Optimizing Capture Performance to Minimize Packet Loss

To prevent packet loss during high-volume captures, administrators should tune both the capture parameters and the underlying operating system buffers. Key strategies include:

• Narrowing the capture scope by specifying specific interfaces, ports, directions, or packet sizes.
• Using the -n flag to disable reverse DNS resolution, which reduces overhead.
• Increasing the operating system's capture buffer size using the -B flag.
• Setting the snapshot length (-s) appropriately; typically, values under 1000 are sufficient for headers without payload bloat.
• Writing data directly to a file rather than standard output to reduce I/O blocking.
• Adjusting kernel socket buffer parameters via sysctl to increase the libpcap buffer capacity (e.g., /proc/sys/net/core/rmem_default and /proc/sys/net/core/rmem_max).

Capturing Traffic Based on MAC Addresses

When filtering at the data link layer, you can target specific hardware addresses. The following command captures traffic on interface eth0 where the source or destination MAC matches specific nodes, combined with IP and port filters.

tcpdump -i eth0 -e -nn -s 0 -B 20480 \
'(ether src 11:22:33:44:55:66 or ether dst 77:88:99:aa:bb:cc) and \
(host 10.0.0.5 or host 10.0.0.9) and tcp port 80'

Filtering HTTP Request Methods

To inspect HTTP traffic, tcpdump can match byte sequences within the packet payload. The following examples demonstrate capturing HTTP GET requests, which start with "GET " (hex 0x47455420).

tcpdump -i eth0 -A -s 0 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

Similarly, to capture POST requests, we look for the "POST" signature (0x504f5354).

tcpdump -i eth0 -A -s 0 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

To capture both request and response bodies (packets containing data), we filter for TCP segments where the payload length is non-zero.

tcpdump -i eth0 -A -s 0 \
'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

Multi-Port and Interface Monitoring

Monitoring specific services across all network interfaces can be achieved by combining port filters. The following example captures HTTP traffic on ports 80 and 8080 on any interface, excluding empty TCP packets.

tcpdump -i any -A -s 0 \
'(tcp port 80 or tcp port 8080) and \
(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

To include connection establishment (SYN) and teardown (FIN) packets in addition to data transfer:

tcpdump -i any -A -s 0 \
'(tcp port 80 or tcp port 8080) and \
((((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) or \
(tcp[tcpflags] & (tcp-syn|tcp-fin) != 0))'

Database Protocol Analysis

For Redis traffic, filter by the specific host and the default Redis port while ensuring you capture the packet payload.

tcpdump -i eth0 -A -s 0 \
'host 192.168.1.10 and tcp port 6379 and \
(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

To analyze MySQL queries, which are often text-based, pipe the output to strings to make the query content readable.

tcpdump -i lo -s 0 -l -A dst port 3306 | strings

Since tcpdump does not natively support the MongoDB wire protocol, using strace on the process ID is a more effective way to inspect database commands.

strace -s 256 -e trace=network -f -p ${MONGO_PID} 2>&1 | grep "collection_name"

Filtering by Packet Size

To identiyf jumbo packets or unusually large payloads, filter based on the IP total length field. This example captures packets larger than 1000 bytes on port 80.

tcpdump -i any 'port 80 and ip[2:2] > 1000'

Inspecting Remote Connections for a Process

To see which remote endpoints a specific process is connected to, use lsof or strace.

lsof -nPp $PID

Alternatively, trace the system calls to see network activity in real-time.

strace -e trace=connect,read,sendto -f -p $PID

Protocol-Specific Captures

Capture High Availability protocols like VRRP (Virtual Router Redundancy Protocol) to monitor failover events.

tcpdump -i eth0 -n vrrp

To observe multicast group management:

tcpdump -i eth0 -n igmp

TCP Flag Filtering

Understanding TCP flags is crucial for diagnosing connection states. The control bits consist of CWR, ECE, URG, ACK, PSH, RST, SYN, and FIN. Below are filters for common scenarios:

Capture TCP handshake initialization (SYN packets):

tcpdump -i any 'tcp[tcpflags] & tcp-syn != 0'

Capture connection termination (FIN packets):

tcpdump -i any 'tcp[tcpflags] & tcp-fin != 0'

Capture both connection opening and closing:

tcpdump -i any '(tcp[tcpflags] & tcp-syn != 0) or (tcp[tcpflags] & tcp-fin != 0)'

Capture connection resets (RST packets) indicating abnormal closures:

tcpdump -i any 'tcp[tcpflags] & tcp-rst != 0'

Debugging Unix Domain Sockets

Since tcpdump cannot directly capture Unix Domain Socket traffic, you can proxy the socket traffic through a TCP port using socat. This setup allows you to sniff the communication loopback.

# 1. Rename the original socket
sudo mv /var/run/docker.sock /var/run/docker.sock.bak

# 2. Create a TCP listener that proxies to the original socket
sudo socat TCP-LISTEN:2375,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sock.bak &

# 3. Recreate the Unix socket pointing to the local TCP port
sudo socat UNIX-LISTEN:/var/run/docker.sock,fork TCP-CONNECT:127.0.0.1:2375 &

# 4. Capture the traffic on the loopback interface
sudo tcpdump -i lo -A port 2375