Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does this mean that the "ports" are MAC addresses?

share|improve this question
What is the switch -xx doing?, I only see -x and -X in the man page for tcpdump. The only switches I see that support multiple copies are v, t, n, and d – Scott Chamberlain Oct 31 '12 at 17:16
@ScottChamberlain: Which version of tcpdump are you using? 4.3.0 has -xx. – grawity Oct 31 '12 at 17:19
@grawity I don't have my box near me right now so I just googled it and got here – Scott Chamberlain Oct 31 '12 at 17:21
@ScottChamberlain: That one is from 2002. The latest version is on the official website. – grawity Oct 31 '12 at 17:29

No, they aren't.

Regardless of its name, tcpdump captures packets at the lowest possible level – it doesn't limit itself to just TCP.

When you use -xx, tcpdump outputs the link layer header of all packets, so the first 4 bytes of the output aren't TCP – they are part of the Ethernet frame.

Even with plain -x, tcpdump would print the IP header before TCP/UDP.

If you want to see the packet structure, use Wireshark instead – it will display every packet as a tree, and highlight the specific bytes for every value.

share|improve this answer
Great! So it looks like I was using the wrong options and was getting the link layer include. – jayeola Oct 31 '12 at 17:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.