.168.0.0/16 and dst net 192.168.0.0/16'

    1
    

Security Red Team / Blue Team Operations ​

96. Detect outbound reverse shell connections:
    bash

    tcpdump -nn -i eth0 'tcp[tcpflags] = tcp-syn and (dst port 4444 or dst port 1234 or dst port 5555 or dst port 9001)'

    1
    
97. Find C2 beaconing patterns (periodic HTTPS connections):
    bash

    tcpdump -nn -tttt -i eth0 'tcp dst port 443 and tcp[tcpflags] = tcp-syn' -c 500

    1
    
98. Detect ICMP tunneling (oversized ping packets):
    bash

    tcpdump -nn -i eth0 'icmp and greater 100'

    1
    
99. Detect DNS over HTTPS (DoH) bypassing corporate DNS:
    bash

    tcpdump -nn -i eth0 'tcp dst port 443 and (dst host 1.1.1.1 or dst host 8.8.8.8 or dst host 8.8.4.4 or dst host 9.9.9.9)'

    1
    
100. Find unauthorized OpenVPN tunnels:
     bash

     tcpdump -nn -i eth0 'udp port 1194 or tcp port 1194'

     1
     
101. Find unauthorized WireGuard tunnels:
     bash

     tcpdump -nn -i eth0 'udp port 51820'

     1
     
102. Detect cryptocurrency mining traffic (Stratum protocol):
     bash

     tcpdump -nn -i eth0 'tcp dst port 3333 or tcp dst port 8333 or tcp dst port 9999'

     1
     
103. Monitor for NTLM credential theft over SMB:
     bash

     tcpdump -nn -s 0 -w ntlm-traffic.pcap -i eth0 'tcp port 445 or tcp port 139'

     1
     
104. Detect data exfiltration (large outbound packets):
     bash

     tcpdump -nn -i eth0 'src net 10.0.0.0/8 and not dst net 10.0.0.0/8 and greater 1000'

     1
     
105. Monitor for unauthorized SOCKS proxy usage:
     bash

     tcpdump -nn -i eth0 'tcp dst port 1080'

     1
     
106. Detect ICMP ping sweep (host enumeration):
     bash

     tcpdump -nn -i eth0 'icmp[0] = 8' -c 500

     1
     
107. Detect C2 traffic to a specific suspected host:
     bash

     tcpdump -nn -tttt -i eth0 'tcp dst port 443 and tcp[tcpflags] = tcp-syn and dst host 192.0.2.100'

     1
     
108. Monitor for LDAP enumeration (Active Directory recon):
     bash

     tcpdump -nn -i eth0 'tcp dst port 389' -c 1000

     1
     
109. Detect PowerShell remoting via WinRM:
     bash

     tcpdump -nn -A -s 0 -i eth0 'tcp dst port 5985'

     1
     
110. Capture DNS traffic for C2 frequency analysis:
     bash

     tcpdump -nn -i eth0 'udp port 53' -c 5000 -w dns-baseline.pcap

     1
     
111. Detect HTTP tunneling (non-browser traffic):
     bash

     tcpdump -nn -A -s 0 -i eth0 'tcp dst port 80 and src host 10.0.1.50'

     1
     
112. Hunt for exfiltration via ICMP payload data:
     bash

     tcpdump -nn -X -i eth0 'icmp[0] = 8 and greater 64'

     1
     
113. Detect port knocking sequences:
     bash

     tcpdump -nn -tttt -i eth0 'tcp[tcpflags] = tcp-syn and dst host 10.0.1.100'

     1
     
114. Monitor for DNS rebinding attack responses:
     bash

     tcpdump -nn -v -i eth0 'udp src port 53' -c 200

     1
     
115. Capture covert channel traffic over permitted DNS:
     bash

     tcpdump -nn -i eth0 'udp dst port 53 and src host 10.0.1.50' -c 1000

     1
     

Security Incident Response Team Operations ​

116. Full packet capture from a compromised host:
     bash

     tcpdump -nn -s 0 -w evidence-$(date +%Y%m%d-%H%M%S).pcap -i eth0 'host 10.0.1.50'

     1
     
117. Time-windowed capture for incident timeline:
     bash

     tcpdump -nn -s 0 -G 300 -w incident-%Y%m%d-%H%M%S.pcap -i eth0 'host 10.0.1.50'

     1
     
118. Quick-triage packet capture with count limit:
     bash

     tcpdump -nn -s 0 -c 10000 -w triage.pcap -i eth0 'host 10.0.1.50'

     1
     
119. Capture HTTP response payloads for malware analysis:
     bash

     tcpdump -nn -s 0 -A -i eth0 'tcp src port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

     1
     
120. Log all DNS queries for IOC matching:
     bash

     tcpdump -nn -i eth0 'udp dst port 53' -l | tee dns-queries.log

     1
     
121. Capture traffic to known malicious IPs:
     bash

     tcpdump -nn -s 0 -w malicious.pcap -i eth0 'host 203.0.113.10 or host 198.51.100.20 or host 192.0.2.30'

