$ sudo yum install tcpdump CENT OS and REDHAT

$ dnf install tcpdump Fedora

Installation Commands
#apt-get install tcpdump Ubuntu, Debian and Linux Mint

Capture from all interfaces tcpdump -i any -i any

Capture from specific interface ( Ex Eth0) tcpdump -i eth0 -i eth0

Capture first 10 packets and exit tcpdump -i eth0 -c 10 -c

Show available interfaces tcpdump -D -D

Print in ASCII tcpdump -i eth0 -A -A

To save capture to a file tcpdump -i eth0 -w tcpdump.txt -w

Read and analyze saved capture file tcpdump -r tcpdump.txt -r

Do not resolve host names tcpdump -n -I eth0 -n

Stop Domain name translation and lookups (Host names or port names ) tcpdump -n -i eth0 -nn

Capture TCP packets only tcpdump -i eth0 -c 10 -w tcpdump.pcap tcp tcp

Capture traffic from a defined port only tcpdump -i eth0 port 80 port
Main Topic
Capture packets from specific host cpdump host 192.168.1.100 host

Capture files from network subnet tcpdump net 10.1.1.0/16 net

tcp-urg
Capture from a specific source address tcpdump src 10.1.1.100 src
Packet Capturing Options tcp-rst
Capture from a specific destination address tcpdump dst 10.1.1.100 dst
tcp-ack
Filter traffic based on a port number for a service tcpdump http
TCP Flags tcp-syn
Filter traffic based on a service tcpdump port 80
tcp-psh
Filter based on port range tcpdump portrange 21-125 portrange
tcp-fin
http Display entire packet tcpdump -S -S

Show only IPV6 packets tcpdunp -IPV6 ipv6 icmp-echoreply

display human readable form in standard output tcpdump -d tcpdump.pcap -d icmp-routeradvert
Use the given file as input for filter tcpdump -F tcpdump.pcap -F icmp-tstampreply
set interface as monitor mode tcpdump -I eth0 -I icmp-unreach
Display data link types for the interface tcpdump -L -L Command Line Options icmp-routersolicit
tcpdump.pcap not printing domian names tcpdump -N -N icmp-ireq
Do not verify checksum tcpdump -K tcpdump.pcap -K icmp-sourcequench
Not capturing in promiscuous mode tcpdump -p -i eth0 -p Tcpdump icmp-timxceed
ICMP Types
Quite and less verbose mode display less details -q icmp-ireqreply
Do not print time stamp details in dump -t icmp-redirect
Little verbose output -v icmp-paramprob
More verbose output -vv icmp-maskreq
Most verbose output -vvv icmp-echo
Print data and headers in HEX format -x icmp-tstamp
Display / Output Options
Print data with link headers in HEX format -xx icmp-maskreply
Print output in HEX and ASCII format excluding link headers -X

Print output in HEX and ASCII format including link headers -XX [src|dst] host <host> Matches a host as the IP source, destination, or either

Print Link (Ethernet) headers -e ether [src|dst] host <ehost> Matches a host as the Ethernet source, destination, or either

Print sequence numbers in exact format -S gateway host <host> Matches packets which used host as a gateway

[src|dst] net <network>/<len> Matches packets to or from an endpoint residing in network

Ether [tcp|udp] [src|dst] port <port> Matches TCP or UDP packets sent to/from port
fddi [tcp|udp] [src|dst] portrange <p1>-<p2> Matches TCP or UDP packets to/from a port in the given range
icmp (ether | ip | ip6) proto <protocol> Matches an Ethernet, IPv4, or IPv6 protocol
Capture Filter Primitives
ip (ether | ip) broadcast Matches Ethernet or IPv4 broadcasts
ip6 (ether|ip|ip6) multicast Matches Ethernet, IPv4, or IPv6 multicasts
ppp type (mgt|ctl|data) [subtype <subtype>] Matches 802.11 frames based on type and optional subtype
radio Protocols vlan [<vlan>] Matches 802.1Q frames, optionally with a VLAN ID of vlan
rarp mpls [<label>] Matches MPLS packets, optionally with a label of label
slip Matches packets by an arbitrary expression
@hackinarticles
tcp

udp https://github.com/Ignitetechnologies
wlan

https://in.linkedin.com/company/hackingarticles
Combine filtering options tcpdump -n src 192.168.1.1 and dst port 21 AND and, &&

Either of the condition can match tcpdump dst 10.1.1.1 && !icmp OR or, ||

Negation of the condition tcpdump dst 10.1.1.1 and not icmp EXCEPT not, !
Logical Operators
Shows packets size less than 32 tcpdump <32 LESS <

Shows packets size greater than 32 tcpdump >32 GREATER >