Ubuntu 22.04 tcpdump 安装与命令参数详解

在 Ubuntu 22.04 上安装 tcpdump 并逐参数实测常用抓包命令输入输出，涵盖基础抓包、协议/端口/主机/网段过滤、保存与读取、十六进制转储。

Linux 网络诊断与调试tcpdumpLinux命令行网络诊断2026/10/06

Ubuntu 22.04 tcpdump 安装与命令参数详解

目标：在 Ubuntu 22.04 上安装 tcpdump，并逐参数实测常用抓包命令的输入与输出，涵盖基础抓包、名称解析控制、时间戳、协议/端口/主机/网段过滤、保存文件与转储。本文命令与输出均为 Ubuntu 22.04（tcpdump 4.99.1 / libpcap 1.10.1）实测回显。

环境信息

  • 操作系统：Ubuntu 22.04 LTS
  • tcpdump 版本：4.99.1；libpcap 版本：1.10.1（TPACKET_V3）；OpenSSL 3.0.2
  • 网卡：eth0，IP 172.22.0.2/16，MAC 72:18:8c:51:b4:75
  • 对端主机：172.22.0.3（CentOS 8），监听 8000 端口（python3 简易 HTTP）
  • 说明：抓包需 root/相应 CAP_NET_RAW 权限；部分包由对端制造（curl / ping）

工具概述

tcpdump 是命令行网络抓包工具，基于 libpcap，可实时抓取接口报文并按 BPF 表达式过滤，用于分析网络协议、排查连通性与安全事件。本文针对 Ubuntu 22.04 实测。

安装

在线安装（apt）

sudo apt update
sudo apt install -y tcpdump

安装后验证：

tcpdump --version

tcpdump version 4.99.1
libpcap version 1.10.1 (with TPACKET_V3)
OpenSSL 3.0.2 15 Mar 2022

离线安装（.deb 包）

# 在可联网机器下载（含 libpcap0.8 依赖）
cd /opt/netdiag-offline
apt-get download tcpdump libpcap0.8

# 目标机离线安装
sudo dpkg -i libpcap0.8_*.deb tcpdump_*.deb

基础抓包实测

列出可抓包接口 -D

用途：列出所有可抓包接口，可用编号代替接口名（如 -i 1）。

tcpdump -D

1.eth0 [Up, Running, Connected]
2.any (Pseudo-device that captures on all interfaces) [Up, Running]
3.lo [Up, Running, Loopback]
4.bluetooth-monitor (Bluetooth Linux Monitor) [Wireless]
5.nflog (Linux netfilter log (NFLOG) interface) [none]
6.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]
7.dbus-system (D-Bus system bus) [none]
8.dbus-session (D-Bus session bus) [none]

默认输出：抓指定接口前 3 个包

用途：最基础抓包。默认对 IP/端口做反向 DNS 解析。

tcpdump -i eth0 -c 3

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:29:36.598242 IP netdiag-centos8.netdiag-net.51554 > netdiag-ubuntu.8000: Flags [S], seq 451952477, win 64240, options [mss 1460,sackOK,TS val 1253043711 ecr 0,nop,wscale 7], length 0
04:29:36.598262 IP netdiag-ubuntu.8000 > netdiag-centos8.netdiag-net.51554: Flags [S.], seq 2594346967, ack 451952478, win 65160, options [mss 1460,sackOK,TS val 2423562481 ecr 1253043711,nop,wscale 7], length 0
04:29:36.598276 IP netdiag-centos8.netdiag-net.51554 > netdiag-ubuntu.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 1253043711 ecr 2423562481], length 0
3 packets captured
13 packets received by filter
0 packets dropped by kernel

字段解读：可见 TCP 三次握手 SYN → SYN-ACK → ACK；length 0 表示无载荷。统计行 N packets captured / received by filter / dropped by kernel 反映抓包结果。

