# BIG-IP tcpdump builder > Assemble a BIG-IP-correct tcpdump command from structured choices: the TMM interface syntax, flow detail, snaplen, file output, and a BPF filter. It formats the command for you to run; it captures nothing. - Tool: https://ronutz.com/en/tools/f5-bigip-tcpdump-builder - Family: Networking --- ## What it does Assemble a correct `tcpdump` command for an F5 BIG-IP from structured choices: the interface (in BIG-IP's own syntax), how much TMM flow detail to include, the snap length, whether to write a capture file, and a BPF filter. The tool formats the command for you to copy and run on the device; it captures nothing itself and contacts no device. ## Why BIG-IP tcpdump is different On a BIG-IP, `tcpdump` runs against the Traffic Management Microkernel (TMM), and the interface argument is where it departs from stock tcpdump. Two BIG-IP-specific pieces matter most: - **The `0.0` interface** means every TMM data interface at once. It is powerful for finding where traffic is (or is not) flowing, but it is not rate-limited, so a filter is essential to avoid overwhelming the capture. - **The `:n` detail suffix** controls how much internal TMM information each packet line carries, and this is the part people most often get wrong. ## The detail suffix, and the mistake to avoid Appending a suffix to the interface raises the "noise" level: - **`:n`** (low) adds the virtual server name, the interface, and the direction. - **`:nn`** (medium) adds flow details. - **`:nnn`** (high) adds the IP and port of both sides of the BIG-IP, so you can follow a single connection across the proxy. A trailing **`p`** (as in `:nnnp`, or just `:p`) captures both sides of the proxy at once: the client-to-BIG-IP flow and the BIG-IP-to-pool-member flow. The classic mistake is to confuse this `:n` interface suffix with the `-n` command-line flag, which does something entirely unrelated (it disables name resolution). They are separate things, and the tool models them separately so you do not conflate them. ## Using it Choose the interface and detail level, set a snap length and an output file if you want them, add a BPF filter, and copy the assembled command. It is built from the options in F5's own packet-tracing guidance (K411 and K13637), so it is the command a BIG-IP will actually accept. ## Standards and references - [F5 K411 - Overview of packet tracing with the tcpdump utility](https://my.f5.com/manage/s/article/K411) - BIG-IP tcpdump options, the 0.0 interface, snaplen, filters, file output - [F5 K13637 - Capturing internal TMM information with tcpdump](https://my.f5.com/manage/s/article/K13637) - the :n / :nn / :nnn TMM detail suffix and the :p both-sides modifier ## Related reading - [BIG-IP tcpdump: How It Differs from Standard tcpdump](https://ronutz.com/en/learn/bigip-tcpdump-syntax.md): On a BIG-IP, tcpdump is the same binary you know from Linux, but the interface you capture on is not a NIC. The special 0.0 interface and the F5-only detail suffixes change how you build the command. This is the orientation for everything else. - [Capturing on VLANs, Self-IPs, and Trunks](https://ronutz.com/en/learn/capturing-on-vlans-and-trunks.md): 0.0 captures on every TMM interface, but sometimes you want to scope a capture to one segment. BIG-IP lets you name a VLAN, a self-IP, or other interface specifiers in place of 0.0, and each choice changes what you see. - [Capturing Safely on a Production BIG-IP](https://ronutz.com/en/learn/bigip-tcpdump-safety.md): tcpdump on a BIG-IP touches the data plane and the file system of a device that is carrying live traffic. A few habits, bounding the capture, watching disk space, and being deliberate about detail, keep a troubleshooting capture from becoming an incident. - [Reading a BIG-IP Capture: The F5 Trailer in Wireshark](https://ronutz.com/en/learn/reading-a-bigip-capture.md): A capture taken with the TMM detail suffix carries extra bytes after each packet. On its own that looks like noise. With the f5ethtrailer dissector, Wireshark turns it into readable fields that tell you exactly how BIG-IP handled each flow. - [TMM Detail Levels and Peer Flows (:n, :nn, :nnn, :p)](https://ronutz.com/en/learn/tmm-detail-and-peer-flows.md): The colon suffix on a BIG-IP capture interface is the most confusing and most useful part of the syntax. It controls how much internal TMM metadata is attached to each packet, and whether you capture one side of a connection or both.