Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Utilities

Filter a saved packet capture with BPF

tcpdump-filter is a saved-packet filter that returns PCAP through native tcpdump.

Agent
Select packets by portReduce a saved captureHandle zero matches explicitly

overview

What tcpdump-filter does

Filter a local packet capture with a BPF expression and return a PCAP file. Reads saved packets only; no live capture, commands or post-processing hooks are exposed.

Read a supplied capture with tcpdump 4.99.3 and write matching packets to a new PCAP file. Omitting filter keeps every packet. A valid filter with no matches returns a successful header-only PCAP. No interface selection, live capture, rotation or command hooks are exposed.

Input is limited to 100 MiB, the filter expression to 4096 bytes and native execution to 60 seconds. The expression is one argv value after --, never shell code. -n disables output name resolution, but hostnames inside a BPF expression can still trigger resolver lookups. Use numeric addresses and ports for reproducible offline filtering. Invalid captures or filters fail without partial output; symlinks and existing outputs are rejected.

Packaged version: 4.99.3-deb12. Upstream license: BSD-3-Clause.

source github.com/the-tcpdump-group/tcpdump/tree/032e4923e5202ea4d5a6d1cead83ed1927135874

use cases

Where tcpdump-filter fits

Select packets by port

Keep packets matching a numeric BPF port expression.

Reduce a saved capture

Pass the filtered PCAP artifact to a separate analysis tool.

Handle zero matches explicitly

Receive a valid header-only PCAP when a valid filter selects nothing.

reference

tcpdump-filter inputs and flags

2 inputs
NameTypeFlagDescription
inputFILE--inputLocal PCAP or supported PCAPNG file, at most 100 MiB.
filterSTRING--filterOptional BPF expression, for example udp dst port 45678. Omit to retain all packets. Use numeric addresses for offline reproducibility.

Showing key inputs. tcpdump-filter exposes 2 inputs in total.

example

Run tcpdump-filter

tcpdump-filter · command
python3 /app/run.py --input ./input.txt --filter "udp dst port 45678" ./output

guidance

Choosing tcpdump-filter

Use tcpdump-filter to reduce an existing capture before another analysis stage. The saved fixture covers Ethernet PCAP. PCAPNG support depends on the installed libpcap and supported link types; this node does not collect new traffic or provide arbitrary tcpdump flags.

faq

tcpdump-filter questions

input: Local PCAP or supported PCAPNG file, at most 100 MiB. filter: Optional BPF expression, for example udp dst port 45678. Omit to retain all packets. Use numeric addresses for offline reproducibility.

Read a supplied capture with tcpdump 4.99.3 and write matching packets to a new PCAP file. Omitting filter keeps every packet. A valid filter with no matches returns a successful header-only PCAP. No interface selection, live capture, rotation or command hooks are exposed.

Input is limited to 100 MiB, the filter expression to 4096 bytes and native execution to 60 seconds. The expression is one argv value after --, never shell code. -n disables output name resolution, but hostnames inside a BPF expression can still trigger resolver lookups. Use numeric addresses and ports for reproducible offline filtering. Invalid captures or filters fail without partial output; symlinks and existing outputs are rejected.

Use tcpdump-filter to reduce an existing capture before another analysis stage. The saved fixture covers Ethernet PCAP. PCAPNG support depends on the installed libpcap and supported link types; this node does not collect new traffic or provide arbitrary tcpdump flags.

The public image repository gives immutable image and ORAS download commands, the expected source/notices bundle checksum and pinned upstream source directions. The accompanying OCI bundle retains the original build recipe, runtime sources and full installed notices. The Git recipe keeps primary notices and an exact layer/hash index; it does not duplicate the full installed notice tree or mirror every upstream source archive. Image, source and license notice downloads.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run tcpdump-filter yourself

The saved verifier parsed two synthetic input packets and confirmed exactly one output packet, destination port 45678, its addresses, timestamp and payload. These are verifier-confirmed packet properties; no native packet dump is invented here. The command shows the container entrypoint with example paths.

Open tcpdump-filter in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.