Capture new TCP connection attempts without payload data
Build a paste-ready command, then review its compatibility and effects before running it.
sudo tcpdump -ni <interface> -c <count> 'tcp[tcpflags] & tcp-syn != 0'Complete required fields to copy the generated command.
cautionrequires privileges Compatibility
Linux + macOSVerified for Linux, macOS using bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementstcpdumptcpdump must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supporttcpdump Current supported releasesVerified for linux, macos using bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signals09:45:08.112710 IP 10.24.7.18.54122 > 10.24.1.9.443: Flags [S], seq 28177201, win 64240Representative successful output; values vary with the selected target and system state.
Known errorstcpdump: command not foundtcpdump is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifysudo tcpdump -ni {{interface}} -c {{count}} 'tcp[tcpflags] & tcp-syn != 0'Re-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01sudoPrivilege elevationRuns the following command with elevated privileges after authorization.
02tcpdumpCommandRuns the tcpdump stage of this one-liner.
03-niOptionConfigures tcpdump with the -ni option.
04<interface>ParameterA value supplied in the Fill parameters section.
05-cOptionConfigures tcpdump with the -c option.
06<count>ParameterA value supplied in the Fill parameters section.
07'tcp[tcpflags] & tcp-syn != 0'ArgumentPasses 'tcp[tcpflags] & tcp-syn != 0' to tcpdump.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
sudo tcpdump -ni eth0 -c 10 'tcp[tcpflags] & tcp-syn != 0'
Example output
09:45:08.112710 IP 10.24.7.18.54122 > 10.24.1.9.443: Flags [S], seq 28177201, win 64240
09:45:08.112884 IP 10.24.1.9.443 > 10.24.7.18.54122: Flags [S.], seq 991722, ack 28177202
Illustrative output — exact values vary by system and data.
Official sources