Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Ditch netstat for quick tcpdump captures

🧩 The Challenge

You’re trying to debug a network issue on a busy server and need to see what’s actually hitting a specific port, but typing out a full `tcpdump` filter is a pain and `netstat` doesn’t show you the packet contents. I’ve wasted hours just trying to get the `tcpdump` filter right.

💡 The Fix

Let’s use `ss` to grab the `PID` of the process listening on a port and then pipe that directly into `tcpdump` for a super-focused capture. It’s way faster than remembering complex `tcpdump` syntax.

PORT=80; PID=$(ss -tlpn sport = :$PORT | awk 'NR>1 {print $7}' | cut -d= -f2 | cut -d, -f1); sudo tcpdump -i any "tcp and port $PORT and not pid $PID"

⚙️ Why It Works

This finds the process ID listening on your target port and then tells `tcpdump` to capture traffic on that port *except* for the traffic originating from that very process, giving you external traffic. And it’s way cleaner than manually scripting it every time.

🚀 Pro-Tip: Add the `-A` flag to `tcpdump` to see the packet payload as ASCII if it’s text-based.

Linux Tips & Tricks | © ngelinux.com | 9/17/2026