tcpdump: pull one conversation and read the flags

The expression that selects one conversation

host matches either side of a frame. host 10.8.0.20 and host 10.8.0.40 keeps frames whose two addresses are that pair. tcp port 443 keeps TCP frames where either port is 443. Together they are one service between two lab machines, in both directions. A filter with only one host also shows that host talking to everyone else it reached.

Put the expression in single quotes so the shell does not split it. This is BPF, the same language -f uses in tshark. Display-filter words such as ip.addr and tcp.flags are tshark syntax. tcpdump will reject them.

tcpdump -nn -tttt -r /lab/evidence.pcap 'host 10.8.0.20 and host 10.8.0.40 and tcp port 443'

What each flag in that command does

-r reads a savefile. It does not listen on a NIC, and it does not need root when you can read the file. -tttt prints the date and the time of day on each line, which is what you match to an application log. -nn keeps addresses and ports numeric. On current tcpdump a single -n already skips host and port names. The second n is the form lab notes use, and it still means numeric output. Either way, reading the file does not fire DNS lookups from the analysis machine, and port 443 stays 443 instead of becoming the name https.

The letters inside Flags [] are TCP control bits. S is SYN, the dot is ACK, P is PSH, F is FIN, R is RST. Flags [S] is a SYN. Flags [S.] is SYN plus ACK. Flags [.] is an ACK. Flags [P.] is data plus ACK. Flags [F.] is FIN plus ACK. Flags [R.] is RST plus ACK. length is the application byte count in that frame, not the size of the whole IP packet.

• seq 1:518 means sequence numbers 1 through 517. The length is the difference, 517.
• The SYN and the SYN-ACK print absolute sequence numbers. Later data and ACK lines are offsets from those, unless you pass -S.
• -S prints absolute sequence numbers for the whole connection.
• -c 30 stops the printout after 30 matching frames so the first look stays short.

A worked defensive case

The lab files service at 10.8.0.40:443 is the only host the web tier at 10.8.0.20 should call. The ticket says logins hung at 10:14. You print that pair on port 443. The lines show Flags [S] from the client, Flags [S.] from the server, Flags [.] from the client, then Flags [P.] with length 517, an ACK from the server, and five seconds later Flags [R.] from the client.

Write this down in that order. The handshake completed, so a filter that dropped every SYN would not explain this file. Data started, the server acknowledged it, and the client aborted. The next evidence is the files VM's application log at 10:14:01, not a new capture of the whole lab. Keep the pcap with the ticket until the retention rule says to delete it.

2026-11-02 10:14:01.102221 IP 10.8.0.20.51422 > 10.8.0.40.443: Flags [S], seq 3842910042, win 64240, length 0
2026-11-02 10:14:01.102480 IP 10.8.0.40.443 > 10.8.0.20.51422: Flags [S.], seq 209184331, ack 3842910043, win 65160, length 0
2026-11-02 10:14:01.102611 IP 10.8.0.20.51422 > 10.8.0.40.443: Flags [.], ack 1, win 502, length 0
2026-11-02 10:14:01.140882 IP 10.8.0.20.51422 > 10.8.0.40.443: Flags [P.], seq 1:518, ack 1, win 502, length 517
2026-11-02 10:14:01.188004 IP 10.8.0.40.443 > 10.8.0.20.51422: Flags [.], ack 518, win 501, length 0
2026-11-02 10:14:06.441220 IP 10.8.0.20.51422 > 10.8.0.40.443: Flags [R.], seq 518, ack 1, win 502, length 0

Where this is documented

tcpdump(1) documents -r, -n, -tttt, and -S. The flag letters are the TCP control bits printed in the summary. pcap-filter(7) documents host, tcp, and port.

The sample omits TCP timestamp options so the lines fit on a page. A real printout is wordier and means the same thing. Port 443 here is the lab service. The payload of TLS stays opaque. You are reading the handshake and the sizes.

Commands

tcpdump -nn -tttt -r /lab/evidence.pcap 'host 10.8.0.20 and host 10.8.0.40 and tcp port 443'

tcpdump -nn -tttt -r /lab/evidence.pcap -c 30 'host 10.8.0.20 and host 10.8.0.40 and tcp port 443'