What is a BPF capture filter?

A Berkeley Packet Filter is a low-level expression the kernel uses to decide which packets to hand to tcpdump. Filters combine primitives like host, port and proto with the boolean operators and, or and not, evaluated per packet.

What is the difference between port and portrange?

port 80 matches packets where the source or destination port is 80. portrange 8000-8100 matches any port in that inclusive range. Prefix with src or dst to restrict the direction, e.g. dst port 443.

How do I match TCP flags like SYN?

Use the tcp[tcpflags] accessor: tcp[tcpflags] & tcp-syn != 0 catches any packet with the SYN bit set. To match a SYN-only segment, compare for equality: tcp[tcpflags] == tcp-syn.

How do host and net differ?

host 10.0.0.5 matches a single address as source or destination. net 10.0.0.0/24 matches any address in that subnet. Add src or dst to limit the direction the address must appear in.

Does the filter affect what is captured or displayed?

A BPF capture filter limits what the kernel captures, so non-matching packets are never seen by tcpdump. That differs from Wireshark display filters, which hide already-captured packets after the fact.

What is the tcpdump BPF Filter Reference?

Build and look up tcpdump/BPF capture filter expressions — host, net, port, protocol and TCP flag primitives — combined with and/or/not, with a live filter builder. It runs free in your browser on Gera Tools, with nothing uploaded.

tcpdump BPF Filter Reference

Name: tcpdump BPF Filter Reference
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Build tcpdump BPF filters without guessing the syntax

tcpdump uses Berkeley Packet Filter expressions to capture only the traffic you care about. This tool lets you assemble a filter from host, network, port, protocol, direction, and TCP-flag primitives — joining them with and/or/not — and includes a reference of the common primitives. It runs entirely in your browser.

How it works

A BPF filter is a boolean expression evaluated per-packet in the kernel before data reaches userspace. Common primitives are host, net, port, portrange, protocol names (tcp, udp, icmp), and direction qualifiers src/dst. Combine them with and, or, and not, using parentheses (quoted in the shell) for grouping:

tcpdump -i eth0 "tcp and host 10.0.0.5 and port 443"
tcpdump -i any "udp port 53 or icmp"
tcpdump -i eth0 "tcp[tcpflags] & tcp-syn != 0 and not net 10.0.0.0/8"

Primitive reference

Primitive	Meaning
`host 10.0.0.5`	Matches either src or dst is this address
`src host 10.0.0.5`	Matches only when source is this address
`dst host 10.0.0.5`	Matches only when destination is this address
`net 10.0.0.0/24`	Matches any address in the subnet
`port 443`	Either src or dst port is 443
`src port 1024`	Source port is 1024
`portrange 8000-8100`	Either port falls in the inclusive range
`tcp` / `udp` / `icmp`	Match by protocol
`tcp[tcpflags] & tcp-syn != 0`	Any packet with the SYN bit set

TCP flag filters

TCP flag matching uses the tcp[tcpflags] byte accessor. Useful patterns:

# Any packet with SYN set (includes SYN-ACK):
tcp[tcpflags] & tcp-syn != 0

# Bare SYN only (connection initiation, no ACK):
tcp[tcpflags] == tcp-syn

# RST (connection resets — useful for spotting refused connections):
tcp[tcpflags] & tcp-rst != 0

# FIN (connection teardown):
tcp[tcpflags] & tcp-fin != 0

Practical filter cookbook

Watch all traffic to/from a single host:

tcpdump -i eth0 "host 192.168.1.10"

Capture only HTTPS and DNS:

tcpdump -i any "tcp port 443 or udp port 53"

Find connection attempts to a server (bare SYNs):

tcpdump -i eth0 "tcp[tcpflags] == tcp-syn and dst host 10.0.0.5"

Exclude internal subnet, capture everything else:

tcpdump -i eth0 "not net 10.0.0.0/8"

Write to file for analysis in Wireshark:

tcpdump -i eth0 -w capture.pcap "tcp port 5432"

Shell and performance tips

Always quote the filter expression with double quotes so the shell does not expand &, <, >, or parentheses.
Use -n to disable DNS reverse lookup and -nn to also suppress port-to-name translation — both keep capture overhead low and output literal.
BPF filters run in the kernel and drop non-matching packets before they reach tcpdump. Wireshark display filters operate differently — they hide already-captured packets but do not reduce kernel-level load during a live capture.
Limit capture size with -s snaplen (for example -s 128) when you only need headers and want to reduce disk and memory use.