By default, tcpdump tries to resolve IP addresses to hostnames and port numbers to service names. While this can be helpful, it may slow down capture and clutter output with less useful info during quick tests or detailed analysis.

To keep the output raw and fast, you can disable resolution using the -n and -nn options.

Why Disable Resolution?

Turning off name resolution:

  • Speeds up packet capture
  • Shows raw IPs and port numbers (more precise)
  • Avoids confusion from DNS lookups or service names

Use -n and -nn Options

tcpdump -n

This disables hostname resolution (IP addresses are shown as numbers).

tcpdump -nn

This disables both hostname and port number resolution.

Without -nn, you might see:

tcp 192.168.1.10.https > 192.168.1.5.55678

With -nn, you get:

tcp 192.168.1.10.443 > 192.168.1.5.55678

This is clearer when you need to identify exact ports.