Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I search for a way to limit or change the output format of tcpdump to print only tcp sequnce number, but i didnt find a way to do this. Can you please advice?

Running on Ubuntu. If there is no way to do this in tcpdump other ways to do this with some linux command is also good, but prefer a way to do this directly by tcpdump.

share|improve this question
up vote 2 down vote accepted
tcpdump -i eth0 -v | egrep -o 'seq [0-9]+(:[0-9]+)?|ack [0-9]+'

Using verbose mode, filter through grep to select seq and ack numbers.

For a more advanced solution, you can pass data on to the scapy library and write code to parse packets directly. The documentation may be a bit staggering if you're not used to network / byte programming, but the power is impressive.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.