Linux networking: Packet capture and firewall

Capture traffic on an interface

Print packets on an interface without resolving names.

sudo tcpdump -i eth0 -nn

Capture traffic for a port

Show only traffic to or from port 443.

sudo tcpdump -i any -nn port 443

Save a capture for Wireshark

Write packets to a file you can open in Wireshark.

sudo tcpdump -i eth0 -w capture.pcap host 203.0.113.10

Show the firewall rules (ufw)

Show the status and numbered rules of Ubuntu's firewall front end.

sudo ufw status numbered

Allow a port (ufw)

Allow incoming SSH. Allow SSH before enabling the firewall.

sudo ufw allow 22/tcp

Caution: Enabling a firewall without allowing SSH can lock you out of a remote server.

Turn the firewall on (ufw)

Enable ufw and start it at boot.

sudo ufw enable

List nftables rules

Show the active nftables ruleset.

sudo nft list ruleset

List iptables rules

Show the filter table rules with counters and numeric addresses.

sudo iptables -L -n -v