The first line of the tcpdump output above is a summary of The first packet that my browser exchanges with Amazon is a TCP 'synchronize' ( SYN) The first three packets that are exchangedĪre, as required, the TCP 3-way handshake, which I step through below.ġ4:39:43.084497 IP localhost.54626 > .: Flags, seq 4183262244, win 65535, options The Amazon home page, there's a flurry of activity. Tcpdump waits until it sees any network traffic - when I open up, for example, Listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes Tcpdump: verbose output suppressed, use -v or -vv for full protocol decode Windump that accepts the same parameters). (If you're on Windows, there's an equivalent program called What should probably be obvious reasons, tcpdump must run as root on Option which instructs it to output the contents of every single data packet in hexadecimal. In this case, I want to see everything, so I pass in the -x

Also byĭefault, tcpdump only summarizes the data under the assumption that you're mostly

tcpdump includes an option to filter the results usingĪn expression language: tcp port 443 is the filter that I'll use here. To start out with, then, it's worth narrowing down exactly what we're interested in: Spits out everything that passes through your network card - which is Of course, the first thing I need to do - before I even launch a browser - is to Walk through each byte of it and what each means and what it's for. In this post, I'll capture the tcpdump output of a TCP handshake and Tcpdump output in a blog post like this one, I'll stick with tcpdump While adding some graphical niceties, but since the output is equivalent and it's easier to show There'sĪctually a more modern graphical tool called Wireshark that exposes the same data, Required me to dig down into the wire-protocol layer that tcpdump exposes. In your network communications - I've been called on more than once to troubleshoot an issue that Tcpdump is a great tool for really making sense of what's going on 'under the hood'

Wireshark pcap 3 way handshake