DEV Community

Cover image for tcpdump and dig Examples You'll Actually Paste Into a Runbook
Schiff Heimlich
Schiff Heimlich

Posted on

tcpdump and dig Examples You'll Actually Paste Into a Runbook

#devops #sysadmin #networking #debugging

The man pages for tcpdump and dig are thorough. They are also useless when you are staring at a broken TLS handshake at 2 AM and need the exact filter syntax now.

Julia Evans put together the practical examples the man pages leave out. Here are the ones that have earned a permanent spot in my runbook.

tcpdump

Filter by TCP flags (SYN, FIN, RST) 

tcpdump -i eth0 "tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0"
Enter fullscreen mode Exit fullscreen mode

Use this when you need to see connection setup/teardown without the data packets drowning you out.

Extract SNI from TLS ClientHello 

tcpdump -i eth0 -s 0 -A "tcp port 443 and (tcp[((tcp[12] & 0xf0) >> 2):1] = 0x16)"
Enter fullscreen mode Exit fullscreen mode

The SNI is in the ClientHello (record type 0x16). This prints the raw packet so you can grep for the hostname. Not pretty, but it works without tshark.

Capture full conversation to a file 

tcpdump -i eth0 -s 0 -w capture.pcap host 10.0.1.5 and port 443
Enter fullscreen mode Exit fullscreen mode

-s 0 captures full packets (default truncates). Open capture.pcap in Wireshark later when you have coffee.

dig

Debug DNSSEC validation failures 

dig +dnssec +multi +noall +answer +authority +additional example.com
Enter fullscreen mode Exit fullscreen mode

+multi formats records in human-readable multiline. You will see RRSIG, DNSKEY, and DS records inline. If validation fails, compare the DS in the parent zone with the DNSKEY in the child.

YAML output for automation 

dig +yaml example.com A
Enter fullscreen mode Exit fullscreen mode

Outputs structured YAML instead of the default text format. Parses cleanly in scripts. No more awk wrestling with column alignment.

Trace the full delegation chain 

dig +trace +additional example.com
Enter fullscreen mode Exit fullscreen mode

Walks from root down to the authoritative servers. Shows every delegation, every glue record, every CNAME. When DNS "works everywhere but here," this tells you where the chain breaks.

Query a specific nameserver directly 

dig @ns1.example.com example.com A +noall +answer
Enter fullscreen mode Exit fullscreen mode

Bypasses your resolver. Essential for verifying what an authoritative server actually returns vs. what your recursive resolver cached.

Why These Stick

None of these are clever one-liners. They are the commands you reach for when:

  • A TLS handshake fails and you need to see what the client actually sent
  • DNSSEC validation breaks and you need to compare DS vs. DNSKEY
  • You need machine-readable dig output for a script that runs in CI
  • Someone says "it resolves fine for me" and you need to prove the authoritative server disagrees

Bookmark the ones that match your stack. Delete the rest. The man pages are still there if you need the full flag list — but these are the ones you will actually type.

What tcpdump or dig invocations live in your runbook? Drop them in the comments — I am always looking for the one I forgot.

Top comments (2)

Collapse
 
kashif_manzer profile image
Kashif Manzer •

One addition to the tcpdump section: pass -G 300 -W 5 -C 100 on long captures so the files rotate instead of one giant pcap filling the disk at 3 AM. It also makes it easier to share just the window around the incident. On the dig side, dig +nssearch for the SOA record lists every authoritative server's serial in one pass, which settles "did the zone change actually land everywhere" faster than +trace. The SNI filter is going straight into my notes.

Collapse
 
devdevdevss profile image
DEV VERIFY •

DEV-VERIFY
tr.ee/dev-to