Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a completely noob question. I want to see all packets that come to my computer from particular site ( So I start tcpdump

sudo tcpdump -i eth0 host

and enter in a browser and hit enter - nothing gets captured. I can't figure out why it happen. What do I do wrong?


It appeared that I was listening to the wrong interface. I had changed eth0 to any and it worked. It was ppp1 that needed listening. Thanks for your answers!

share|improve this question
Your command above works ok for me on Ubuntu. Are you sure that eth0 is the port you want to capture ? – Iain Jan 2 '11 at 17:19
up vote 3 down vote accepted

There are several possibilities.

1- You are listening on the wrong the interface eth0, eth1, etc.

2- You did not wait enough for the packets to show up. Packets are not shown immediately unless you specify -n to disable name resolution.

3- You are filtering based on the wrong IP address as suggested by "Nathan Adams".

share|improve this answer
You might want to also try adding "port 80" instead of a host, at least until you can figure out what the correct IP address is. – jftuga Jan 2 '11 at 17:30
You're right - I changed eth0 to any and it worked. I figured out that it was ppp1, not eth0 that needed to be listened – Denis Kniazhev Jan 2 '11 at 17:43

It's probably filtering the wrong address because has multiple addresses.

Try something simpler like:

tcpdump -i eth0 host
dig @

11:11:01.488442 IP > 32923+ A? (28)
11:11:01.512304 IP > 32923 6/0/0 A,[|domain]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.