tcpdump and Wireshark

The frontline tool for network troubleshooting—tcpdump uses BPF filters to filter in kernel space (packets that do not match are never copied to user space, making it several orders of magnitude faster than grep), while Wireshark provides protocol field-level visual analysis. The key to TLS decryption is SSLKEYLOGFILE.

Overview

The most important tool for network troubleshooting is packet capture—tcpdump filters traffic on the server side using BPF filters, while Wireshark provides visual analysis. BPF filters are compiled into kernel-level filtering programs that discard unmatched traffic before packets are copied to user space—making them several orders of magnitude more efficient than filtering with grep. Wireshark's display filters work on already captured packets and support deep filtering on arbitrary protocol fields. The key to TLS decryption is SSLKEYLOGFILE.

BPF Filter

BPF (Berkeley Packet Filter) is compiled into a kernel-level filtering program that discards unmatched packets before capture, avoiding copying them to user space:

host 192.168.1.1
net 192.168.0.0/24
port 443
portrange 8000-9000
tcp, udp, icmp, arp
and / or / not / && / || / !

TCP flags:
  'tcp[tcpflags] & tcp-syn != 0'       SYN
  'tcp[tcpflags] == tcp-syn'           only SYN (not SYN+ACK)
  'tcp[tcpflags] & tcp-rst != 0'       RST

Combination:
  '(host 1.1.1.1 or host 8.8.8.8) and tcp port 443'

Practical Commands

# Capture to file:
tcpdump -i eth0 -w capture.pcap -s 0 'host 192.168.1.1 and port 443'

# DNS:
tcpdump -i any -nn 'port 53'

# TCP SYN (all connection establishments):
tcpdump -i any -nn 'tcp[tcpflags] & tcp-syn != 0'

# HTTP Host header:
tcpdump -A -s 0 'tcp port 80' | grep -i 'Host:'

# tshark (Wireshark CLI):
tshark -r capture.pcap -Y 'tcp.analysis.retransmission'
tshark -r capture.pcap -Y 'tcp.analysis.zero_window'
tshark -r capture.pcap -z conv,tcp               # Connection statistics

# TLS decryption:
# Wireshark: Edit - Preferences - TLS - (Pre)-Master-Secret log filename = SSLKEYLOGFILE

References

• BPF syntax: tcpdump.org/manpages/pcap-filter.7
• Wireshark: wiki.wireshark.org/DisplayFilters

Keywords: tcpdump, BPF filter, Wireshark, tshark, packet capture, retransmission