禁止名称解析 -nn

用途：-n 禁主机名解析、-nn 同时禁主机名和端口名解析（如 8000 不再显示为 http-alt）。生产排查首选。

tcpdump -i eth0 -c 3 -nn

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:29:37.889792 IP 172.22.0.3.51588 > 172.22.0.2.8000: Flags [S], seq 507485149, win 64240, options [mss 1460,sackOK,TS val 1253045002 ecr 0,nop,wscale 7], length 0
04:29:37.889813 IP 172.22.0.2.8000 > 172.22.0.3.51588: Flags [S.], seq 968407970, ack 507485150, win 65160, options [mss 1460,sackOK,TS val 2423563772 ecr 1253045002,nop,wscale 7], length 0
04:29:37.889830 IP 172.22.0.3.51588 > 172.22.0.2.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 1253045002 ecr 2423563772], length 0
3 packets captured
12 packets received by filter
0 packets dropped by kernel

人类可读绝对时间 -tttt

用途：默认时间戳为相对当日时分秒；-tttt 输出 年-月-日 时:分:秒 绝对时间，便于对齐应用日志。

tcpdump -i eth0 -c 3 -tttt

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
2026-10-06 04:29:39.130024 IP netdiag-centos8.netdiag-net.51630 > netdiag-ubuntu.8000: Flags [S], seq 3970698747, win 64240, options [mss 1460,sackOK,TS val 1253046242 ecr 0,nop,wscale 7], length 0
2026-10-06 04:29:39.130043 IP netdiag-ubuntu.8000 > netdiag-centos8.netdiag-net.51630: Flags [S.], seq 2031369466, ack 3970698748, win 65160, options [mss 1460,sackOK,TS val 2423565012 ecr 1253046242,nop,wscale 7], length 0
2026-10-06 04:29:39.130060 IP netdiag-centos8.netdiag-net.51630 > netdiag-ubuntu.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 1253046242 ecr 2423565012], length 0
3 packets captured
38 packets received by filter
0 packets dropped by kernel

链路层信息 -e

用途：在每行前追加 MAC 地址、ethertype 与帧长，排查二层问题。

tcpdump -i eth0 -c 3 -e

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:29:49.446324 aa:8e:4b:e3:a1:9f (oui Unknown) > 72:18:8c:51:b4:75 (oui Unknown), ethertype IPv4 (0x0800), length 74: netdiag-centos8.netdiag-net.57620 > netdiag-ubuntu.8000: Flags [S], seq 917377715, win 64240, options [mss 1460,sackOK,TS val 1253056559 ecr 0,nop,wscale 7], length 0

详细协议解码 -v

用途：展开 IP 头（tos/ttl/id/分片标志/协议/总长）与校验和。

tcpdump -i eth0 -c 3 -v

tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:29:50.719972 IP (tos 0x0, ttl 64, id 30216, offset 0, flags [DF], proto TCP (6), length 60)
    netdiag-centos8.netdiag-net.57642 > netdiag-ubuntu.8000: Flags [S], cksum 0x5860 (incorrect -> 0x2b7b), seq 263604585, win 64240, options [mss 1460,sackOK,TS val 1253057832 ecr 0,nop,wscale 7], length 0
3 packets captured
12 packets received by filter
0 packets dropped by kernel

⚠️ cksum 0x5860 (incorrect -> ...) 是校验和卸载（checksum offload）现象：硬件/内核延迟计算校验和，抓包点看到未填充值，并非真实错误。

十六进制+ASCII 转储 -X

用途：逐包打印 hex 与 ASCII 对照（从 IP 头开始），检查报文原文。

tcpdump -i eth0 -c 3 -X

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:29:58.162108 IP netdiag-centos8.netdiag-net.48476 > netdiag-ubuntu.8000: Flags [S], seq 2831808337, win 64240, options [mss 1460,sackOK,TS val 1253065274 ecr 0,nop,wscale 7], length 0
        0x0000:  4500 003c 6cd0 4000 4006 75ba ac16 0003  E..<l.@.@.u.....
        0x0010:  ac16 0002 bd5c 1f40 a8c9 f751 0000 0000  .....\.@...Q....
        0x0020:  a002 faf0 5860 0000 0204 05b4 0402 080a  ....X`..........
        0x0030:  4ab0 423a 0000 0000 0103 0307            J.B:........
3 packets captured
12 packets received by filter
0 packets dropped by kernel

