Firewall debugging: Troubleshoot packet filtering rules in the firewall.Multi-homed routing: Verify traffic routing in multi-homed environment.Rogue DHCP server detection: Discover DHCP responses from unauthorized DHCP servers.Application performance: Estimate application-level latency from packet timestamps.Packet loss diagnosis: Detect packet loss and diagnose the cause for dropped packets.Using tcpdump, you can troubleshoot a wide range of network issues including but not limited to: Although GUI-based Wireshark provides equally powerful filtering/dissecting capabilities via a more user-friendly interface, its relatively high memory footprint (for buffering packets) and GUI-based operations make Wireshark unsuitable when you are troubleshooting directly from remote headless servers. The main power of tcpdump comes from its (1) flexible packet filtering rules and (2) versatile protocol dissection capability. Tcpdump is a command-line tool packet sniffing that allows you to capture network packets based on packet filtering rules, interpret captured packet content, and display the result in a human-readable format. While required tools may vary depending on the types of network problems you are dealing with, there are a set of essential tools that every network administrator must be familiar with, and tcpdump is definitely one of them. When it comes to network troubleshooting and monitoring, what types of tools you are using make a world of difference.

Wireshark filters cheat sheet pdf