tcpdump Filters: host, port, and tcp Flags
A tcpdump filter expression selects which packets to capture by host, port, direction, or protocol flag.
A raw capture on a busy runner is unreadable. The filter language is how you reduce it to just the connection that is failing, then read the handshake to see where it breaks.
What it does
The trailing expression is a Berkeley Packet Filter. Primitives like host, port, src, dst, and tcp combine with and, or, and not to match packets in the kernel before they reach tcpdump, so even a broad capture stays cheap.
Common usage
# only traffic to/from one host on one port
tcpdump -i any -n 'host 10.0.0.5 and port 5432'
# only outbound DNS queries
tcpdump -i any -n 'udp dst port 53'
# isolate connection resets (RST) that signal a refused connection
tcpdump -i any -n 'tcp[tcpflags] & tcp-rst != 0'Filter primitives
| Primitive | Matches |
|---|---|
| host <h> | Packets to or from host h |
| src <h> / dst <h> | Only the source or destination side |
| port <p> | Packets on TCP or UDP port p |
| tcp / udp / icmp | Restrict to a protocol |
| tcp[tcpflags] & tcp-syn != 0 | Packets with the SYN flag set |
| not / and / or | Combine primitives |
In CI
Reading a failed handshake: a lone SYN with no SYN-ACK back means the packet is dropped (firewall, wrong route, or nothing listening). A SYN answered by RST means the host is reachable but the port is closed, which matches "connection refused".
Common errors in CI
"syntax error in filter expression" usually means the filter was not quoted, so the shell split it; wrap the whole expression in single quotes. "tcp-syn: unknown" appears on captures that are not IPv4 TCP, or on builds missing the named flag constants; fall back to the numeric mask tcp[13] & 2 != 0.