解读首包：4500=IPv4+头长 20B，003c 总长 60，4006=TTL 64/协议 TCP，ac16 0003→ac16 0002 即 172.22.0.3→172.22.0.2，1f40=8000；a002=SYN 标志。

纯 ASCII 转储 -A

用途：只打印包 ASCII 形式，抓 HTTP 明文可直接看到请求/响应内容。

tcpdump -i eth0 -c 3 -A

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:29:59.423296 IP netdiag-centos8.netdiag-net.48510 > netdiag-ubuntu.8000: Flags [S], seq 2140678096, win 64240, options [mss 1460,sackOK,TS val 1253066536 ecr 0,nop,wscale 7], length 0
E..<~.@.@.c..........~.@..'.........X`.........
3 packets captured
13 packets received by filter
0 packets dropped by kernel

过滤表达式实测

协议过滤：icmp

用途：BPF 过滤 icmp 只匹配 ICMP 报文。配合 ping 制造流量可得 request/reply 成对。

tcpdump -i eth0 -c 3 icmp

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:33:47.584747 IP netdiag-centos8.netdiag-net > netdiag-ubuntu: ICMP echo request, id 5, seq 1, length 64
04:33:47.584826 IP netdiag-ubuntu > netdiag-centos8.netdiag-net: ICMP echo reply, id 5, seq 1, length 64
04:33:47.889244 IP netdiag-centos8.netdiag-net > netdiag-ubuntu: ICMP echo request, id 5, seq 2, length 64
3 packets captured
6 packets received by filter
0 packets dropped by kernel

端口过滤：tcp port 8000

用途：匹配源或目的端口为 8000 的 TCP 包。

tcpdump -i eth0 -c 3 tcp port 8000

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:33:49.781477 IP netdiag-centos8.netdiag-net.47400 > netdiag-ubuntu.8000: Flags [S], seq 1032173951, win 64240, options [mss 1460,sackOK,TS val 1253296894 ecr 0,nop,wscale 7], length 0
04:33:49.781498 IP netdiag-ubuntu.8000 > netdiag-centos8.netdiag-net.47400: Flags [S.], seq 759390077, ack 1032173952, win 65160, options [mss 1460,sackOK,TS val 1253296894,nop,wscale 7], length 0
04:33:49.781515 IP netdiag-centos8.netdiag-net.47400 > netdiag-ubuntu.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 1253296894 ecr 2423815664], length 0

主机过滤：host

用途：匹配源或目的是该主机的所有包。

tcpdump -i eth0 -c 3 -nn host netdiag-centos

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:33:54.493922 IP 172.22.0.3.47434 > 172.22.0.2.8000: Flags [S], seq 4169274190, win 64240, options [mss 1460,sackOK,TS val 1253301606 ecr 0,nop,wscale 7], length 0
04:33:54.493941 IP 172.22.0.2.8000 > 172.22.0.3.47434: Flags [S.], seq 2853815690, ack 4169274191, win 65160, options [mss 1460,sackOK,TS val 2423820376 ecr 1253301606,nop,wscale 7], length 0
04:33:54.493957 IP 172.22.0.3.47434 > 172.22.0.2.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 1253301606 ecr 2423820376], length 0

方向性主机过滤：src host / dst host

用途：src host 只匹配源地址；dst host 只匹配目的地址。两条配合可精确定位单向流量。

tcpdump -i eth0 -c 3 -nn src host 172.22.0.2
tcpdump -i eth0 -c 3 -nn dst host 172.22.0.3

