tcpdump Filter Builder
Build a tcpdump command with a BPF filter for a host, port, protocol and direction, excluding your own SSH session, writing to a pcap or printing payloads.
Free · No sign-up · Your inputs stay in your browser
Input
Build a tcpdump capture filter
Output
Command
58 characters
The filter is BPF, compiled into the kernel so unwanted packets are never copied out. -nn stops tcpdump resolving names and ports, which otherwise slows it down and generates DNS traffic of its own. Excluding port 22 matters when you capture over SSH: every line printed would be captured again. The HTTP GET filter only works on plain HTTP, never TLS.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Filters run in the kernel
The filter expression is compiled to BPF and evaluated in the kernel, so packets you are not interested in are never copied to tcpdump. That is what makes capturing on a busy server practical. The pcap-filter manual describes the syntax.
Habits that help
-nn avoids DNS and port lookups, which slow output and add traffic of their own. Excluding port 22 matters when capturing over SSH, or every printed line generates more packets to capture. Write to a file with -w and open it in Wireshark when the protocol needs decoding; TLS payloads cannot be read either way.