Capture traffic on a port with tcpdump
Sniff packets on any interface with a BPF filter — the fastest way to prove whether traffic is even reaching your server.
Run `sudo tcpdump -i any -nn port 443` to watch HTTPS traffic on every interface with raw IPs and ports (no DNS lookups).
01Command
Command
$ sudo tcpdump -i any -nn port 44302What it does
`-i any` captures on all interfaces at once, which matters on multi-NIC servers and containers where guessing the interface wastes time. `-nn` disables name resolution so output stays fast and shows the true ports; without it, tcpdump resolves every IP and you lose visibility on load. Refine the filter with standard BPF syntax — `port 443 and host 10.0.0.5` — and add `-w /tmp/dump.pcap` to save a file for Wireshark instead of reading it live.
03Risk
!Warning: Captured output can contain sensitive payload data; anyone watching the terminal or the pcap file sees it. Stop capture with Ctrl+C and delete pcaps when done.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- tcpdump(1) — dump traffic on a networkEvidence: Documents -i any (all interfaces), -n (no name resolution), and BPF filter expressions like `port 443`.
Last verified: 2026-09-17 · Category: Network