# src host 172.22.0.2（本机发出的 echo reply）
04:33:55.728597 IP 172.22.0.2 > 172.22.0.3: ICMP echo reply, id 6, seq 1, length 64
04:33:56.033263 IP 172.22.0.2 > 172.22.0.3: ICMP echo reply, id 6, seq 2, length 64
04:33:56.337270 IP 172.22.0.2 > 172.22.0.3: ICMP echo reply, id 6, seq 3, length 64

# dst host 172.22.0.3（发往对方的包）
04:34:01.554346 IP 172.22.0.2 > 172.22.0.3: ICMP echo reply, id 7, seq 1, length 64
04:34:01.858256 IP 172.22.0.2 > 172.22.0.3: ICMP echo reply, id 7, seq 2, length 64
04:34:02.161274 IP 172.22.0.2 > 172.22.0.3: ICMP echo reply, id 7, seq 3, length 64

网段过滤：net CIDR

用途：匹配整个子网（源或目的任一侧落在网段内即命中），也可写 net 172.22.0.0 mask 255.255.0.0。

tcpdump -i eth0 -c 3 -nn net 172.22.0.0/16

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
04:34:05.662867 IP 172.22.0.3.48000 > 172.22.0.2.8000: Flags [S], seq 1947484607, win 64240, options [mss 1460,sackOK,TS val 1253348831 ecr 0,nop,wscale 7], length 0
...
3 packets captured

保存与读取文件实测

写入 pcap 文件 -w

用途：-w 文件 把原始报文写入 pcap 文件（二进制），供事后分析或用其他工具打开。

tcpdump -i eth0 -c 3 -w /tmp/cap.pcap
ls -l /tmp/cap.pcap

listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
3 packets captured
12 packets received by filter
0 packets dropped by kernel
-rw-r--r-- 1 root root 530 Oct  6 04:29 /tmp/cap.pcap

读取 pcap 文件 -r

用途：-r 文件 回放读取 pcap 文件，可用 -nn/-tttt/-X 等配合解析。

tcpdump -r /tmp/cap.pcap -nn

reading from file /tmp/cap.pcap, link-type EN10MB (Ethernet)
04:29:...
IP 172.22.0.3.51588 > 172.22.0.2.8000: Flags [S], ...
...

tcpdump -r /tmp/cap.pcap -nn -tttt
tcpdump -r /tmp/cap.pcap -nn -X | head -8

# -tttt 输出绝对时间；-X 输出 hex 转储，用法与实时抓包一致

帮助输出

tcpdump -h

tcpdump version 4.99.1
libpcap version 1.10.1 (with TPACKET_V3)
Usage: tcpdump [-AbdDefhHIKlLnNOpqStuUvxX#] [ -B size ] [ -c count ]
                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                [ -i interface ] [ -j tstamptype ] [ -M secret ] [ --number ]
                [ -Q in|out|inout ] [ -r file ] [ -s snaplen ] [ -T type ]
                [ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]
                [ -Z user ] [ --time-stamp-precision=tstamp_precision ]
                [ --immediate-mode ] [ --version ] [ expression ]

常见问题

  1. tcpdump: no suitable device found：需 root 或 CAP_NET_RAW 权限；用 sudo 执行。
  2. You don't have permission：非 root 抓包受限，加 sudo 或 -Z root。
  3. cksum incorrect：校验和卸载（offload）现象，非真实错误。
  4. 抓包量大导致丢包：统计行 dropped by kernel 过大时，用更高带宽或 -i 指定精确接口、合理过滤减少负担。
  5. 离线安装：需同时安装 libpcap 依赖。

参考链接

  • 官方文档：https://www.tcpdump.org/
  • man 手册：man tcpdump、man pcap-filter
  • BPF 过滤语法见 man pcap-filter
Ubuntu 22.04 tcpdump 安装与命令参数详解 - Quzuo