Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like

IP > Flags [P.], seq 54:72, ack 1, win 5792, length 18

it only shows the hostname and the protocol for http, it is easy to know it is 80 but for dnp I have to search

so is it possible to how to make tcpdump to display ip and port number but not hostname and protocol if so , how? thanks

share|improve this question

4 Answers 4

up vote 9 down vote accepted

Add -n to your tcpdump command line.

From the tcpdump manpage:

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

It should also be noted that on Fedora (and perhaps other derivatives: RHEL, CentOS, etc.) they have patched the original tcpdump version to include a separate option -nn to remove port numbers. From the manpage:

-n     Don't convert host addresses to names.   This  can  be  used  to
              avoid DNS lookups.

-nn    Don't convert protocol and port numbers etc. to names either.
share|improve this answer
port number is still converted to protocol name using -n – misteryes Apr 24 '13 at 22:36
"port number is still converted to protocol name using -n" Not with, for example, the tcpdump 4.1.1 that comes with OS X Mountain Lion or with tcpdump built from the top of the Git trunk. On what version of tcpdump are you seeing -n not suppress the conversion of port numbers to protocol names? – Guy Harris Aug 23 '13 at 17:52

I use -nn parameter.

-nn: Don’t resolve hostnames or port names.

Run it as:

tcpdump -nn 
share|improve this answer

-n works only for hostnames, but doesn't work for port numbers. -nn does the trick for both. This is running tcpdump version 4.5.1 on Fedora 20 gnu/linux. Downvoted answer of @ATMc is the only correct. I sadly can neither upvote it nor write a comment below it because of low karma.

share|improve this answer

I think the best approach is:

sudo tcpdump -ni any

Steps to test:

  1. Open a console and type:

    sudo nc -l -p 6666
  2. Open another console and type:

    sudo tcpdump -ni any

    If the output is too verbose you can filter it out (| grep -v "patter1n|pattern2")

  3. Open a third console and type:

    telnet localhost 6666

Expected output:

10:37:13.770997 IP > Flags [S], seq 2822288041, win 43690, options [mss 65495,sackOK,TS val 1028779 ecr 0,nop,wscale 7], length 0

If you use sudo tcpdump -i any you will see something like this:

10:38:22.106022 IP localhost.56924 > localhost.https: Flags [S], seq 3147104744, win 43690, options [mss 65495,sackOK,TS val 1045863 ecr 0,nop,wscale 7], length 0
share|improve this answer
That's the same as the other answer - the -i any isn't necessary if you want to suppress address/port-to-name conversion, it's just the -n that matters. – Guy Harris Aug 23 '13 at 17:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.