Packet Capture & Analysis

tcpdump syntax and BPF expressions, Wireshark display filters, pcap format, and decoding protocol layers from a capture.

Overview

Overview Packet capture and analysis is a fundamental SRE and network engineering skill for diagnosing connectivity issues, performance problems, protocol errors, and security incidents that cannot be solved with higher-level metrics and logs alone. When an application reports "connection refused" or "timeout" and log analysis is inconclusive, packet-level inspection is often the only way to determine ground truth.

tcpdump is the standard command-line packet capture tool available on nearly every Linux system. It uses the libpcap library and supports Berkeley Packet Filter (BPF) expressions for efficient kernel-level packet filtering. BPF filtering happens in the kernel before packets are copied to userspace, making tcpdump efficient even on high-traffic interfaces. Understanding BPF syntax — filtering by host, port, protocol, direction, and combining expressions with and/or/not — is essential for targeted captures that don't overwhelm disk or memory.

Wireshark is the standard GUI analysis tool that processes pcap files captured by tcpdump or libpcap. Wireshark dissects protocol layers, reconstructs TCP streams, identifies retransmissions and out-of-order packets, decodes application-layer protocols, and provides powerful display filter syntax separate from capture filters. The combination of tcpdump for capture and Wireshark for offline analysis is the standard production workflow.

In cloud environments, traditional packet capture requires some adaptation. On AWS, VPC Traffic Mirroring mirrors ENI traffic to a network monitoring appliance. EC2 instances can run tcpdump directly on their interfaces. In Kubernetes, tcpdump can be run in a privileged pod or using tools like kubectl-sniff that inject a tcpdump sidecar. Understanding how encapsulation affects what you see in a capture — VXLAN outer headers, TLS encryption, VPN tunnels — is critical for correct interpretation.

Key concepts

BPF (Berkeley Packet Filter)
A kernel-level filtering mechanism that efficiently selects packets before copying them to userspace. BPF expressions filter by protocol (tcp, udp, icmp), host (src host, dst host), port (port, src port, dst port), network (net), and combine with and/or/not. BPF runs in the kernel, dramatically reducing CPU overhead compared to userspace filtering.
pcap File Format
The standard packet capture file format used by tcpdump, Wireshark, and virtually all network analysis tools. Contains a global header (magic number, snap length, link type) followed by packet records (timestamp, captured length, original length, raw packet bytes). Can be read offline by any pcap-compatible tool.
TCP Stream Reassembly
Wireshark reassembles TCP byte streams from individual packets, allowing analysis of complete application-layer exchanges (HTTP requests, SMTP conversations). Follow TCP Stream (right-click then Follow then TCP Stream) shows the complete bidirectional conversation. Essential for debugging application protocol issues where the payload spans multiple packets.
Wireshark Display Filters
Display filters in Wireshark are applied after capture and do not affect captured data. They are more expressive than BPF capture filters. Examples: ip.addr==10.0.0.1, tcp.port==443, http.response.code==500, dns.qry.name contains "example.com", tcp.flags.reset==1. Can be combined with and/or/not and parentheses.
Promiscuous Mode
Normally, a network interface only passes packets addressed to its own MAC address to the OS. Promiscuous mode configures the interface to capture all packets on the segment, including those destined for other hosts. Essential for capturing on a hub or port span/mirror. tcpdump enables promiscuous mode by default unless -p is specified.

When to use it

  • Diagnosing TCP connection failures, RST injections, or handshake issues
  • Verifying TLS certificate negotiation and cipher suite selection
  • Identifying dropped packets, retransmissions, and TCP window size issues affecting throughput
  • Analyzing DNS query failures, NXDOMAIN responses, or resolution timing
  • Capturing traffic during a security incident for forensic analysis

Interview questions

  • Write tcpdump commands for the following capture scenarios: capturing HTTP traffic, capturing DNS queries, capturing only TCP RST packets, and capturing traffic to/from a specific host while excluding SSH.
  • How do you use Wireshark to analyze a TCP connection problem? Walk through diagnosing a scenario where connections complete the handshake but data transfer is slow.

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio