Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know there's a native command on linux that will output (to stdout) every "event" related to a certain network interface (be it eth0 etc').
Like there's tail -f <file> to listen on file changes..
I just can't find it.

I want to see all events, incoming packets, even dropped ones. At lowest level possible. In every protocol (TCP, UDP etc').
I think WireShark is a bit too big for this as I need something very simple just to see the events, it's for testing.

What's the command?

share|improve this question
up vote 5 down vote accepted

You're talking about tcpdump, as other people have mentioned.

There's also ngrep:

$ yum info ngrep
Loaded plugins: fastestmirror, priorities
Available Packages
Name       : ngrep
Arch       : i386
Version    : 1.45
Release    : 2.el5.rf
Size       : 33 k
Repo       : dag
Summary    : Realtime network grep tool
URL        :
License    : GPL
Description: ngrep is grep command that works on realtime network data.
           : ngrep strives to provide most of GNU grep's common features, applying
           : them to the network layer. ngrep is a pcap-aware tool that will allow
           : you to specify extended regular or hexadecimal expressions to match
           : against data payloads of packets. It currently recognizes TCP, UDP
           : and ICMP across Ethernet, PPP, SLIP, FDDI, Token Ring and null
           : interfaces, and understands bpf filter logic in the same fashion as
           : more common packet sniffing tools, such as tcpdump and snoop.

which is sort of like grep on a network stream. It's not a standard package, but it can help you find the network traffic you're looking for.

share|improve this answer
Thanks everyone. Selected this answer as it added another value to the answer. – Poni Nov 27 '11 at 19:29


[root@kerberos users]# tcpdump -i virbr0 port 22 -c 10
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on virbr0, link-type EN10MB (Ethernet), capture size 65535 bytes
10 packets captured
10 packets received by filter
0 packets dropped by kernel
18:15:00.629145 IP > Flags [P.], seq 723634149:723634341, ack 2691792940, win 145, options [nop,nop,TS val 2845703615 ecr 994376021], length 192
18:15:00.646606 IP > Flags [.], ack 0, win 65535, options [nop,nop,TS val 994376068 ecr 2845703587], length 0
18:15:00.653646 IP > Flags [.], ack 4059311404, win 33108, options [nop,nop,TS val 994376075 ecr 2845703594], length 0
18:15:00.659078 IP > Flags [P.], seq 0:96, ack 1, win 33156, options [nop,nop,TS val 994376075 ecr 2845703594], length 96
18:15:00.660041 IP > Flags [P.], seq 1:129, ack 96, win 244, options [nop,nop,TS val 2845703645 ecr 994376075], length 128
18:15:00.676094 IP > Flags [.], ack 192, win 65535, options [nop,nop,TS val 994376096 ecr 2845703615], length 0
18:15:00.706762 IP > Flags [.], ack 129, win 33092, options [nop,nop,TS val 994376126 ecr 2845703645], length 0
18:15:00.712138 IP > Flags [P.], seq 96:192, ack 129, win 33156, options [nop,nop,TS val 994376126 ecr 2845703645], length 96
18:15:00.713242 IP > Flags [P.], seq 129:257, ack 192, win 244, options [nop,nop,TS val 2845703699 ecr 994376126], length 128
18:15:00.760791 IP > Flags [.], ack 257, win 33092, options [nop,nop,TS val 994376179 ecr 2845703699], length 0
share|improve this answer

I think you might be looking for tcpdump.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.