     1
     
122. Capture only new TCP connections during an incident:
     bash

     tcpdump -nn -tttt -i eth0 'tcp[tcpflags] = tcp-syn'

     1
     
123. Long-running evidence capture with size rotation:
     bash

     tcpdump -nn -s 0 -C 100 -W 50 -w evidence.pcap -i eth0 'host 10.0.1.50'

     1
     
124. Capture ICMP error messages during an incident:
     bash

     tcpdump -nn -v -i eth0 'icmp[0] = 3 or icmp[0] = 11'

     1
     
125. Monitor for data exfiltration over email:
     bash

     tcpdump -nn -A -s 0 -i eth0 'tcp dst port 25 or tcp dst port 587 or tcp dst port 465'

     1
     
126. Ring-fence a compromised subnet:
     bash

     tcpdump -nn -s 0 -w subnet-capture.pcap -i eth0 'net 10.0.1.0/24'

     1
     
127. Detect internal scanning from a compromised host:
     bash

     tcpdump -nn -i eth0 'tcp[tcpflags] = tcp-syn and src host 10.0.1.50 and dst net 10.0.0.0/8'

     1
     
128. Capture evidence of internal data staging:
     bash

     tcpdump -nn -i eth0 'src host 10.0.1.50 and dst net 10.0.0.0/8 and greater 1000'

     1
     
129. Time-limited capture for legal evidence hold:
     bash

     timeout 3600 tcpdump -nn -s 0 -w legal-hold-$(date +%Y%m%d).pcap -i eth0 'host 10.0.1.50'

     1
     
130. Capture outbound traffic excluding known-good destinations:
     bash

     tcpdump -nn -i eth0 'src net 10.0.0.0/8 and not dst net 10.0.0.0/8 and not (dst port 80 or dst port 443 or dst port 53)'

     1
     

Network Engineer / SysAdmin Use Cases ​

131. Monitor TCP zero window events (flow control problems):
     bash

     tcpdump -nn -i eth0 'tcp[14:2] = 0 and tcp[tcpflags] & tcp-ack != 0'

     1
     
132. Detect ICMP "need to fragment" messages (MTU issues):
     bash

     tcpdump -nn -v -i eth0 'icmp[0] = 3 and icmp[1] = 4'

     1
     
133. Capture packets with Don't Fragment bit set:
     bash

     tcpdump -nn -i eth0 'ip[6] & 0x40 != 0'

     1
     
134. Monitor BGP sessions:
     bash

     tcpdump -nn -i eth0 'tcp port 179'

     1
     
135. Check NTP synchronization traffic:
     bash

     tcpdump -nn -i eth0 'udp port 123'

     1
     
136. Debug DHCP lease problems (full handshake):
     bash

     tcpdump -nn -e -vv -i eth0 'udp port 67 or udp port 68'

     1
     
137. Monitor VRRP failover traffic:
     bash

     tcpdump -nn -i eth0 'ip proto 112'

     1
     
138. Monitor HSRP failover traffic:
     bash

     tcpdump -nn -i eth0 'udp dst port 1985'

     1
     
139. Capture SNMP trap notifications:
     bash

     tcpdump -nn -i eth0 'udp port 162'

     1
     
140. Detect duplicate IP addresses via ARP:
     bash

     tcpdump -nn -e -i eth0 'arp'

     1
     
141. Troubleshoot DNS resolution failures:
     bash

     tcpdump -nn -v -i eth0 'udp port 53'

     1
     
142. Capture SIP/VoIP signaling traffic:
     bash

     tcpdump -nn -A -s 0 -i eth0 'tcp port 5060 or udp port 5060'

     1
     
143. Capture RTP voice/video streams:
     bash

     tcpdump -nn -i eth0 'udp portrange 16384-32767'

     1
     
144. Monitor RADIUS authentication:
     bash

     tcpdump -nn -i eth0 'udp port 1812 or udp port 1813'

     1
     
145. Monitor TACACS+ authentication:
     bash

     tcpdump -nn -i eth0 'tcp port 49'

     1
     
146. Check GRE tunnel traffic:
     bash

     tcpdump -nn -i eth0 'ip proto 47'

     1
     
147. Debug OSPF neighbor issues:
     bash

     tcpdump -nn -i eth0 'ip proto 89'

     1
     
148. Monitor EIGRP routing updates:
     bash

     tcpdump -nn -i eth0 'ip proto 88'

     1
     
149. Capture multicast traffic:
     bash

     tcpdump -nn -i eth0 'dst net 224.0.0.0/4'

     1
     
150. Verify QoS/DSCP markings on traffic:
     bash

     tcpdump -nn -v -i eth0 'ip[1] & 0xfc != 0'

     1
     

These examples should provide a solid foundation for using tcpdump to analyze network traffic.

Happy hunting!

-Daniel