Tcpdump: Filter Packets By Port

Tcpdump is a CLI tool to capture raw network packets. It is very useful for various forms of network troubleshooting. We will learn how to filter packets by port in tcpdump command.

TCP and UDP Ports

Our system uses ports to communicate with other devices on a network. Each port is associated with a specific function or service, and each device on a network has to have a unique port number assigned to it.

There are two types of ports: TCP and UDP. TCP ports are used for reliable communication, and UDP ports are used for unreliable communication.

TCP ports are used when you need to guarantee that the data will be received and processed successfully, while UDP ports are used when you don’t need to guarantee that the data will be received or processed successfully.

TCP and UDP can both multiplex using port numbers to work with multiple applications. For example, DHCP uses UDP ports 67 and 68, RIP uses UDP port 520, and HTTP uses TCP port 80.

Both Tcp and UDP use a pair of endpoints as their fundamental communication.We will take the following two protocols as examples.

(128.2.254.139, 1184) <=> (128.10.2.3, 53) UDP
(128.2.254.139, 2012) <=> (128.10.2.4, 22) TCP

53 is the default port for DNS. 22 is the default port for SSH.

Filter Packets with Specific Port in tcpdump

If you want to filter packets that are coming in or going out on a specific port, you can use the “tcpdump” tool. The “tcpdump” tool has the following syntax:

tcpdump -i <interface> [port <port>]

The “-i” parameter specifies the network interface that you want to listen on. The “port” parameter specifies the port number that you want to filter on.

Here’s an example:

tcpdump -i eth0 port 80

This command will capture all of the packets that are traveling through interface eth0 (the first Ethernet interface) and  for port 80 (the HTTP port).

If we need to filter packets for the first connection above, we can use the following ways.

• tcpdump -i interface port 1184
• tcpdump -i interface port 53

Filter Packets with source port or destination port in tcpdump

The “port” parameter in tcpdump specifies the port number that you want to filter on. The “src” parameter specifies the source , and the “dst” parameter specifies the destination.

Here’s an example:

tcpdump -i eth0 dst port 80

This command will capture all of the packets that are traveling through interface eth0 and the destined port is 80.

To be more specific, we can add the port direction like this.( dst = destination, src = source)

• tcpdump -i interface dst port 53
• tcpdump -i interface src port 1184
• tcpdump -i interface src port 1184 and dst port 53

Filter Packets with Host and Port in tcpdump

The “host” parameter in tcpdump specifies the hostname or IP address that you want to filter on.

Here’s an example:

tcpdump -i eth0 port 80 and src 192.168.0.100 and dst host www.howtouselinux.com

This command will capture all of the packets that are traveling through interface eth0 (the first Ethernet interface), that have a source IP address of 192.168.0.100, and that are destined for port 80 on the host www.howtouselinux.com

If we need to filter packets for both two connections, we can use the following commands.

• tcpdump -i interface dst host 128.10.2.3 or dst host 128.10.2.4
• tcpdump -i interface dst port 53 or dst port 22
• tcpdump -i interface dst port 53 and dst host 128.10.2.3

Filter Packets with TCP UDP Port in tcpdump

The “udp” parameter in tcpdump specifies that we want to capture packets that are using the UDP protocol.

Here’s an example:

tcpdump -i eth0  udp port 53

This command will capture all of the packets that are traveling through interface eth0 (the first Ethernet interface) and that are using the UDP protocol.

If we want to filter the packets at the beginning of this article, we can use this command.

tcpdump -i interface dst port 53 and udp

For the second example, we can use this.

tcpdump -i interface dst port 22 and tcp

Filter Packets with Port Range in tcpdump

If you want to capture packets that are traveling to or from a specific port range, you can use the “portrange” parameter in tcpdump. The “portrange” parameter allows you to specify a range of port numbers, instead of just a single port number.

Here’s an example:

tcpdump -i eth0 portrange 22-25

It will capture all of the packets that are traveling through interface eth0 and that are destined for ports 22 through 25.

Reference:

• Tcpdump: Filter UDP Packets
• Tcpdump Cheat Sheet With Basic Advanced Examples
• Filtering ICMP ICMPv6 Packets with Tcpdump