tcpdump & BPF Filter Builder

About this tool

tcpdump decides what to record with a capture filter written in BPF (Berkeley Packet Filter) syntax, for example tcp and (port 80 or port 443). It is compact, easy to get wrong and unforgiving: a missing bracket, or a filter that can never match, either fails or silently captures nothing. This tool builds the filter from choices. Add a condition for a protocol (tcp, udp, icmp, icmp6, arp, ip, ip6, sctp), a host or a network (either direction, or only source or destination), a port, several ports or a port range, TCP flags (new connections with SYN only, SYN+ACK, RST, FIN, PSH), an ICMP type (ping request and reply, unreachable, time exceeded), a VLAN, a MAC address, broadcast or multicast frames, or a minimum or maximum packet size. Tick "not" to exclude a condition, and join the conditions with AND or OR. Several ports or hosts separated by commas become a grouped list: 80,443 becomes (port 80 or port 443). Starter filters cover web traffic, DNS, SSH, ping, new connections, resets and "everything except my own SSH session". The tool also writes the full command: interface, whether to show numbers only, how many packets to stop after, snap length and an output file for Wireshark, with the filter safely single-quoted. Values are checked as you type (ports, address and prefix lengths, MAC addresses, VLAN ids). It also refuses combinations that can never match together, such as UDP with a TCP flag, a port with ICMP, an IPv6 address with an IPv4 network, two different source ports joined with AND, or a minimum size above the maximum, because tcpdump itself rejects those or they would match nothing. Host names that are tcpdump keywords (and, tcp, port and so on), network addresses with bits set beyond the prefix (10.1.2.3/8), and a second VLAN condition are refused too. We checked the tool against the real tcpdump in three ways. First, every filter it can build was compiled with tcpdump: about 2,800 of them, covering every field alone, negated, and combined in pairs, including pairs of the same field with different values. Second, every pair of conditions that the tool refuses as impossible was also refused by tcpdump (172 pairs), and every pair it accepts compiled. Third, about 45 typical filters (web, DNS, SSH, ping, SYN and RST, networks, IPv6, VLANs, MAC addresses, packet sizes) were run against a small capture file of known packets, and exactly the expected packets matched. The compile check is far broader than the packet-matching check, which covers the common cases rather than every combination. Two BPF quirks are handled or noted: a VLAN condition is placed first with AND and last with OR, because it shifts how everything after it is read (and "not VLAN" must stand alone), and TCP flag and ICMP type matching works on IPv4 only. This writes text only: nothing is captured here, host names are not looked up, and what you type stays in your browser. Capture only on networks and machines you are authorised to monitor, and note that capturing needs root or the right capabilities.

How to use it

1. Choose a starter filter or add conditions one by one.
2. Tick "not" to exclude something, and pick AND or OR.
3. Open Command options to set the interface, packet count or an output file.
4. Copy the filter or the full command and run it where you are allowed to capture.

Example

The filter is quoted so the shell cannot change it.

protocol: tcp · port: 80,443 · interface eth0 · stop after 100

sudo tcpdump -i eth0 -nn -c 100 'tcp and (port 80 or port 443)'

Common problems

It says the rows cannot match together

A filter with AND needs every condition to be possible at once. Ports exist only on TCP, UDP and SCTP, TCP flags only on IPv4 TCP, and an address family cannot mix. Switch to OR, or remove a row.

VLAN traffic is not captured

On tagged links, add a VLAN condition. The tool puts it first because BPF reads everything after it as inside the VLAN tag.

tcpdump says permission denied

Capturing needs root or capabilities. Run the command with sudo, or give tcpdump the capture capability, on a machine you are allowed to monitor.

I need a Wireshark display filter

This builds capture filters (BPF), which are applied while recording. Wireshark's display filters use different syntax and are not covered here.