What it does
tcpdump captures and displays packets traversing a network interface. It can decode headers, filter traffic in-kernel using BPF, and write raw captures to disk for later analysis in tools like Wireshark.
How it works (mechanical)
tcpdump uses libpcap to attach a capture socket to a network interface.
Packet filtering is compiled into a Berkeley Packet Filter (BPF) program that runs in the kernel,
ensuring only matching packets are copied to user space.
- Capture point: network interface (or monitor interface for Wi‑Fi)
- Filtering: kernel-level BPF
- Decoding: user space protocol dissection
- Output: human-readable text or pcap files
10 Practical Examples
# 1) List available capture interfaces tcpdump -D
# 2) Capture packets on an interface sudo tcpdump -i eth0
# 3) Capture only TCP traffic sudo tcpdump -i eth0 tcp
# 4) Capture traffic to/from a host sudo tcpdump -i eth0 host 192.168.1.10
# 5) Capture traffic on a specific port sudo tcpdump -i eth0 port 443
# 6) Capture and display packet contents (ASCII) sudo tcpdump -i eth0 -A
# 7) Increase verbosity (decode more protocol detail) sudo tcpdump -i eth0 -vv
# 8) Write packets to a capture file sudo tcpdump -i eth0 -w capture.pcap
# 9) Read packets from a capture file tcpdump -r capture.pcap
# 10) Capture Wi‑Fi traffic (monitor interface) sudo tcpdump -i mon0 -e -I
Notes & Gotchas
- Root privileges are typically required for live captures.
- Capturing on Wi‑Fi usually requires monitor mode.
- Unfiltered captures can generate huge files quickly.
- BPF filters are applied left‑to‑right; be explicit.
- Encrypted traffic still reveals metadata (IPs, ports, timing).
Historical Context
tcpdump originated at Lawrence Berkeley National Laboratory and
became the canonical UNIX packet sniffer. Its filtering syntax and capture model
formed the foundation for libpcap and modern tools like Wireshark.
Modern Equivalent / Related Tools
- wireshark — graphical packet analysis
- tshark — Wireshark CLI analyzer
- ngrep — regex-based packet inspection
- ss — socket-level connection inspection
- perf / eBPF tools — deep kernel/network tracing