tcpdump能否按应用层协议过滤？是否具备识别应用层协议头的功能？

Great question! Let's break this down clearly:

First, you’re absolutely right that tcpdump doesn’t have built-in support for directly filtering by application-layer protocols like HTTP, FTP, etc. Its filtering capabilities rely on the pcap-filter syntax, which only operates up to the transport layer (TCP/UDP) and below. That means you can filter by IP addresses, TCP/UDP ports, packet sizes, or transport-layer flags—but you can’t natively recognize and filter based on application-layer protocol headers like Wireshark does.

Why is this the case? #

Tcpdump is built to be a lightweight, high-performance packet capture tool. Its filtering logic runs in the kernel via BPF (Berkeley Packet Filter), which prioritizes speed over deep packet inspection. Parsing application-layer headers would add significant processing overhead, which goes against tcpdump’s core design goal of fast, low-overhead capture.

Workarounds to filter application-layer traffic with tcpdump #

While you can’t filter directly by protocol name, you can mimic this behavior with a few practical tricks:

• Filter by default ports: Most application protocols use standard ports (e.g., HTTP on 80/443, FTP control on 21). You can target these with commands like:

  tcpdump tcp port 80  # Capture HTTP traffic
  tcpdump tcp port 21  # Capture FTP control traffic
  

  Caveat: This fails if the protocol uses non-standard ports.
• Filter by payload signatures: You can match specific strings in the packet payload (after the TCP header). For example, HTTP GET requests start with "GET ", which translates to the hex value 0x47455420. To filter these:

  tcpdump -A 'tcp port 80 and tcp[20:4] = 0x47455420'
  

  The tcp[20:4] refers to 4 bytes starting at offset 20 (assuming a standard 20-byte TCP header). This requires knowing exact payload signatures and calculating offsets, which is tedious but works for simple use cases.
• Capture first, analyze later: Use tcpdump to save packets to a file, then open it in Wireshark for full application-layer filtering:

  tcpdump -w capture.pcap tcp port 80 or tcp port 21
  

  Wireshark will automatically identify application-layer protocols and let you filter with simple syntax like http or ftp.

A better command-line alternative: tshark #

If you need native application-layer filtering from the command line, tshark (Wireshark’s command-line counterpart) is ideal. It supports the same protocol recognition as Wireshark, so you can filter directly by application protocol names:

tshark -Y http  # Filter all HTTP traffic
tshark -Y ftp   # Filter all FTP traffic

Final takeaway #

Tcpdump doesn’t have Wireshark-style native application-layer protocol filtering, but you can work around it with port or payload filters. For a more seamless command-line experience, tshark is the best tool if you need to filter by application-layer protocols directly.

内容的提问来源于stack exchange，提问作者flow2k